alternatives to TrueCrypt

[majoron]

Hi,
Recently "something" happened to TrueCrypt. AFAIK there is not public statement apart from a red warning in its home site saying that TrueCrypt is not secure. I was interested in using it until I saw this message.

My question is: is there any tested alternative to TrueCrypt?
My needs are: I just need to encrypt an external disk which will be used only under Linux. It has to be free software.

Thanks in advance and best regards
_________________
Computers are like air conditioners, they stop working properly if you open Windows

[zaphyr]

It is my personal opinion that TrueCrypt 7.1a is still safe to use for now. At the very least for personal use.
My opinion may change depending on the results of the security audit

As for alternatives...perhaps dm-crypt or tcplay
_________________
emerge IQ

[xaviermiller]

Hey! The Gentoo wiki is worth to be read;)

http://wiki.gentoo.org/wiki/DM-Crypt
http://wiki.gentoo.org/wiki/DM-Crypt_LUKS
http://wiki.gentoo.org/wiki/Whole_Disk_Encryption

I use LUKS to encrypt a whole LVM set of partitions.
_________________
Kind regards,
Xavier Miller

[khayyam]

[krinn]

[mv]

[majoron]

[majoron]

[Yamakuzure]

[Yamakuzure]

[Yamakuzure]

Okay, it is dead.

But now there is : http://www.truecrypt.ch/
_________________
Important German:

1. "Aha" - German reaction to pretend that you are really interested while giving no f*ck.
2. "Tja" - German reaction to the apocalypse, nuclear war, an alien invasion or no bread in the house.

[khayyam]

[Havin_it]

TrueCrypt will come through all this, I think, in some shape or form. I was a bit panicked like many people by the news, but if you look into it a bit, and take Occam's razor to it, I find there's little reason to think the worst.

The first thing that's notable about the updated web page is how rudimentary it is: it's pretty much the HTML equivalent of a scribbled note. If you discount the possibility of defacement (which doesn't make a lot of sense and is contraindicated by the new binary apparently signed with a legit key), then you must conclude that the devs who re-did the page either (A) were in a big hurry, or (B) couldn't be arsed putting much effort into it.

I believe (B) is more likely, and that opinion is lent weight by this snippet from one of the devs as relayed to the head of the audit project (reported by Steve Gibson here):

[Pearlseattle]

My recommendation: encfs
It's since years that I use it to encrypt my home directories and a portion of my raid and it has never failed (e.g. when my raid5 lost 1hdd on xfs the whole thing was ok as you expected when using any other filesystem, when I lost my main backup drives the restoration from the secondary backup gave me everything without problems, etc...).

Important:
encfs is not a filesystem - it's just an additional layer that you put on top of whatever you're using as filesystem.
You will therefore format your device(s) with whichever fs you want (e.g. ext3/ext4/xfs/jfs/btrfs/ufs/whatever...) and use whichever functionality you want on it (e.g. a jfs fs on top of a raid6 fs) and only at the end use "encfs" to mount a virtual unencrypted device which will write all data to the underlying layers (again, e.g. a SSD using nilfs2 with "trim" functionality switched on) in encrypted form.

Sounded at the time like a great idea to decouple the encryption process from the filesystem (you still have the same advantages whichever filesystem you use, plus encryption) and it still seems to be to me.

Downsides:
1)
I don't know if Truecrypt was better but encfs uses always only 1 thread to encrypt a single stream of data that is being written => you max thoughput will be limited to the effectivity of the encryption algorithm that you use vs. the CPU that you have.
2)
(I think that) you cannot encrypt your whole rootfs - whatever is needed to boot and get into an operational state will have to be unencrypted (but I might be wrong).
3)
If you're writing file "A" and the system goes down (e.g. no power) then the whole file won't be readable anymore as its encrypted form won't be complete. I personally prefer this white&black situation than half-ok files.

[mv]

[mhogomchungu]

[Yamakuzure]

Just a side question:

Substituting TrueCrypt with BitLocker, LUKS or whatever for disks, partitions and directories is all fine, but what if you rely heavily on the cross platform container capability of truecrypt? How to substitute that?

• We often build containers of different sizes on our Debian servers, put data into them, copy them on external NTFS hard drives, and our customers mount those under windows where they, surely enough, need to be able to open the containers. So Windows-only or Linux-only substitutes are a big no-no.
• My personal data resides in a subfolder in my home directory. This folder is a RAIDZ (zfs) drive put together out of 7 truecrypt containers that are individually backed up.
• My backup folders use the same technique apart from the fact that the 6 truecrypt containers are backed up using three different dropbox accounts.

How on earth is this to be substituted by anything else?

(My zpool configs:)

[depontius]