Take the 2-minute tour ×
Software Recommendations Stack Exchange is a question and answer site for people seeking specific software recommendations. It's 100% free, no registration required.

With the advent of TrueCrypt appearing to have been abandoned, what are my options for whole disk encryption going forward?

I'm looking for options that will work with Linux distros as well as Windows, preferably a single solution for both OSes. My light searching turned up this option which looked promising:

What other options do I have?

share|improve this question
1  
I've migrated this to SR.SE since its off topic for SU, I'm a mod in both places, and this has the potential to be a great question. More details would be nice - what does decent mean to you? Open source makes sense here - do you need FDE? Plausibly deniable encrypted volumes? Containers? –  Journeyman Geek May 29 at 9:32
2  
@slm could you be a bit more precise concerning your requirements? What features must be supported, which are optional? Please take a look here, then edit your question to incorporate some of the improvements. –  Izzy May 29 at 13:37
1  
@Caleb I fully agree with you on this – but would feel better if it were the other way around (a Windows-specific solution would be covered here as well). Specific requirements are not detailled in either of the two; so you're probably correct VTCing this one. If the OP edits it and makes it "more unique", it can always be re-opened. –  Izzy May 29 at 15:29
3  
Great. Now my windows question is merged with one that has loads of answers for Linux only. I think this is over-moderation, you should have just left everything alone. –  codeulike May 30 at 11:01
4  
Meta discussion about the merge of softwarerecs.stackexchange.com/questions/4529/… into this question. –  Gilles May 31 at 12:10

10 Answers 10

EncFS is an encryption layer on top of an existing filesystem. I currently use it with a Dropbox-synced folder on Linux and OS X where it works perfectly. There is also experimental support for Windows, but I have not tried it. See also How to Encrypt Cloud Storage on Linux and Windows.

LUKS is natively supported on Linux, and also has Windows support using FreeOFTE, which should be a reasonably simple transition for TrueCrypt users. OS X does not appear to be supported. It's block-level encryption very similar to TrueCrypt.

BitLocker is an encryption system built into NTFS and is supported only by Windows. It also has an unusual security model that is deeply integrated into the operating system and involves using your Windows password to "unlock" your data immediately upon login. The encrypted block cannot be directly accessed under normal circumstances. This is file-level encryption under NTFS only.

FileVault is the OS X-native encryption system, mostly usable only on OS X. It comes in two flavors, version 1 and version 2; version 1 is file-level encryption while version 2 is partition-level encryption. Read-only support for version Filevault2 partitions is available for Linux using libvfde.

Other Options - there are quite a lot of other options available, some from well-known names such as McAfee or PGP, some largely unheard-of commercial offerings, and some additional free projects. I don't have much experience with them, nor can I say anything for their trustworthiness, but they may be what you're after.

share|improve this answer
2  
We can pretty much safely assume that at least Bitlocker and FileVault have backdoors thanks to NSA shenanigans. –  JamesRyan Jun 2 at 11:21

You could continue using TrueCrypt. According to this blog post on grc.com:

to excerpt a key part of that article:

And then the TrueCrypt developers were heard from . . .

Steven Barnhart (@stevebarnhart) wrote to an eMail address he had used before and received several replies from “David.” The following snippets were taken from a twitter conversation which then took place between Steven Barnhart (@stevebarnhart) and Matthew Green (@matthew_d_green):

  • TrueCrypt Developer “David”: “We were happy with the audit, it didn't spark anything. We worked hard on this for 10 years, nothing lasts forever.”
  • Steven Barnhart (Paraphrasing): Developer “personally” feels that fork is harmful: “The source is still available as a reference though.”
  • Steven Barnhart: “I asked and it was clear from the reply that "he" believes forking's harmful because only they are really familiar w/code.”
  • Steven Barnhart: “Also said no government contact except one time inquiring about a ‘support contract.’ ”
  • TrueCrypt Developer “David”: Said “Bitlocker is ‘good enough’ and Windows was original ‘goal of the project.’ ”
  • Quoting TrueCrypt Developer David: “There is no longer interest.”

Also this thread of tweets seemed to indicate that a formal fork was in the works.

   ss #1

There are also links to the latest versions of TrueCrypt which include all the source code + installation packages.

