Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Encryption Operating Systems Security Software Windows Linux

Encrypted Volumes for Linux and Windows? 59

Posted by Cliff from the privacy-in-dual-booting dept.
share_it asks: "On my Win PC I used a lot of encryption: I had encrypted small files for personal stuff, encrypted virtual disks for programs, music, video, etc. I used PGPdisk and mounted 3 big virtual disks (for a total of 170 gigs) on startup with just one single passphrase and those 'disks' were even quite fast. I have now switched to GNU-Linux for most of my interests, but sometimes I have to use Windows and I want my data to be encrypted and accessible from both OSes The only software that I found which can mount the same encrypted disk on both platforms is BestCript, but from Linux I can't store file with long names. Is there a better way to share encrypted data between when I dual-boot?"
This discussion has been archived. No new comments can be posted.

Encrypted Volumes for Linux and Windows? More

Encrypted Volumes for Linux and Windows?

Comments Filter:

  • NAH6's Secure-Notebook project covers this (Score:5, Informative)

    by schmaltz ( 70977 ) on Tuesday June 29, 2004 @10:20PM (#9567161)
    Although Rop has moved on to other projects, Secure Notebook [nah6.com] was a pretty good idea. The software [wwwnah6.com] may still be useful (documentation here [nah6.com], check the page [nah6.com] for file signatures.)

    IIRC, this was a secure-ified Debian with encrypted swap, encrypted partitions, running VMWare which ran Win2K as a guest o/s. The idea was to run Windows while treating it as a small child that keeps burning itself on the stove. Everything was filtered thru the Linux host o/s, including network and hardware access.

    Also, I believe the encryption key was provided in two parts: a dongle containing part of the key, and then also a key requested of the user during boot.

    Worth a look.

  • tin foil (Score:3, Interesting)

    by ralphus ( 577885 ) on Tuesday June 29, 2004 @10:28PM (#9567198)
    the poster seems to be going through the "i just discovered crypto" phase where everything should be encrypted. 170 gb of encrypted partitions for all his programs, music, video etc? EGADS!

    I have been around the crypto block a time or two and unless i completely missed it, I don't think there is a solution for what the poster is looking for other then bestcrypt.

    I was once where the poster is, encrypting all my partitions including swap with a USB token required for boot. it was a nice excercise in orwellian paranoia and i learned a lot, but it is completely impractical and a total pain in the ass.

    best of luck to the poster [lynchzone.com] in his quest for ultimate, um, security.

    • Re:tin foil (Score:3, Insightful)

      by kisielk ( 467327 )
      Care to explain why encrypting your partitions with a USB token required was completely impractical and a pain in the ass? Specifically, what problems and inconveniences did you run in to with this setup? I'm just curious..

    • Re:tin foil (Score:3, Informative)

      by ralphus ( 577885 )
      mainly because I always had to have the darn thing or I couldn't use the computer. Also because it slowed things down a bunch, made anything like accessing the drive from another OS an impossibility and generally did it's job. It was basically a trade off in usability/security that eventually rose past my patience for the useless personal email about inane things, porn and personal digital audio i was "protecting". Oh, i also spent a lot of time being paranoid about losing my USB token and therefore all

    • Re:tin foil (Score:2, Informative)

      by Anonymous Coward
      It is not paranoid to be concerned with security. As a person who has recieved a "visit" from federal agents, I know of what I speak.

      I view my machines as extensions of my mind. Whatever I have in my mind is private. No one's business except my own. I have nothing "illegal" on any of my machines, but I was once involved with what some people might deem "fringe" politics. The worst thing that could have happened was for someone to take information from me and use it against someone who shared my goals.

      For

  • Try a modified approach (Score:5, Interesting)

    by tchuladdiass ( 174342 ) on Tuesday June 29, 2004 @11:26PM (#9567611) Homepage
    First, you don't need the OS encrypted. The most you'll need is /var, /tmp, /home and swap (and /data or wherever you put your bulk data files). So, that takes care of having to get the OS to boot off an encrypted volume.
    Now, to make things easy, you probably will only need to access /home and /data from windows. So, when you boot windows, fire up a virtual host program (either vmware, or a free alternative) to boot a linux kernel / mini distribution, which then mounts & exports /home and /data via samba, then use the virtual network connection to mount those volumes from windows.
    Of course, in windows, you never know where it may leave temp files laying around, so you might want to encrypt the entire win volume using a seperate utility.

