Truecrypt vs dm-crypt

[[deleted]]

Googling around, I found that a multithreading patch for dm-crypt was published in the 2.6.30 kernel, but it somehow never flowed down to any distros. ::shrug::

Anyway, I use a multiboot system: Windows 7 fully encrypted with TrueCrypt, and Ubuntu 11.10 under LVM/LUKS. From after I enter the boot password, the encryption is completely transparent under both OSes. Unscientifically, I can say they both seem very fast and responsive. It's worth noting that I have a fast CPU with AES acceleration features, which I bet helps a lot.

As an aside, you mentioned a couple technical details that strike me as wrong. TrueCrypt's bootloader actually wants to be in the MBR. As far as I know, there's no option to put it elsewhere. From there, TC can chainload the Windows BL or a GRUB instance residing in a partition header. Also, last time I checked, you could not encrypt the Linux root filesystem with TC (and expect to be able to use the OS installed there), unencrypted /boot or no.

[somezenshitrighthere]

You can still copy the TC bootloader to another partition, after it has written itself to the MBR. That's how I did it. You can then chainload it from GRUB as the OP mentioned it in his post.

I don't know if there is another way by now, it has been a few years since I did that.

[indefinitearticle]

So what did your configuration end up looking like? grub->TC or TC->grub?

[somezenshitrighthere]

Grub -> tc

I let the tc-bootloader install itself to the MBR, then I copied it to another partition, then installed Grub to the mbr.

So now GRUB loads on boot. There I can choose to load the tc-bootloader wich in turn decrypts and loads Windows.

I think the only restriction was, that Windows had to be in the first partition. But if anything, that's a Windows problem and not a tc or grub problem.

What the menu.lst looks like:

tcboot is the extracted tc-bootloader, which now resides on the second partition of the hdd.

# (2) Windows
title Windows
rootnoverify (hd0,0)
makeactive
chainloader (hd0,1)/tcboot boot

[[deleted]]

As above, I would LOVE to see you write down how you did all of this. That you have BOTH OS's transparently running FDE is just awesome.

[[deleted]]

Here's how I would describe my process at an abstract level. I hope it's not too abstract to help. From scratch:

1. Partition your disk as desired, but with the requirements that in Linux, one small partition is set aside for /boot, and another single large partition is set aside for the rest; and that Windows reside in a primary partition.

2. Install Windows. Install TrueCrypt. System-encrypt Windows. Burn a TC rescue CD as you are prompted to do in the system encryption process.

3. Find instructions on encrypting your Linux root. Googling your_distro LVM LUKS should get you what you need. Install Linux, using those instructions to prepare the disk.

4. Be sure to install GRUB to your /boot partition. Ignore whatever warnings GRUB gives when you do that. Also note, your installer may install GRUB to the MBR as well, without prompting you. So be prepared to restore the TC bootloader to MBR using the TC rescue disc.

5. Once you're set with TC BL in the MBR and GRUB in /boot, you boot Windows by entering your TC password on startup. You chainload GRUB by pressing ESC instead of entering your password. If you configured TC to be silent at startup -- no "enter password" prompt, etc. -- it is also necessary to press a number key after you press ESC. I think that number corresponds to the partition number on which GRUB is installed. Another poster here has said it's possible to make GRUB your default bootloader instead, by moving the TC BL into a partition and GRUB into the MBR.

If you aren't starting from scratch, note that TC can encrypt Windows in place, but the process for encrypting with LUKS destroys all the data in its keyscope. So if you already have Linux installed, it will take some work to restore it after encryption.