3. Basics: Securing your secrets with encryption

Encryption is essential to make your data unreadable.

In short what encryption does is that it rewrites your data according to some rule and a value to revert it to a readable form. (Algorithm + login/password/keyfile/token etc). If the attacker does not know the rule and solution they will only see random nonsense.

I would want to introduce you to three programs that I used and I can review.

NOTE: Before you pick a password - please check out how to pick the right password in "4. Basics: Picking a password"!


First program: VERACRYPT

Available on pretty much any system, has GUI.

For newbs I would recommend Veracrypt because IT JUST WORKS. It has a nanny mode by default so even newbs cannot fail. You can use it without any knowledge of the field with no instruction and you will manage to encrypt stuff successfully.

As to main options you can either encrypt a whole partition or make a container inside it (which will behave like any regular file).

When you want to encrypt a whole partition - you can encrypt your system partitons and non-system partition. Encrypting a system partition will make you put in a password before your system starts, encrypting a non-system partition will make you put in a password when your system is running and you choose to use that partition.

When you make a container - it is a file whose inside is hidden behind a password/key. You can open it via Veracrypt, paste the password/key, and it will be mounted as if it were a separate memory device (like another disk, a USB drive, a CD etc.). You can move it around like a file. Easy.

Veracrypt also offers "hidden volumes" which would be as they promise undetectable to find any trace of any encrypted data even existing. Not just the contents of encrypted memory, but even any proof that anything on your disk is encrypted at all. I never tried it because you can plead the fifth or an equivalent in your jurisdiction.

If you encrypt ANYTHING make sure to absolutely remember your password and make it unforgettable. Without it - you may never open your files again.

In my opinion it should be a casual or starting option and not your base choice. It is less common than Luks, and volumes made with Veracrypt are tied to Veracrypt and cannot be opened with other programs (to my knowledge) and not everyone has Veracrypt installed. I still use it in casual cases.

Easy introduction to Veracrypt
https://www.youtube.com/watch?v=C25VWAGl7Tw

Practical tutorial of encryption with Veracrypt
https://www.youtube.com/watch?v=HEybfZXYpok


Second program: LUKS

Available natively for Linux. It has a CLI.

Luks is easy and hard, basic and advanced at the same time depending on how much precision you need. You can use it as a casual and a newb, but most hardened information hiders like it too.

You can set up your Linux to decrypt them by default in /etc/crypttab, you can easily automate how you want to mount them. Possibilities are many, depends mostly on limits of your imagination.

Luks allows you to easily have multiple working passwords/keys/tokens or whatever method you use. You can add, alter, remove them easily without having to re-encrypt your entire drive with the new password. If I remember correctly I had to re-encrypt everything with Veracrypt which was a pain for tens of terabytes.

Decent tutorial on basic Luks use
https://www.youtube.com/watch?v=5rlZtasM-Pk


EXTRA TIP

Luks seems to not support file containers like Veracrypt but I evade it in a way.
You create an .img file, you set up Luks on that sole .img file, you make a filesystem and you can work with it after decrypting and mounting. You can later resize it too.

1. I create an img (for example 5GBs)
truncate -s 5G nameyourcontainer.img

2. You encrypt the file you made with Luks and open it
sudo cryptsetup luksFormat nameyourcontainer.img
sudo cryptsetup open nameyourcontainer.img pickwhatevernameyoulike

3. Inside of your .img has no filesystem, you need to make one before being able to put anything on there (for example ext4)
sudo mkfs.ext4 /dev/mapper/pickwhatevernameyoulike

4. Now your container is ready, you can mount it wherever you like (for example at /mnt/)
sudo mount /dev/mapper/pickwhatevernameyoulike /mnt


EXTRA: You can add size to your container, please follow the three commands below

First decide how much more space you want to give to it (ex. 2Gbs)
sudo truncate -s +2G nameyourcontainer.img

Once you increased the size of that file - tell luks to recognize the new size - THIS IS A MUST
sudo cryptsetup resize pickwhatevernameyoulike

When luks learned there is more free space - tell the filesystem to expand - THIS IS A MUST
sudo resize2fs /dev/mapper/pickwhatevernameyoulike

Done! Now it is bigger.


Whenever you want to open it - it is just decryption and mounting:
sudo cryptsetup open nameyourcontainer.img pickwhatevernameyoulike
sudo mount /dev/mapper/pickwhatevernameyoulike /mnt

I suggest automating stuff with bash scripts, or using fstab and crypttab files to decrypt and mount it on boot.


Third program: KLEOPATRA

It is available on pretty much anything and it has a GUI.
Kleopatra is for convenience as you can get by without installing it and using basic GNU key operations that your Linux almost certainly will support by default no matter the distro but I use it for the ease of navigation.

It is mostly for cryptographic identification and authorization but you can use key/keys or a password to encrypt a file and pass that file to somebody else. Note that if your system is unencrypted then somebody can technically have a look on your computer and find your keys unencrypted and vulnerable.

They can use these keys to decrypt your Kleopatra-encrypted files. It is an equivalent to having a key to your house behind a flower pot if you store the files locally.

This encryption is only really useful when you upload files for somebody to use, and not storing on your own computer under the condition that you are sure that they will not be able to tie that file upload to your person/computer/key.

Kleopatra is mostly used though for message encryption, files are also best to be sent like messages. I hope you understand that this is the only realistic use case for Kleopatra in terms of file encryption.

A little watch
https://www.youtube.com/watch?v=QmE4LrBSChQ