Specifically, Linux.

I would love to be able to use TrueCrypt consistently across all my machines, be they Windows or Linux. As it stands, I can do full-disk encryption with pre-boot authentication only on Windows.

I don't really understand why this is. Are there technical challenges specific to Linux/Mac that make full disk encryption harder? Does anyone know whether TrueCrypt will support this in the near future.

PS. yes, I'm aware that there are other options. My goal is to simplify my life here and use the one tool across all machines.

  • I haven't found references anywhere from the contrary about the status of ext2/3/4 partitions, if someone has stronger google-fu, please provide authoritative references. – Braiam Mar 21 '14 at 14:36
  • "I can do full-disk encryption with pre-boot authentication only on Windows." Untrue. Debian and Ubuntu have supported LUKS/dm-crypt based FDE for a long time now. It's not "Truecrypt"-compatible but it's effective FDE nonetheless. – LawrenceC Mar 21 '14 at 15:10
  • @ultrasawblade again, OP wants a TrueCrypt solution. – Braiam Mar 24 '14 at 3:51

Because they just haven't done it yet. They would have to support ext1/2/3/4 and reiserfs, for example. Also, what's with SWAP? Swap has to be encrypted too, or part of your data is just there (at least what you've loaded, etc).

They also have to cope for GRUB and LILO. Where do they put it in? After the boot manager? Do they modify your init.rd?

It's of course more complicated because they'd have to cope with infinite kinds of configurations. Literally everyone could have their bootloaders somewhere else.

On Windows it's all in the same place and the same everytime.

  • So the other options for full-disk encryption on linux have overcome this complication, but truecrypt haven't done so yet? – cantloginfromwork May 16 '11 at 11:35
  • Yep, the team of TrueCrypt hasn't quite completed this yet. I don't know of any beta or alpha of this, too. So they might not even be planning it :). – sinni800 May 16 '11 at 11:36
  • those other options are built into linux, often at kernel level, so its simpler – Journeyman Geek May 16 '11 at 12:05
  • 2
    They don't have to figure ext2/3/4/whatever - proper FDE works at block level, and uses a block layer driver to decrypt. I suspect windows has this done through the boot storage driver and later registering truecrypt driver as filter between disk and filesystem drivers. – p_l Feb 14 '13 at 21:57
  • "On Windows it's all in the same place and the same everytime." Ya, Windows gets loaded with a simple chainload +1, whereas Linux needs you to find kernel, initrd, etc... I can definitely understand some of the challenges of full-disk encryption.. Oh, well, at least the Linux community is full of Geeks who like to tinker with stuff. hopefully someone will DIY it. (I'm currently thinking of having a TC'ed /home folder..) – JamesTheAwesomeDude May 11 '13 at 22:08

Because it's much work to implement that and there isn't much need for that for two reasons:

  • Linux and OS X have their own full disk encryption mechanisms, which can't be easily accessed from another OS¹, but
  • if one separates system from data partitions, the former don't usually contain interesting data one might want to access from another OS; so you can still use Truecrypt for the latter.

They also don't seems to have any plans to start any time soon.

On a side note, in my experience Truecrypt isn't nearly as well integrated into Linux and OS X system environments as into Windows, i. e. there's no mount helper for it.

¹ It is possible to access LUKS-encrypted ext2/3/4 partitions from Windows with FreeOTFE and ext2FSD under certain conditions, which is also my current setup.

  • So, there isn't a single clue if the team will work on this? – Braiam Mar 24 '14 at 18:36
  • I didn't even try to answer that because that wasn't the question (to my understanding). As far as truecrypt.org/future goes, there's no plan to implement that feature. – David Foerster Mar 25 '14 at 3:45
  • Is in my comment – Braiam Mar 25 '14 at 4:35
  • "if one separates system from data partitions, the former don't usually contain interesting data one might want to access from another OS" Well, not really true. If the kernel, other boot files and system binaries are unprotected, it's trivial to plant malicious code into the system partition. You could, for example, extract the kernel build configuration, make a new kernel of the same version and with the same configuration but which stores to some unencrypted location all keyboard I/O while cryptsetup is running, and have a trivial way of entry into the supposedly protected data. – a CVn Apr 17 '14 at 11:19
  • Entirely true, yet I never said anything about leaving system partitions unencrypted. I was merely talking about separate security schemes for system and non-system data. Besides, encryption isn't the only way to prevent injection of malicious code. My first idea would be electronic signatures. – David Foerster Apr 18 '14 at 11:49

Fedora 18+ supports this. And nothing really stands in the way of implementing it yourself. Linux provide all the hooks in making the proper initrd. It is just not supported by any Linux distribution except Fedora (since 18).

It would really not be too hard, especially since cryptsetup already supports truecrypt. The initrd people haven't really gotten around to supporting the truecrypt flag in /etc/crypttab (taking the proper actions when it appears, ie. include truecrypt in the initrd, and decrypt the indicated container).

  • You do realize TrueCrypt itself was discontinued in 5/2014, so the point is moot? – DevSolar Feb 18 '15 at 12:33
  • Truecrypt is still supported by cryptsetup on Linux, and it's successors are still going strong. And the 7.1a version of TrueCrypt is still usable, so it's not moot. – PePa Feb 22 '17 at 11:40
  • "WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues." (truecrypt.sourceforge.net) – DevSolar Feb 22 '17 at 11:45
  • There are stange circumstances around TrueCrypt's termination. Most hold nowadays that the 7.1a version is still secure. But there have been improvements, see Veracrypt and other continuations. The encryption is cleanly implemented in LUKS, so you could use that as well. – PePa Mar 26 '17 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.