Slashdot Mirror

← Back to Stories (view on slashdot.org)

Encrypted Volumes for Linux and Windows?

Posted by Cliff on from the privacy-in-dual-booting dept.

share_it asks: "On my Win PC I used a lot of encryption: I had encrypted small files for personal stuff, encrypted virtual disks for programs, music, video, etc. I used PGPdisk and mounted 3 big virtual disks (for a total of 170 gigs) on startup with just one single passphrase and those 'disks' were even quite fast. I have now switched to GNU-Linux for most of my interests, but sometimes I have to use Windows and I want my data to be encrypted and accessible from both OSes The only software that I found which can mount the same encrypted disk on both platforms is BestCript, but from Linux I can't store file with long names. Is there a better way to share encrypted data between when I dual-boot?"

59 comments

  1. Just how long do you want it to be? by orthogonal · · Score: 0, Flamebait

    want my data to be encrypted and accessible from both OSes The only software that I found which can mount the same encrypted disk on both platforms is BestCript, but from Linux I can't store file[s] with long names. Is there a better way to share encrypted data between when I dual-boot?

    I understand you want it uh, instantly "to hand" regardless of the OS you boot, but for the love of god, why do you need long names for your porn files?

    I mean, I mean, isn't "dnkymdgt.mpg" just as emotional moving as "donkey makes sweet, sweet love to gay midget.mpeg"?

    Length isn't everything, man.

    --
    Opinions on the Twiddler2 hand-held keyboard?
  2. NAH6's Secure-Notebook project covers this by schmaltz · · Score: 4, Informative

    Although Rop has moved on to other projects, Secure Notebook was a pretty good idea. The software may still be useful (documentation here, check the page for file signatures.)

    IIRC, this was a secure-ified Debian with encrypted swap, encrypted partitions, running VMWare which ran Win2K as a guest o/s. The idea was to run Windows while treating it as a small child that keeps burning itself on the stove. Everything was filtered thru the Linux host o/s, including network and hardware access.

    Also, I believe the encryption key was provided in two parts: a dongle containing part of the key, and then also a key requested of the user during boot.

    Worth a look.

    --
    Big Daddy, Johnny, Burp, Aunt Zelda, Scott, Slurp, Big Momma ... where's Siggy?
    1. Re:NAH6's Secure-Notebook project covers this by MagiGraphX · · Score: 1, Funny

      Also, I believe the encryption key was provided in two parts: a dongle containing part of the key, and then also a key requested of the user during boot.

      Ha. You said dongle.

  3. Re:Do they have to be encrypted? by baywulf · · Score: 0, Troll

    "The reason why could suggest a solution."

    He is just John Asscroft asking for how to encrypt the top secret database of foreign lobbyists. Doesn't want to risk it on that nearly failing hard drive so he is planning to back it up.

  4. tin foil by ralphus · · Score: 2, Interesting
    the poster seems to be going through the "i just discovered crypto" phase where everything should be encrypted. 170 gb of encrypted partitions for all his programs, music, video etc? EGADS!

    I have been around the crypto block a time or two and unless i completely missed it, I don't think there is a solution for what the poster is looking for other then bestcrypt.

    I was once where the poster is, encrypting all my partitions including swap with a USB token required for boot. it was a nice excercise in orwellian paranoia and i learned a lot, but it is completely impractical and a total pain in the ass.

    best of luck to the poster in his quest for ultimate, um, security.

    --
    Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
    1. Re:tin foil by kisielk · · Score: 2, Insightful

      Care to explain why encrypting your partitions with a USB token required was completely impractical and a pain in the ass? Specifically, what problems and inconveniences did you run in to with this setup? I'm just curious..

    2. Re:tin foil by ralphus · · Score: 2, Informative

      mainly because I always had to have the darn thing or I couldn't use the computer. Also because it slowed things down a bunch, made anything like accessing the drive from another OS an impossibility and generally did it's job. It was basically a trade off in usability/security that eventually rose past my patience for the useless personal email about inane things, porn and personal digital audio i was "protecting". Oh, i also spent a lot of time being paranoid about losing my USB token and therefore all my data because I just have that kind of worrysome personality.

      --
      Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
    3. Re:tin foil by 0x0d0a · · Score: 1

      I'm guessing that it's a pain to set up.

      None of the mainstream distros have idiot-proof "check to use encryption" interfaces. It probably took a lot of work to set this beast up.

      --
      May we never see th
    4. Re:tin foil by Hank+Reardon · · Score: 1

      Ack!

      Thread.... Broken.... reply under different parent.... Triggering nurosis!

      --
      There's so little difference between politics and jihad lately...
    5. Re:tin foil by Anonymous Coward · · Score: 2, Informative

      It is not paranoid to be concerned with security. As a person who has recieved a "visit" from federal agents, I know of what I speak.

