UnRelatedBurner

Encrypt whole system?

https://sh.itjust.works/post/24598696

Encrypt whole system? - sh.itjust.works

My laptop isn’t under my supervision most of the time. And I’d hate it if someone were to steal my SSD, or whole laptop even, when I’m not around. Is there a way to encrypt everything, but still keep the device in sleep, and unclock it without much delay. It’s a very slow laptop. So decryption on login isn’t viable, takes too long. While booting up also takes forever, so it needs to be in a “safe” state when simply logged out. Maybe a way that’s decrypt-on-demand? I’m on Arch with KDE.

Sep 2, 2024 at 2:30pmWeb
Show threadfrightful_hobgoblinSep 2, 2024
theintercept.com/…/encrypting-laptop-like-mean/
Encrypting Your Laptop Like You Mean It

If you want to encrypt your hard disk, you should know the basics of what disk encryption protects, what it doesn't protect, and how to avoid common mistakes.

The Intercept
Show threadsudoSep 2, 2024

The standard route is to decrypt on boot. It happens after GRUB but before your display manager starts. IDK if there even is a setup that has you “decrypt on login”. Thats sounds like your display manager (sddm for KDE) is decrypting system which is not possible IMO.

Unless your laptop somehow has multiple drives you’ll want to use the “LVM on LUKS” configuration. 1 small partition for /boot. The rest gets LUKS encrypted, and an LVM group is put on the LUKS container. Or you could replace LVM with btrfs.

This will require wiping your system and reinstalling so you have some reading to do.

The arch-install script in the live iso has options for full disk encryption.

If you suspend to RAM your system will stay unencrypted, because your ram is not encrypted. if you suspend to disk (aka hibernate) your system will be encrypted. You go through the boot loader when waking from hibernation but it just drops you off where you left off.

You need a swapfile for hibernation so make sure its inside the LUKS container.

dm-crypt - ArchWiki

Show threadPossibly linuxSep 3, 2024
You technically could encrypt just your home but that’s not the recommended approach.
Show threadbruhbeansSep 2, 2024
How old are we talking? If the CPU is >10 years old and/or some kind of ARM, it may not have hardware encryption acceleration, which means it’ll happen in software. I did that once, it was horrible. lscpu |grep -i aes should probably tell you what you need to know.
Show threadUnRelatedBurnerSep 2, 2024

It does give me a result so I do have “aes”. How can I use it?

We’re talking an Intel i5-8350U. it has 16GBs of ram and 500GB of SSD.

Show threadBjörnSep 3, 2024

That is absolutely not a slow laptop. If it takes a long time to boot there must be something wrong. I have a similar system that takes about ten seconds to boot.

Anyways, like others said, LVM with LUKS is the simplest. It uses your hardware to quickly decrypt the drive on boot. While it is running access to your data is protected by your login manager or lock screen.

Show threadPossibly linuxSep 3, 2024

LUKS2 with a strong hash.

It will take a while to decrypt but it will so be worth it. You only have to enter the password once.