Additional TrueCrypt resources

  • TrueCrypt.ch: A just launched, Swiss-based, possible new home for TrueCrypt. Given the deliberate continuing licensing encumbrance of the registered TrueCrypt trademark, it seems more likely that the current TrueCrypt code will be forked and subsequently renamed. In other words . . . what TrueCrypt becomes will not be called “TrueCrypt.”
  • github.com/DrWhax/truecrypt-archive: This is a frequently cited, nearly complete, historical repository of previous TrueCrypt versions, tracking its evolution all the way back to when it was previously named “ScramDisk” (which is when we were first using and working with it).
  • github.com/syglug/truecrypt: Another TrueCrypt v7.1 archive, though apparently not the latest. But readily browsable if someone wishes to poke around within the source with their web browser.
  • IsTrueCryptAuditedYet.com: This is the home of the TrueCrypt auditing project. As the audit moves into its next phase, digging past the startup and boot loader and into the core crypto, updates will be posted and maintained here.
share|improve this answer

I said it before, and I'll say it again: the best solution, unless you have very specific requirements, is to use your operating system's native encryption mechanism. This has superior integration, so it tends to be easier to use and administer not only for single-OS users and administrator but even for dual-OS users.

This means: under Windows, use Bitlocker. Under Linux, use Dm-crypt via LUKS for whole-disk encryption, and Ecryptfs for home directory encryption.

The main advantage of Truecrypt is if you have an encrypted removable disk that you want to be able to use under both Windows and Linux. As Linux cannot access encrypted NTFS files and Windows can of course not access Ecryptfs (nor does either OS support the other one's native encryption), the alternatives there are limited. Depending on your adversaries' profile, you may elect to continue to use Truecrypt until vulnerabilities are made public — you need to evaluate the risk of someone stealing your disk now and decrypting it later if a devastating vulnerability are found. Another option would be to use Dm-crypt and access files via a Linux virtual machine (which you could bundle as an appliance on an unencrypted partition on the disk). The simple solution is of course to encrypt individual files (with PGP), but this can be tedious in some scenarios.

If you're concerned about backdoors in your operating system's native encryption mechanism, then you need to be equally concerned with backdoors else where in your operating system. The encryption subsystem isn't even the easiest place to hide a backdoor — for example, it's easier to hide something in the networking stack, and it's easier for that subsystem to report the information outside. A backdoor in the operating system could recognize and extract the key for a third-party encryption mechanism — or it could cut the middleman and leak your data directly. If you don't trust your operating system vendor, you can't trust the operating system at all, period. Using a third-party mechanism only increases the sources that you need to trust.

TrueCrypt also is and remains useful if you use an older or cheaper version of Windows that doesn't have Bitlocker.

share|improve this answer
2  
Single-file encryption also does not do anything to protect against an attacker that is able to access the unused portions of the disk (deleted files, etc.) that have not been specifically overwritten. PGP and friends is good for data at rest and in transit, but doesn't really do for many of the scenarios that FDE protects against. That said, I'd give you +1 even for just "don't panic now". –  Michael Kjörling May 29 at 22:34
6  
Maybe I'm paranoid but I cannot trust Microsoft or Apple anymore (and I use both). It's okay for general encryption but for really sensitive stuff? TrueCrypt might not be perfect but it at least has no PRISM inside. –  2called-chaos May 30 at 7:09
3  
@Gilles Well what you say is that Windows would upload files (which would be more obvious than a backdoor in the encryption imho) but what I mean is that you think that you have a secure partition and some guy comes along with the master password because Gov. forced them to. I don't really trust TC either (to be honest I thought it would be more open and audited). –  2called-chaos May 30 at 7:43
2  
FreeOTFE let Windows read & write LUKS encrypted partitions, but the project seems to be dead. –  Cristian Ciupitu May 30 at 10:24
1  
AFAIK Bitlocker is not available in/for many versions of Windows currently in widespread use, such as the starter or home editions of Vista, 7 etc (or at best is read-only). I think this answer would be better if it pointed that out. –  RedGrittyBrick Jun 2 at 10:12

I found diskcryptor while looking for something entirely unrelated. It has a few nifty features - critically the ability to encrypt boot drives, the use of standard, proven, open source encryption algorithms, the ability to use intel and via's hardware accelerated encryption options. Its windows only and supports only windows partitions.

It does boot and system drive encryption (and encrypts ISOs).

What it lacks is it does not do containers like truecrypt - but you could trivially work-around it with say, a VHD container thats been encrypted.