      I view my machines as extensions of my mind. Whatever I have in my mind is private. No one's business except my own. I have nothing "illegal" on any of my machines, but I was once involved with what some people might deem "fringe" politics. The worst thing that could have happened was for someone to take information from me and use it against someone who shared my goals.

      For example, let us say that there was an unsolved crime that happed in a specific place at a specific time. In order to discredit someone, the authorities would only need to place them nearby at the time of the crime. An old lady gets mugged and the mugger takes $50 from her. You happen to be 5 miles away at the time and you spend $45 on some widget...Next thing you know "We can't prove he did it, but he was in the area at the time and spending the same amount of money that was missing. Do you want to believe his word or ours?"

      Don't ask why I'm anonymous.

    6. Re:tin foil by Anonymous Coward · · Score: 0

      It's that view that causes people to not bother about privacy at all. Security in general is a "pain in the ass"...so why bother at all? Why bother with PGP? Why sign/encrypt your messages? Why install patches? Why read EULAs and privacy agreements?

      It's all a big pain the ass. So let's just not bother!

  5. Re:tsarkon reports how about a working filesystem by Anonymous Coward · · Score: 0

    mod the bastard down, but he is right.

  6. Safe deposit by metalhed77 · · Score: 2, Funny

    I would also be paranoid as hell about my usb token. You ever consider copying it and storing one in a safe deposit box?

    --
    Photos.
    1. Re:Safe deposit by ralphus · · Score: 1

      Yes, but that would mean that the feds could get it if they ever wanted at my aria giovanni collection. I had to keep the only copy around my neck so I could destroy it the instant they kicked down my door and leave my data hopefully un-recoverable.

      --
      Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
    2. Re:Safe deposit by Anonymous Coward · · Score: 0

      Tere ARE other ways of doing this. One way would be to use a page of a book'n hash (where you would remember the page number) to recreate the key if it should ever by destroyed. Youwould have to type in the page exactly again but hey, its better than all your data. Other possibilities would include a hash of a digital photo or a mandelbrot set generator which has secific code and where you know the size and coordinates and type them in and it could regen your key. Point is, it is possible to generate keys in uch a way that you can always recreate them if you should ever need to by using a long text to seed a RNG.

    3. Re:Safe deposit by harrkev · · Score: 3, Funny

      I assume that you got a small one that you could swallow. Chewing would be tough, though (and might break a tooth).

      I hope they used lead-free solder.

      --
      "-1 Troll" is the apparently the same as "-1 I disagree with you."
    4. Re:Safe deposit by Anonymous Coward · · Score: 0

      Chewing would be tough, though (and might break a tooth).

      One good bite with your molars, once you hear the chip "crunch", all of the work is done.

    5. Re:Safe deposit by Anonymous Coward · · Score: 0

      Either that or you just broke a molar.

    6. Re:Safe deposit by magefile · · Score: 1

      Hmm ... did you by any chance read the article a few weeks/months ago about the spammer from (I think) Eire?

  7. Try a modified approach by tchuladdiass · · Score: 4, Interesting

    First, you don't need the OS encrypted. The most you'll need is /var, /tmp, /home and swap (and /data or wherever you put your bulk data files). So, that takes care of having to get the OS to boot off an encrypted volume.
    Now, to make things easy, you probably will only need to access /home and /data from windows. So, when you boot windows, fire up a virtual host program (either vmware, or a free alternative) to boot a linux kernel / mini distribution, which then mounts & exports /home and /data via samba, then use the virtual network connection to mount those volumes from windows.
    Of course, in windows, you never know where it may leave temp files laying around, so you might want to encrypt the entire win volume using a seperate utility.

    1. Re:Try a modified approach by Anonymous Coward · · Score: 2, Interesting

      First, you don't need the OS encrypted.

      If you're concerned about someone editing one of the binaries, then you want the OS to be encrypted.

    2. Re:Try a modified approach by Tux2000 · · Score: 2, Interesting

      First, you don't need the OS encrypted. The most you'll need is /var, /tmp, /home and swap (and /data or wherever you put your bulk data files).

      Right. Encrypting the OS is encrypting known data. <paranoia>This may lead to a key recovery by just comparing the encrypted OS and the unencrypted OS.</paranoia> Regarding encrypted swap: I think encrypting swap slows down too much. Just a dd if=/dev/random of=swappartition in the shutdown script should do the job as well. OK, if someone knocks you down, rips out the HDD of your PC before it has a chance to shut down properly, and runs strings swappartition | grep somepattern, he might find something useful. Decide yourself how important your data security is. You could also add some more RAM and do not use a swap partition at all.

