- Strong cryptography
Thank TrueCrypt for 256 bits AES in XTS mode. I think 256 bits is overkill, but 128 is not offered. I don’t see any performance hit on my modest, stock Fujitsu E8210 laptop.
- Need to know (reduced data exposure)
Data is not available in clear text when I don’t need it. In other words, when I work, I have my files, when I play they stay encrypted
- Easy encrypted backup
My backups are merely a copy to a file server.
- Single sign-on to any encrypted volume
The pre-boot authentication password (or pass phrase, your call) is the only one you’ll ever have to enter, and yet, that password is never stored anywhere. Not even in encrypted memory. It’s only in your head.
- Supports encrypted USB drive
USB drives get the same single sign-on, need to know and backup features. Doesn’t matter wheter you use file based or whole volume, although using a file based container allows you to store regular data on any computer, instead of carrying to drives.
- Platform independent
Works on all platforms that TrueCrypt supports
It does not feature, but could be extended to :
- Plausible deniability
- Two factor authentication to encrypted files (TrueCrypt version 6.1 required)
- Step-up authentication to encrypted files
- Operating system logon integration (stay tuned for that one…)
- Full operating system backup
Here is a simplified view of my setup. A laptop, a usb drive and a simple NAS server (I have a Linksys NAS200, but any remote file share or ftp will do).
- A keyfile is stored on your encrypted partition.
I generated a keyfile with cryptographic random noise. Let’s call it Entropy.dat. Your pre-boot password and operating system logon will give you access to that key file. It is used to single sing-on to any container. That keyfile is never backed up, excluded it from all your backups.
- A volume header of your container (with password authentication) is backed up
For any file based volume you create, backup a header that has a password authentication, no keyfiles. Write that password behind a picture of yourself with your kids and send it to your mother. It will be on the her fridge if ever you need it.
- Backup a rescue disk ISO file
This is regular TrueCrypt procedure for full disk encryption.
To set yourself up like this, follow these steps :
- Follow TrueCrypt’s guidelines to enable full disk encryption.
- Create a file based TrueCrypt volume, with a strong password that you will remember or write down.
- Backup that volume header.
- Select (or generate) a keyfile.
- Change the volume password to (nothing, leave the password field blank)
- Select the keyfile of step 4 and click Ok
Repeat steps 4-5-6 for each file based container. Copy to that container the files you want to be able on a need to know basis. When you need the files, mount the container. I wrote a batch file that mounts a file based container and shows a popup with my Notifu utility (Windows only).
@echo off REM Mounts a file based TrueCrypt container and displays a pop-up "C:\Program Files\TrueCrypt\TrueCrypt.exe" /v C:\users\your_username\Clients.tc /l X /q /k "%USERPROFILE%\entropy.dat" /m ts start "" notifu /m "TrueCrypt drive X was mounted successfully from file Clients.tc" /p "Secure drive mounted" /d 5000 /i "C:\Program Files\TrueCrypt\TrueCrypt.exe" start "" /MIN "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q background
The batch is a little different for USB drives.
@echo off REM Mounts a file based TrueCrypt container located on a USB drive and displays a pop-up setlocal REM I use this setup on many machines, and the USB drive is not REM always given the same letter... if exist f:\mobile.tc set TCFILE=f:\mobile.tc if exist e:\mobile.tc set TCFILE=e:\mobile.tc start "TrueCrypt" /MIN "C:\Program Files\TrueCrypt\TrueCrypt.exe" /v %TCFILE% /k "%USERPROFILE%\entropy.dat" /l U /a /q /m rm /m ts start "" notifu /m "TrueCrypt drive U was mounted successfully from file %TCFILE%" /p "Secure drive mounted" /d 5000 /i "C:\Program Files\TrueCrypt\TrueCrypt.exe" start "" /MIN "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q background endlocal
Feel free to use it and adapt it to your needs !