Truecrypt or LUKS?

Question

My work requires my laptop hard drive (running Linux) to be encrypted and from what I can tell TrueCrypt and LUKS seem to be the two major contenders out there.

In a "normal" system, if the system crashes (power gets cut, etc), it's easy to recover a corrupted system with fsck. However, on an encrypted system, things become a lot more complicated.

Which of TrueCrypt or LUKS offers the best stability / recovery in an event of a crash?

Solution 1

LUKS seems to be the more standard tool (included by default in distribution installers, etc), so that's what I use.

Solution 2

Well, as other have pointed out, LUKS is generally better integrated into current distributions. For security reasons, you almost certainly want to encrypt all partitions (including /), which is called "encrypted root". Setting this up by hand can be a bit tricky (though doable), so distro integration helps a lot.

At least Debian and Ubuntu offer encrypted root via LUKS in the standard installer, so that's a point for LUKS. I'm not even sure if TrueCrypt can encrypt the root partition at all.

The only advantage I can see for Truecrypt is that its Windows support is better, so it's easier to mount a Truecrypt partition under Windows. But that is really only relevant for portable drives/media. At any rate, most Linux FS have no Windows driver anyway...

So I would recommend LUKS (though Truecrypt is a viable option as well).

In a "normal" system, if the system crashes (power gets cut, etc), it's easy to recover a corrupted system with fsck. However, on an ecrypted system, things become a lot more complicated. Does TrueCrypt of LUKS offer the best stability / recovery in an event of a crash?

There isn't really any difference. Encryption is always per sector, and disks are written per sector, so usually you'll lose any sectors that weren't written properly, with or without encryption.

I use full-disk LUKS (including root partition) on my laptop, and it's gone through many fscks without problems.

At any rate, you are going to perform at least nightly full backups, aren't you? So a crash should not wipe out a lot of work... . IMHO, anything less than that is criminal negligence on a system with important data.

Solution 3

AFAIK, they are both based of similar technology unlike say ecryptfs. File-system integrity would largely depend on your choice of FS. However, your best bet would still be to use a UPS. If your data is important, that should be necessary even if no encryption was used.

Comments

[sleske]

Well, he's using a laptop, so UPS would not really apply (at least not for mobile usage).

[Teddy]

Ubuntu only supports full-disk encryption on installation if you use the "Alternate" install CD.

[Teddy]

There is a program for Windows to read LUKS-encrypted devices: freeotfe.org

[sleske]

@Teddy: Thank you for the info. Still, I believe TrueCrypt's Windows version is a bit more full-featured than freeotfe.org, hence the "better Windows support". Might be arguable of course...

[sybreon]

In that case, just auto shutdown the laptop on low-power. At other times rely on the battery as backup and things will be fine.