      I think "Windows in VMware" is the way to do work with encrypted data with more than one OS. Always boot Linux, configure its firewall as paranoid as possible, and "wire" Windows in it's VMware box to the inside of the firewall. Mount your data directory via Samba in Windows. Encrypt and decrypt it in Linux. Make sure there is no way to connect to the VMware virtual LAN except inside your PC; this also means to set up firewall (iptables) rules to prohibit a connection to Samba from the real LAN or Wireless LAN.

      Tux2000

      --
      Denken hilft.
    3. Re:Try a modified approach by alien+at+large · · Score: 2, Informative
      So, when you boot windows, fire up a virtual host program (either vmware, or a free alternative) to boot a linux kernel / mini distribution
      Colinux may be another nice alternative for this scenario.
    4. Re:Try a modified approach by Ckwop · · Score: 1

      <paranoia>This may lead to a key recovery by just comparing the encrypted OS and the unencrypted OS.</paranoia>

      No.. almost all decent encryption algorithms are secure against this "known plain-text" attack. AES (and all decent ciphers) can withstand attacks where the attacker can choose the plain-text to be encrypted and then is given the result.

      Simon.

    5. Re:Try a modified approach by Anonymous Coward · · Score: 0

      No.. almost all decent encryption algorithms are secure against this "known plain-text" attack.

      But hybrid attacks are just as easy, regardless of the algorithm. A typical known plain text attack might not be very effective, but brute force becomes easier. Take a file that is only a few bytes long and try every possible key. Since the data is small, the keys can be tried very rapidly. It will still be too hard for a script kidde to recover your key, but the big boys will have it in a matter of weeks.

    6. Re:Try a modified approach by Steve+B · · Score: 1
      If you're concerned about someone editing one of the binaries, then you want the OS to be encrypted.

      No, you want it to be digitally signed, which is related in some ways but not the same thing.

      --
      /. If the government wants us to respect the law, it should set a better example.
    7. Re:Try a modified approach by Kjella · · Score: 1

      Right. Encrypting the OS is encrypting known data. [paranoia]This may lead to a key recovery by just comparing the encrypted OS and the unencrypted OS.[/paranoia]

      That's the difference between a weak and strong cryptoalgorithm (nothing to do with key size). And the last weak algorithm in use is the zip password protection. Anything even remotely seriously considered for cryptography does not have this vunerability.

      That being said, I had a lot of fun in my day recovering zip files. Change passwords? Reposted something? Whoops, I got your new pw too. Hell, some people still use it because it's the least common denominator...

      Kjella

      --
      Live today, because you never know what tomorrow brings
  8. Re:WTF IS THIS?!?! by Nermal6693 · · Score: 4, Funny

    Since we're already off topic...

    I'd honestly love to see ActiveX ads. Especially if they become more popular than Flash ads. Why? Because none of the browsers/OSes I use support ActiveX. Built-in ad blocking at its finest :)

  9. Re:WTF IS THIS?!?! by Anonymous Coward · · Score: 0

    really? well how bout not installing the flash plugin. instant ad blocking. But then again, what about those pesky .gif and .jpg, etc ads. Easy, just turn off graphics in your browser. What a wonderful web experience. Or one could simply just deal with it.

  10. Samba/IPSEC by harikiri · · Score: 1

    Just pulling a solution out of my arse. Have a fileserver on the network (unix of some kind), sharing files via Samba. Create an IPSEC tunnel and access the shares.

    --
    Man watching 6 MSCE's around a sun box, looks alot like the opening scene's of 2001:space odyssey...
  11. BestCrypt is great by davegaramond · · Score: 5, Informative

    I have been using BestCrypt for several years and it's great. Unfortunately it's the only solid product available on Linux and Windows that I know of.

    Why can't you store long filenames on Linux? BestCrypt just provides a block device on which you can use any filesystem. FAT32/VFAT is fine for Linux-Windows work. I've formatted a Bestcrypt volume with fat, vfat, iso9660, ext2, ext3, reiserfs, all without any problem.

    Another alternative is to use VMware and then use ext3 on Bestcrypt and serve Windows needs with Samba.

    1. Re:BestCrypt is great by sadiklis · · Score: 1

      Care to post a short doc on it? I mean: "A description how to work with encrypted partitions !" (www.scherrer.cc/crypt).

    2. Re:BestCrypt is great by sadiklis · · Score: 1

      Oops, sorry. My reading accuracy needs an improvement :-)

  12. Re:WTF IS THIS?!?! by afidel · · Score: 1

    Hmm, I have the Mozilla click to play flash plugin installed, I have aminations turned to once, and popups blocked. When people see me browsing they can't believe how non-distracting an experience it is. That's how I've converted plenty of people over, that and telling them I won't clean the spyware crap off their machine again if they insist on continuing to run IE.