And yes, causing BSODs is a feature of the software, not a bug ;p

share|improve this answer
3  
You should add, that it works only with "Windows filesystems" and is - at least out of the box - only working on Windows systems. - For those a valid option, though. –  Alexander Kosubek Jun 2 at 6:56

Based on some additional research these alternatives looked useful as well. Much of this is excerpted from this articled titled: Replace TrueCrypt.

Tc-play

tc-play is a Free implementation of TrueCrypt based on dm-crypt, licensed under the 2-clause BSD license. It is in Debian sid (tcplay), and would serve as a full replacement of TrueCrypt... once a proper GUI available.

tc-play allows to create TrueCrypt volumes.

version 2 added an ability to save and restore TrueCrypt volume headers to external header files.This feature can be used to change a TrueCrypt volume password.

Cryptsetup

Cryptsetup 1.6 supports reading the TrueCrypt on-disk format, so if/when udisks and friends are adapted (if needed), then we could as well avoid shipping any additional software at all. It is part of Debian Jessie.

Once unlocked on the command-line, the TC volume shows up in Nautilus, but no udisks / GNOME Disks / Nautilus integration is here to enable the user to graphically activate a TC volume.

Upstream (udisks) feature request: https://bugs.freedesktop.org/show_bug.cgi?id=70164

cryptsetup 1.6.4 does not support creating TrueCrypt volumes.

Zulucrypt

zuluCrypt is a front end to cryptsetup and tcplay, it make easy to manage Truecrypt volumes through a GUI, but it's not packaged in Debian yet (RFP #703911).

  • It uses cryptsetup to unlock TrueCrypt volumes and LUKS volumes.
  • It uses cryptsetup to backup and restore LUKS volume headers.
  • It uses cryptsetup to add and remove keys in LUKS volumes.
  • It uses tcplay to create TrueCrypt volumes.
  • It uses tcplay to backup and restore TrueCrypt volume headers

zuluCrypt now has a hidden volume like functionality using cryptsetup.

zuluCrypt can open LUKS volumes with a detached header.

share|improve this answer

You may want to check out Truecyrpt.ch. They are a Swiss group who are working on taking over the codebase of Truecrypt and eventually create a new fork with a new name. Since recent information shows that Truecrypt is still safe to use, you may be best off with sticking to TrueCrypt until a better option is available.

I have two main reasons for this recommendation. Firstly, you specify that you need cross-platform compatibility. This is one of the features that made Truecrypt very desirable and if it is still secure to use the latest version, there really isn't much reason to change. Secondly, I'm assuming you're already using Truecrypt, and sticking with it until the community sorts out an as good or better solution is generally preferable to choosing the next-best option out of a false sense of urgency now.

share|improve this answer

I would like to add one more tool to the list: SecurStick

It is a tool written for a German computer magazine. What is very important to me is that the tool works without admin rights (it is designed for removable media)

The caveat is that it creates a WebDAV service. The consequence is that Windows has no information about the encrypted drive's size and assumes it to have the same amount of free space as the C drive. This can be a problem if your C drive is almost full.

I have not tried it on Linux, but it works fine on Windows.

share|improve this answer

According to The Register:

In the past hour, crypto-guru Bruce Schneier has told us he's switched back to Symantec's PGPDisk to encrypt his data.

Schneier wrote in 2007:

There are several whole-disk encryption products on the market. I use PGP Disk's Whole Disk Encryption tool for two reasons. It's easy, and I trust both the company and the developers to write it securely. (Disclosure: I'm also on PGP Corp.'s Technical Advisory Board.)

share|improve this answer
2  
No source, no way. –  gd1 May 30 at 15:02

And, yet another name: BoxCryptor Classic. Pay attention: I'm talking about the classic version, not the new fancy one.

The Classic flavour works pretty much like TC but it doesn't require you to predefine a size of the volume, all the files in a folder are encrypted if added to a volume that, when unmounted, makes them still visible but not accessible.

The only potential weakness I see is that it goes with a configuration file (that you can take out of the volume and separate from the encrypted files) that could possibily expose information to a bad guy who wants to discover something. TC doesn't offer this "weapon".

share|improve this answer

And another one option - DAEMON Tools Ultra (from 2.4 version). It is mounting software with additional functions, and one of them - creating TrueCrypt images - has appeared in the latest version. More info can be found on the official site or in the company's blog.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.