Downloading from the website
Although I found a private repository with a deb package for TrueCrypt, I prefer to use the version from the official website. For example, the current console version of TrueCrypt at the time of writing this article:
# wget http://www.truecrypt.org/download/truecrypt-7.0a-linux-console-x64.tar.gz
I extracted the archive using the following command:
# tar zxvf truecrypt-7.0a-linux-console-x64.tar.gz
This produced the executable file truecrypt-7.0a-setup-console-x64.
Installing TrueCrypt
To run TrueCrypt, you need to install additional packages:
# aptitude install libfuse2 fuse-utils dmsetup
After installation, I run the previously extracted file truecrypt-7.0a-setup-console-x64:
# ./truecrypt-7.0a-setup-console-x64 TrueCrypt 7.0a Setup ____________________ Installation options: 1) Install truecrypt_7.0a_console_amd64.tar.gz 2) Extract package file truecrypt_7.0a_console_amd64.tar.gz and place it to /tmp To select, enter 1 or 2: 1 Before you can use, extract, or install TrueCrypt, you must accept the terms of the TrueCrypt License. Press Enter to display the license terms... Читаю лицензионное соглашение до самого конца и набираю yes Requirements for Running TrueCrypt: ----------------------------------- - FUSE library and tools - device mapper tools Press Enter to continue... Uninstalling TrueCrypt: ----------------------- To uninstall TrueCrypt, please run 'truecrypt-uninstall.sh'. Installing package... usr/bin/truecrypt usr/bin/truecrypt-uninstall.sh usr/share/truecrypt/doc/License.txt usr/share/truecrypt/doc/TrueCrypt User Guide.pdf Press Enter to exit...
Encrypting a partition and creating a container
Encrypting a partition and creating a container are not very different. In the first case, the command argument specifies a partition, while in the second case, it specifies a file. When encrypting a partition, all data on it is destroyed. The partition does not need to be formatted before encryption.
As an example, I will describe partition encryption.
# truecrypt -c /dev/sda8 Volume type: 1) Normal 2) Hidden Select [1]: 1
At this stage, you select the type of volume to create. Normal is a standard, fully encrypted volume. Hidden is an inconspicuous, hidden volume located inside a real, formatted partition. For the real donor partition, it is advisable to choose a partition with the FAT32 file system, so that more information can fit inside the partition and the risk of damaging the hidden volume is reduced.
Encryption algorithm: 1) AES 2) Serpent 3) Twofish 4) AES-Twofish 5) AES-Twofish-Serpent 6) Serpent-AES 7) Serpent-Twofish-AES 8) Twofish-Serpent Select [1]:
The AES encryption algorithm is the fastest, and it is probably best to choose it for volumes from which programs will be launched. For storing information, you can choose any algorithm from the provided list.
Hash algorithm: 1) RIPEMD-160 2) SHA-512 3) Whirlpool Select [1]:
I simply press Enter. The first hash function is just right.
Filesystem: 1) None 2) FAT 3) Linux Ext2 4) Linux Ext3 5) Linux Ext4 Select [2]: 5
File system for the new volume. I selected ext4.
Enter password: Re-enter password:
I entered (and re-entered) a sufficiently long password: K.,k.nt,z?j.,rfljhjufz?Rjulf?vtyzgjldtxhj;blfz. I would like to note that the best password is not stanzas from Strikotvorenija poems, but a truly random set of characters. Or pseudo-random: Lxq-weqp=9Mhft9E&ad_W[\8^",2nJqo-b$kQ[Hz['qV.
Enter keyfile path [none]:
A good idea is to create a key file on a USB drive and specify it during encryption. The main thing is not to lose it later. However, you can use a simple text file with well-known text as a key file. For example:
Article 23 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. Everyone has the right to the protection of the law against such interference or attacks. Article 24 1. Everyone has the right to the protection of the law against such interference or attacks. 2. No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks. Article 25 1. Everyone has the right to the protection of the law against such interference or attacks. 2. No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.
Of course, it is better to choose articles from the constitution of another country or use other texts. Otherwise, upon losing the key file and attempting to recover it, you might discover that the constitution has changed and the encrypted volume cannot be opened.
Please type at least 320 randomly chosen characters and then press Enter: (тут беспорядочно нажимаю на любые буквенные клавиши и иногда нажимаю Enter, чтобы увидеть сколько ещё раз надо долбить по клавишам, чтобы выполнить в сумме 320 случайных нажатий) Characters remaining: 307 Characters remaining: 299 Done: 6,166% Speed: 81 MB/s Left: 5 minutes The TrueCrypt volume has been successfully created.
The process has completed and the encrypted volume has been created.
Mounting the encrypted volume
To mount it to an existing folder, I execute the command:
# truecrypt /dev/sda8 /mnt
Changing the password on the encrypted volume
# truecrypt --new-password=new1pass2word3 -C /dev/sdb3 Enter password: (вводим существующий пароль) Enter new keyfile [none]: Please type at least 320 randomly chosen characters and then press Enter: (долбим по клавиатуре 320 раз и нажимаем Enter) (ждём какое-то время)
Password and/or keyfile(s) successfully changed.
The password has been successfully changed.
Adding a key file to the encrypted volume
# truecrypt --new-keyfiles=/media/blabla.txt -C /dev/sdb3 Enter password: (вводим действующий пароль на том) Enter new password: (вводим новый пароль на том или нажимаем Enter для отключения пароля) Please type at least 320 randomly chosen characters and then press Enter: (жмём триста двадцать раз по клавишам на клавиатуре) Password and/or keyfile(s) successfully changed.
Now, to mount an encrypted volume that uses a key file with an empty password, you need to enter the command:
# truecrypt --keyfiles=/media/blabla.txt --password="" --protect-hidden=no /dev/sdb3 /media/1
If the password is not empty and you need to specify it directly in the command line, write it instead of the quotes.
If the password is not empty, you can omit the --password option and enter the password when prompted.
Can you tell if a partition or file is encrypted?
Some people ask this question, citing, for example, a line from a Wikipedia article dedicated to TrueCrypt: No TrueCrypt volume can be identified (TrueCrypt volumes cannot be distinguished from a set of random data, i.e., the file cannot be linked to TrueCrypt as the program that created it, in any form or context).
I will reiterate that this phrase carries a different meaning. It clearly states that upon seeing a partition or file with random data, you cannot say for sure that it is encrypted using TrueCrypt. You simply need to read the entire sentence.
An encrypted partition or file can be easily distinguished from an unencrypted one just by looking at it with any low-level editor. If we see data that is too random, that is already a reason to suspect encrypted content.
If we simplify things greatly, random data can be described as a collection of repeating character sequences, fragments of readable data from certain files, and empty gaps. Data that is “too random” consists of a set of non-repeating characters. It is noise, chaos, and a spike in entropy. It is impossible to compress such “too random” data using any archiver. No ordinary hard drive partition will contain clusters that are completely filled with overly random data.
A certain type of encrypted file resembles archives. However, archives have headers that allow identification of the archiver program used to create them.