Slashdot Mirror

← Back to Stories (view on slashdot.org)

Encrypted Volumes for Linux and Windows?

Posted by Cliff on from the privacy-in-dual-booting dept.

share_it asks: "On my Win PC I used a lot of encryption: I had encrypted small files for personal stuff, encrypted virtual disks for programs, music, video, etc. I used PGPdisk and mounted 3 big virtual disks (for a total of 170 gigs) on startup with just one single passphrase and those 'disks' were even quite fast. I have now switched to GNU-Linux for most of my interests, but sometimes I have to use Windows and I want my data to be encrypted and accessible from both OSes The only software that I found which can mount the same encrypted disk on both platforms is BestCript, but from Linux I can't store file with long names. Is there a better way to share encrypted data between when I dual-boot?"

5 of 59 comments (clear)

  1. tin foil by ralphus · · Score: 2, Interesting
    the poster seems to be going through the "i just discovered crypto" phase where everything should be encrypted. 170 gb of encrypted partitions for all his programs, music, video etc? EGADS!

    I have been around the crypto block a time or two and unless i completely missed it, I don't think there is a solution for what the poster is looking for other then bestcrypt.

    I was once where the poster is, encrypting all my partitions including swap with a USB token required for boot. it was a nice excercise in orwellian paranoia and i learned a lot, but it is completely impractical and a total pain in the ass.

    best of luck to the poster in his quest for ultimate, um, security.

    --
    Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
  2. Try a modified approach by tchuladdiass · · Score: 4, Interesting

    First, you don't need the OS encrypted. The most you'll need is /var, /tmp, /home and swap (and /data or wherever you put your bulk data files). So, that takes care of having to get the OS to boot off an encrypted volume.
    Now, to make things easy, you probably will only need to access /home and /data from windows. So, when you boot windows, fire up a virtual host program (either vmware, or a free alternative) to boot a linux kernel / mini distribution, which then mounts & exports /home and /data via samba, then use the virtual network connection to mount those volumes from windows.
    Of course, in windows, you never know where it may leave temp files laying around, so you might want to encrypt the entire win volume using a seperate utility.

    1. Re:Try a modified approach by Anonymous Coward · · Score: 2, Interesting

      First, you don't need the OS encrypted.

      If you're concerned about someone editing one of the binaries, then you want the OS to be encrypted.

    2. Re:Try a modified approach by Tux2000 · · Score: 2, Interesting

      First, you don't need the OS encrypted. The most you'll need is /var, /tmp, /home and swap (and /data or wherever you put your bulk data files).

      Right. Encrypting the OS is encrypting known data. <paranoia>This may lead to a key recovery by just comparing the encrypted OS and the unencrypted OS.</paranoia> Regarding encrypted swap: I think encrypting swap slows down too much. Just a dd if=/dev/random of=swappartition in the shutdown script should do the job as well. OK, if someone knocks you down, rips out the HDD of your PC before it has a chance to shut down properly, and runs strings swappartition | grep somepattern, he might find something useful. Decide yourself how important your data security is. You could also add some more RAM and do not use a swap partition at all.

      I think "Windows in VMware" is the way to do work with encrypted data with more than one OS. Always boot Linux, configure its firewall as paranoid as possible, and "wire" Windows in it's VMware box to the inside of the firewall. Mount your data directory via Samba in Windows. Encrypt and decrypt it in Linux. Make sure there is no way to connect to the VMware virtual LAN except inside your PC; this also means to set up firewall (iptables) rules to prohibit a connection to Samba from the real LAN or Wireless LAN.

      Tux2000

      --
      Denken hilft.
  3. ok what do you need ? by johnjones · · Score: 2, Interesting

    what do you need ?

    how about a file e.g. tar/zip of all your files that is encrypted each time you login/logout ?
    use a standard AES/DES and secure deletion

    whats wrong with this ?

    slow
    unsecure if power fails

    but with everthing else you are at vendors mercy

    I would use PGP disk or a secure online file server...

    regards

    John Jones