Linux - Encryption
by Jeff Hatfield
pd: July 13, 2015
Encryption: The very “evil” thing the UK and US governments are looking to banish from the Internet is baked into Linux distributions. From whole-disk encryption, single files, email GPG encryption or Secure shell (ssh), Linux has you covered. The very fact Open Source encryption tools exist insures encryption will not ever disappear. Some of our “friends” at the big 3-letter agencies or nation-state entities use encryption to protect their data, so why shouldn’t you?
That said, it is also possible for such 3-letter agencies or government officials to force your hand and provide the decryption key for your data. In many situations where you would want to ensure even this could not happen, other options such as encrypting specific sets of data on your encrypted drive via hidden volumes utilizing multiple assorted keys (including images or other files along with your passphrase) with Truecrypt would provide foolproof protections against such strong-arm tactics.
Disk Encryption
If you use encryption you can be sure your files are stored on the disk in an encrypted form. Protection of is provided since your files only become available to the operating system and applications in readable form while the system is running and unlocked by a trusted user. Anyone looking at the disk contents directly will only find garbled random-looking data instead of actual files.
What instances would you think of where such encryption would be helpful?
- Your drive or system is located in a place where non-trusted people might gain access. Certain nefarious types or entities might attempt to install malware, keyloggers or Trojan horse programs on your system, but would be thwarted by an encrypted disk at rest.
- Your system is lost or stolen, as with laptops, netbooks or external storage devices
- Your shiny new laptop is in the repair shop
- After its useful lifetime to you, either discarded or donated to a charity
Be mindful of these items:
- You must consider threats to your system in a powered state including keyloggers and other malware designed specifically to take control while the system and access data before it is encrypted.
- Advanced crackers and nation states have the wherewithal, funding and incentives to perform such attacks, even on your encrypted system. In addition, anyone could wipe all data from your drive and repurpose or sell your system.
- The better option for security of your data would be to perform regular backups and if possible, use a trusted computing module (TPM) or hardware encryption device.
Data or System
Data encryption
Most of your data on a Linux system is located within the /home directory, but could be stored on removable media like a data DVD or external hard drive, USB stick or SDCard just as easily. And though it is the simplest and least intrusive method to encrypt your data, it does have some significant disadvantages.
There are many background processes caching metadata or parts of the data itself in non-encrypted areas of the hard drive. These areas include partitions for swap, /tmp, or /var. I’ve found the best solution for a normal home workstation or laptop is to keep maintain only the root partition / with the a swap and /home partitions, both of which can be encrypted as well.
System encryption
This method encrypts all content on a system including the operating system and user data and helps to address some of the inadequacies of data encryption.
This method encrypts all content on a system including the operating system and user data and helps to address some of the inadequacies of data encryption.
Benefits:
- Prevents unauthorized physical access to (and tampering with) operating system files
- Prevents unauthorized physical access to private data that may be cached by the system
Disadvantages:
- Unlocking of the encrypted parts of the disk can no longer happen during or after user login; it must now happen at boot time
In practice, there is not always a clear line between data encryption and system encryption, and many different compromises and customized setups are possible.
In any case, disk encryption should only be viewed as an adjunct to the existing security mechanisms of the operating system - focused on securing offline physical access, while relying on other parts of the system to provide things like network security and user-based access control.
Next topic: Encryption methods
