cryptsetup: encrypted filesystem on your N900
 

I have built a kernel package and the userspace tool for using encrypted filesystems on the N900.

See:
http://wiki.maemo.org/User:Jebba/Cryptsetup

Have fun.

Re: cryptsetup: encrypted filesystem on your N900
 

Nice. How is the file system performance when using this (relative to no encryption)?

Re: cryptsetup: encrypted filesystem on your N900
 

That script he has on the linked page just sets up a loopback device and then encrypts that. I don't think it's really intended to be used to encrypt your entire filesystem. (First question that springs to mind is, why? protect the open source n900 firmware?)

but really I think he intends it to be used to store the naked pictures your girlfriend MMS's you or the photos you've been saving of that girl you've been stalking on facebook.

you know, stuff you don't use all the time.

Re: cryptsetup: encrypted filesystem on your N900
 

On the line
dd if=/dev/urandom of=$CRYPTFILE bs=1M count=$CRYPTSIZE

why not /dev/random instead? Isn't that more secure?

Re: cryptsetup: encrypted filesystem on your N900
 

Thanks. The n900 really could use some encryption software. I hope eventually there will be some easy-to-use application for the end user to at least create password-protected vaults.

Re: cryptsetup: encrypted filesystem on your N900
 

I don't think so, it also requires more entropy. If you come up with a good doc explaining why it's better, let me know. Many docs I see use /dev/zero, so this is definitely an improvement over that.

Re: cryptsetup: encrypted filesystem on your N900
 

I just got it set up, I haven't had a chance to benchmark it. It would be interesting to see how AES performs versus twofish as well.

Encrypted root filesystem (e.g. the *entire* system is encrypted), would be cool, but likely quite difficult with Maemo.

Re: cryptsetup: encrypted filesystem on your N900
 

urandom is non blocking, so using random maybe "more secure" but you are likely to suffer file system freezes using random - not something you would want.

random is generally used for cert generation and one off stuff like that

Re: cryptsetup: encrypted filesystem on your N900
 

/dev/random blocks until more entropy can be gathered

On the N900, producing even 1 kilobyte of random data with /dev/random takes ages (it just sits there waiting for environment "noise")

/dev/urandom takes less a second to fill 1 MB of random data

Unless you are exchanging above top secret government documents, /dev/urandom is good enough.

Re: cryptsetup: encrypted filesystem on your N900
 

Maybe not the whole filesystem, though root could feasibly be encrypted...

Anyhow, I've been testing Jebba's packages and kernel, and they work really well for cryptsetup encryption.

Basically, I use it to encrypt the whole SD card, therefore protecting everything that's on it. That's where your data is to be stored, that's the best protection you can have and it's OTF, you just mount it and then use it as normal. You can do the same for the free space on the internal drive.

BTW, anyone tried mounting encrypted partitions via fstab/crypttab on boottime on the N900 with this?

I'm thinking of trying, but had to reflash a couple of times this past day, due to setting this up, and am not sure I wanna reflash again, in case it coughs up some prob when booting. Though it shouldn't and should probably boot... Any thoughts on this? Or rather anyone tried yet?