    --
    There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
  13. Use Opera by vijaya_chandra · · Score: 1

    Continuing the offtopic thread....

    Disable loading of images by default which is the best thing to do

    and when you get to a page where you need to view the images, just press 'g' (without quotes ;) ) and voila there your images appear
    That you can enable this per-tab is an extremely good option in Opera. In IE and Firefox enabling/disabling images seem to get applied to all windows/tabs which is quite annoying to say the least. I guess there'd be some plugin available for both those browsers but needless to say people like me would be too lazy to search for things

    1. Re:Use Opera by nri · · Score: 1

      http://white.sakura.ne.jp/~piro/xul/_tabextensions .html.en

      --
      if :w! doesn't work, try :!cvs commit -m""
  14. Try the munitions site by Ragetech · · Score: 2, Informative

    Well, I'm not sure if this is a mirror or the primary, but anyway check this out: Munitions - cryptographic software for Linux.

    At home w/ SuSE I use cryptofs, but if you don't have SuSe here's something else that looks pretty good (And I think OpenBSD has this one too)-- CFS. I think there are actually a lot of options out there for you, just look around through Google.

  15. 2nd The BestCrypt Recommendation. by zorkmid · · Score: 1

    I'm using BestCrypt with my container file on a 256Meg USB Pen Drive. Format the container as FAT32 and you can mount it on both W2k, XP or Linux.

    Grab the evaluation versions and give it a whirl.

    http://www.jetico.com/

  16. ok what do you need ? by johnjones · · Score: 2, Interesting

    what do you need ?

    how about a file e.g. tar/zip of all your files that is encrypted each time you login/logout ?
    use a standard AES/DES and secure deletion

    whats wrong with this ?

    slow
    unsecure if power fails

    but with everthing else you are at vendors mercy

    I would use PGP disk or a secure online file server...

    regards

    John Jones

    1. Re:ok what do you need ? by Anonymous Coward · · Score: 0

      Does anyone know if there is a PGPdisk alternative compatible with gnupg? It would be nice if i could create a container encrypted with DSA/ELG and use the same key that i sent to the keyservers.

      Gnupg claims that they are a complete replacement for pgp... but they don't have pgpdisk!

      Anyone also know if they are planning to make a pgpdisk alternative?

  17. ho ho by samjam · · Score: 1

    Ho ho!

    And of course you wont be cleaning much spyware off their PC if they don't use IE either!

    Sam

    --
    blog.sam.liddicott.com
  18. Re:WTF IS THIS?!?! by Chess_the_cat · · Score: 1
    I have news for you: you can have the exact same browsing experience in IE. I haven't seen a popup in 2 years, and haven't seen an ad in 6 months (not even a Google text ad mind you). And yet, I still have graphics turned on. I guess that makes me a some type of computer genius if I can figure it out and you can't huh?

    But, as a disclaimer, I still run Firefox quite a bit because it's so blindingly fast. The problem keeping me from switching to Firefox completely is that the Ad Block extension is utter shit. I may not see ads but I do get to see huge blocks of color where the ads used to be. Not to mention that the Google Toolbar provided in Firefox isn't as complete as the IE download.

    --
    Support the First Amendment. Read at -1
  19. fileserver+terminal by Iron_Fist · · Score: 1

    how about having a file server with linux and which ever encryption you like, serving the files over nfs and samba ?

  20. Flash Banner Ads are nothing new by Anonymous Coward · · Score: 0

    I've seen flash banner ads for well over a year now.

  21. Re:WTF IS THIS?!?! by golgotha007 · · Score: 1

    for those of you not running the separate googlebar extension for firefox, RUN do not walk and download the googlebar extension right now!

  22. Re:WTF IS THIS?!?! by Nermal6693 · · Score: 1

    I have a rather large /etc/hosts file, with plenty of 127.0.0.1 entries. Gets rid of most of the ads, while keeping the "useful" graphics :)

  23. Re:WTF IS THIS?!?! by Anonymous Coward · · Score: 0

    my firewall redirects ad requests and instead shows pictures and previes of porn it has recently downloaded for me

  24. not quite so easy by Anonymous Coward · · Score: 0

    and how do you know where that few byte file is on a 10GB partition? If a filesystem is placed on an encrypted block device, you have no idea. It all looks like random shit.

  25. Mmmm, Aria Giovanni by empaler · · Score: 1

    If she asked nicely, would you turn her down?

    1. Re:Mmmm, Aria Giovanni by ralphus · · Score: 1

      she could ask in a very disrespectful way and i wouldn't turn her down.

      --
      Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout