Filesystem Encryption

[ivoencarnacao]

I was planning to setup an encrypted filesystem for my Ubuntu, but i dont really know what are the best choices... anyone with some ideas?


Thanks for the help!
Ivo.

[tomBorgia]

truecrypt is pretty good... have to use the command line tho -
http://www.truecrypt.org/

[ivoencarnacao]

I was looking at this tutorial of LUKS to go (https://wiki.ubuntu.com/EncryptedFilesystemHowto4), what would be the diferences between them?

Thanks for your answer!
Ivo.

[tomBorgia]

trucrypt would be easier!

Here's how to install http://ubuntuforums.org/showthread.php?t=199367
Basically you create a file of a certain size as opposed to a entire filesystem - something like
truecrypt -c filename
and then specify the size and the encryption method, passcode etc. this then generates a file which you then mount to another directory with truecrypt.

e.g.
truecypt -c encryptedfile.tc //create the file - you'll be promted fo
//the required info...
mkdir /home/user/encrypted //the mount directory
truecrypt encryptedfile.tc /home/user/encrypted
//mounts the file on the directory - you can then use the directory as a normal directory, when finished -
truecrypt -d //dismounts the directory - the dir will then be empty but your data will be encrypted in the encrypted.tc file
Hope this is helpful.

[Chayak]

Just a note for you to take into consideration. You'll be creating a bottleneck in your filesystem and a cpu load whenever you write or read to the encrypted area. This can sometimes create problems with multimedia files being read from the drive unless you have a newer cpu. Your speed for the drive access will probably be in the 50MB/s range depending on which encryption scheme you use.

[etienne.navarro]

encfs is an option and similar to truecrypt

[etienne.navarro]

Originally Posted by Chayak Just a note for you to take into consideration. You'll be creating a bottleneck in your filesystem and a cpu load whenever you write or read to the encrypted area. This can sometimes create problems with multimedia files being read from the drive unless you have a newer cpu. Your speed for the drive access will probably be in the 50MB/s range depending on which encryption scheme you use.

Is this for all encryption schemes? I'm using LUKS on a P3 and doesn't seem to create any bottleneck.

[etienne.navarro]

FWIW here are some tests I ran using dbench.

Encryption used is LUKS: SHA256, AES cipher with 256 keysize (followed EncryptedFilesystemHowto3)
File system is XFS, no special parameters and journal on same disk. No special hdparm settings in place either.

Machine 1: Pentium III (Coppermine), 866MHz, cache size 256KB, 512MB SDRAM

• Regular: Throughput 67.802 MB/sec 10 procs

• LUKS: Throughput 57.2743 MB/sec 10 procs

• hdparm -tT /dev/hdX:
  • Timing cached reads: 460 MB in 2.00 seconds = 230.00 MB/sec
  • Timing buffered disk reads: 110 MB in 3.02 seconds = 36.42 MB/sec

Machine 2: Pentium 4 1.60GHz, 2133 MHz, cache size 512KB, 1024MB DDR RAM

• Regular:Throughput 146.437 MB/sec 10 procs

• LUKS: Throughput 129.104 MB/sec 10 procs

• hdparm -tT /dev/hdX:
  • Timing cached reads: 1680 MB in 2.00 seconds = 840.00 MB/sec
  • Timing buffered disk reads: 146 MB in 3.03 seconds = 48.18 MB/sec

So there is a drop in performance by about 10-15% (in my case), but doesn't necessary limit the drive access speed to 50MB/s (for LUKS).

Note: if you run these tests, make sure dbench is on the same hard disk you are running the tests on.

[Chayak]

It will vary but I was speaking more from previous benchmarks with TrueCrypt. Like everything it can vary greatly with different configurations but there is a potential bottleneck for some systems. Thats where hardware ran encryption picks up.

[ivoencarnacao]

So we have TrueCrypt, LUKS, EncFS with the FUSE thing and, what else is there?

Which one could be considered the most secure? Can we choose one with security / performance balance?


I was planning to use LUKS on a XFS partition in my "stylish" Ubuntu Edgy laptop (1,5Ghz Centrino, 512 RAM, 60GB 4200RPM HDD) but at this point i really dont know where to go!

Not even if XFS would be my best choice...


So, all the help would be just GREAT!