11-04-2019, 01:30 PM
Quote:By the way, what does one gain by full-disk encryption? The term is misleading as one does not encrypt the /boot partition including the kernel and initrd.
If one wants to prevent someone from tempering with the root filesystem, then that's also possible by replacing the initrd with one that that includes a backdoor. The backdoor can modify the root filesystem right after it's unencrypted and before the boot continues.
A number of things, compared to filesystem-layer encryption:
- While you can keep all private data in your homedir, it's easy to leak outside that - /var/log, swap, /etc, /tmp, etc.
- Performance & reliability - dm-crypt translates one block device to another. eCryptFS has to implement a POSIX filesystem that saves to another POSIX filesystem.
- Metadata leakage: while eCryptFS encrypts filenames, the directory structure, file count, file size, etc is all preserved in the encrypted version. If I can see that you have a directory with around 1000 files in it, whose directory structure and file sizes match an untarred torbrowser.tar.gz, that's information.
