Geeks Lunch - Intensive Version -HowTo's




Encrypted USB Filesystem


I bought a Lexar Jump drive to keep my personal files on so I don't keep them on the laptop owned by the company I work for.  Also with the pervasive layoffs in my company over the last year it will make it much easier for the day they say "here's your pinkslip, pack-up all your stuff; and no, you can't keep the laptop"; if that day ever arrives.  If so it's  just, grab my USB device, say farewell and hit the want ads.  I also don't want it readable if I happen to leave it laying around or lose it, its full of Million-Dollar-Ideas(tm).

So its time to do the "USB-encrypted-filesystem-thang".  Here's the quick and dirty on how to set it up on Fedora Core 3 (FC3)

Automount Works
Fedora Core 3 automagically mounted the drive on boot
 /dev/sda1 on /media/LEXAR_MEDIA type vfat (rw,nosuid,nodev,sync,noatime,iocharset=utf8)

That a good start.  It came with a movie trailer for "BE COOL" already loaded.  Also on the device are Winblows, Mac, and Linux directories.  In the Linux directory there is a GUI setup tool for the hardware encryption which works and a loadable kernel module that doesn't.  :( When I checked out their website (http://www.lexar.com/support/lexar_support.html) they had no updates, no source code, no mention of Linux at all.  Bummer. 

So now I've got an unencrypted USB filesystem.  Not good.  Time to start from scratch.
Being the paranoid type, I don't trust their proprietary encryption system anyway.
You know, the one with the back door key of "letNSAin", so lets do the Linux version.

Tools Up
We need some tools- easy enough- yum will get them
yum install cryptsetup

To see what encryption options are available to the kernel type
cat /proc/crypto

There is nothing good there by default so lets install blowfish.
insmod /lib/modules/2.6.10-1.770_FC3smp/kernel/crypto/blowfish.ko
(use kernel path dujour)

now a cat /proc/crypto shows that blowfish is available.

Device setup
Don't forget to umount /media/LEXAR_MEDIA (or whatever your device is if you're using something else.  Use dmesg | less to look for your device name or just mount if its already mounted.)

Here's where the real-magic(tm) happens.  Setup the encrypted device with
cryptsetup -c blowfish -s48 -b1014784 create cryptvol /dev/sda

where -s is keysize (cat /proc/crypto for options)
-b is number of sectors (get with  blockdev --getsize /dev/sda)
cryptvol is the name of the volume to create
and finally the actual device is the last item on the command line

It will prompt you for a pass phrase, if you're going to all this trouble- pick a good one.  That's it.  You know have a blowfish encrypted device.  But what to do with it?  First:


Lets create a filesystem on the encrypted device.
mkfs /dev/mapper/cryptvol

Now we're all done except for:

Mounting the new device
mount /dev/mapper/cryptvol /mnt

Looking at the device with
df -h
shows
/dev/mapper/cryptvol  480M  2.3M  453M   1% /mnt
(of the 512MB advertised space)

Speed Testing
I did a test copy of 271M of various files in a subdirectory to the encrypted device and as a comparison to another directory on my HD. My system was rather busy doing other things at the time.

First the encrypted drive
time cp -ar /root/monta /mnt
real    1m16.873s

Now the HD
time cp -ar /root/monta /tmp
real    1m26.636s

The encrypted filesystem was faster in this test- but remember that copying
from the HD back to the HD is twice the load on it.  While it appears that
the encrypted filesystem is slower than than the HD it is plenty fast and
if feels responsive to work with.

Note: if you want to make the encrypted filesystem unavailable while the computer is still on, after you umount the filesystem execute
cryptsetup remove cryptvol

(otherwise it can simply be mounted again)

Final note: I wouldn't put your browser cache or similar on a USB device
because the non-infinite number of re-writes available.

For more info see http://www.saout.de/misc/dm-crypt/


The most recent copy of this document is here.

http://www.geekslunch.com/glivh/Encrypted_USB_filesystem.html
written by: Monta Elkins

Back to GLIVH's [Geeks Lunch Intensive HowTo's]

email Monta.gl @ [this domain]
Please send you comments/feedback/suggestions
or if you really liked it; link to it.