    • Re:Try a modified approach (Score:2, Interesting)

      by Anonymous Coward
      First, you don't need the OS encrypted.

      If you're concerned about someone editing one of the binaries, then you want the OS to be encrypted.
      • If you're concerned about someone editing one of the binaries, then you want the OS to be encrypted.

        No, you want it to be digitally signed, which is related in some ways but not the same thing.

    • First, you don't need the OS encrypted. The most you'll need is /var, /tmp, /home and swap (and /data or wherever you put your bulk data files).

      Right. Encrypting the OS is encrypting known data. <paranoia>This may lead to a key recovery by just comparing the encrypted OS and the unencrypted OS.</paranoia> Regarding encrypted swap: I think encrypting swap slows down too much. Just a dd if=/dev/random of=swappartition in the shutdown script should do the job as well. OK, if someone knocks you

      • <paranoia>This may lead to a key recovery by just comparing the encrypted OS and the unencrypted OS.</paranoia>

        No.. almost all decent encryption algorithms are secure against this "known plain-text" attack. AES (and all decent ciphers) can withstand attacks where the attacker can choose the plain-text to be encrypted and then is given the result.

        Simon.

      • Right. Encrypting the OS is encrypting known data. [paranoia]This may lead to a key recovery by just comparing the encrypted OS and the unencrypted OS.[/paranoia]

        That's the difference between a weak and strong cryptoalgorithm (nothing to do with key size). And the last weak algorithm in use is the zip password protection. Anything even remotely seriously considered for cryptography does not have this vunerability.

        That being said, I had a lot of fun in my day recovering zip files. Change passwords? Repost
    • So, when you boot windows, fire up a virtual host program (either vmware, or a free alternative) to boot a linux kernel / mini distribution
      Colinux may be another nice alternative for this scenario.
  • Just pulling a solution out of my arse. Have a fileserver on the network (unix of some kind), sharing files via Samba. Create an IPSEC tunnel and access the shares.

  • BestCrypt is great (Score:5, Informative)

    by davegaramond ( 632107 ) on Wednesday June 30, 2004 @03:27AM (#9568798)

    I have been using BestCrypt for several years and it's great. Unfortunately it's the only solid product available on Linux and Windows that I know of.

    Why can't you store long filenames on Linux? BestCrypt just provides a block device on which you can use any filesystem. FAT32/VFAT is fine for Linux-Windows work. I've formatted a Bestcrypt volume with fat, vfat, iso9660, ext2, ext3, reiserfs, all without any problem.

    Another alternative is to use VMware and then use ext3 on Bestcrypt and serve Windows needs with Samba.

  • Try the munitions site (Score:2, Informative)

    by Ragetech ( 97458 )
    Well, I'm not sure if this is a mirror or the primary, but anyway check this out: Munitions - cryptographic software for Linux [dotforge.net].

    At home w/ SuSE I use cryptofs, but if you don't have SuSe here's something else that looks pretty good (And I think OpenBSD has this one too)-- CFS [crypto.com]. I think there are actually a lot of options out there for you, just look around through Google.
  • I'm using BestCrypt with my container file on a 256Meg USB Pen Drive. Format the container as FAT32 and you can mount it on both W2k, XP or Linux.

    Grab the evaluation versions and give it a whirl.

    http://www.jetico.com/

  • ok what do you need ? (Score:3, Interesting)

    by johnjones ( 14274 ) on Wednesday June 30, 2004 @08:19PM (#9577197) Homepage Journal
    what do you need ?

    how about a file e.g. tar/zip of all your files that is encrypted each time you login/logout ?
    use a standard AES/DES and secure deletion

    whats wrong with this ?

    slow
    unsecure if power fails

    but with everthing else you are at vendors mercy

    I would use PGP disk or a secure online file server...

    regards

    John Jones
  • how about having a file server with linux and which ever encryption you like, serving the files over nfs and samba ?

Slashdot Top Deals

"If it ain't broke, don't fix it." - Bert Lantz

Close