4 ms·

> It's impossible for any court forensic team, let alone an airport goon, to prove there is actually another partition inside the outer encrypted partition, unl

> It's impossible for any court forensic team, let alone an airport goon, to prove there is actually another partition inside the outer encrypted partition, unless you mount common volumes and cross-contaminate. An important caveat is to properly defragment the outer partition and fiddle with the offset and the size of the inner partition to avoid any conflicts, then avoid writing in the outer partition. Customs staff typically don't know to prove there is, they just need reasonable suspicion to seize goods for further investigation. The fact you've booted into a 50GB partition on a 500GB disk may well be considered reasonable suspicion to seize the goods for the sake of further investigation.

oconnor663 8y ago
I think the parent comment is describing a scheme where the outer partition contains the inner one, so both are large. As the parent notes, this is dangerous, and you have to be careful not to overwrite inner data if you boot the outer os.
- zymhan 8y ago
  It is also Linux, so there are probably three different ways to make partitions appear to be a different size or reserve certain blocks in the partition.
yholio 8y ago
You are correct. I've simplified a bit: I boot from a 50GB decoy root partition that also has a 450GB decoy data partition along side it, both encrypted with the same weak password. This is a standard configuration and the machine works perfectly fine, you can write inside the decoy root as much as you want, as Linux would do when it boots. The data partition is largely empty and you haven't written large files there for some time, but that should not be suspicious by itself. In the free space of the large data partition there lives the sensitive hidden root. It's maybe 250GB, with a 100GB offset from the start of the decoy data, and 50GB guard space at the back, where ext4 writes all sorts of crap. So you get to use about 50% of your raw disk capacity inside the sensitive environment, as a single encrypted root.
- ldarby 8y ago
  There is a risk of them looking at the raw data of the drive and asking what all the random data at the end of it is. The beatings will continue until you decrypt it. Hopefully you can and it's not actually just random data...
  - yholio 8y ago
    The outer volume is itself encrypted so if you correctly initialized it as recommended, the raw disk should be full of random bits. When read from within the encrypted outer volume, these decrypt to random data as well, so there should be no way to detect the inner volume, either by looking at the raw disk sectors or at the decrypted outer volume sectors. Most importantly, you have the plausible deniability that the disk looks exactly as it should per recommendations of security experts, that the boot-loader and initrd are the stock versions that exist on any other Ubuntu machine with encrypted volumes etc. Another caveat here is that the inner volume must use the implicit encryption parameters of cryptsetup, or that the correct parameters are supplied in the command line. A LUKS header should absolutely not be used, as it will be plainly visible inside the partition, and would indicate, at the very least, that some other encrypted data was stored in the past on the disk leading to new questions about its password etc., killing plausible deniability.
    - Laforet 8y ago
      TrueCrypt/VeraCrypt can do this for you with the intention that the existence of a hidden partition is plausibly deniable unless the correct key is provided. The only downside to this is gross inefficiency, you may only be able to get 20GB useful space out of a 500GB disc.
    - ldarby 8y ago
      See the cryptsetup FAQ 5.2 (https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAsk...): "This means that if you have a large set of random-looking data, they can already lock you up." In the UK, with RIPA legislation, there is a real risk of someone dropping a USB key full of random data on you, telling the cops there's child porn in it, then you get locked up for 5 years for failing to decrypt it.

oconnor663 8y ago

I think the parent comment is describing a scheme where the outer partition contains the inner one, so both are large. As the parent notes, this is dangerous, and you have to be careful not to overwrite inner data if you boot the outer os.

zymhan 8y ago
It is also Linux, so there are probably three different ways to make partitions appear to be a different size or reserve certain blocks in the partition.

yholio 8y ago

You are correct. I've simplified a bit: I boot from a 50GB decoy root partition that also has a 450GB decoy data partition along side it, both encrypted with the same weak password. This is a standard configuration and the machine works perfectly fine, you can write inside the decoy root as much as you want, as Linux would do when it boots. The data partition is largely empty and you haven't written large files there for some time, but that should not be suspicious by itself. In the free space of the large data partition there lives the sensitive hidden root. It's maybe 250GB, with a 100GB offset from the start of the decoy data, and 50GB guard space at the back, where ext4 writes all sorts of crap. So you get to use about 50% of your raw disk capacity inside the sensitive environment, as a single encrypted root.

ldarby 8y ago
There is a risk of them looking at the raw data of the drive and asking what all the random data at the end of it is. The beatings will continue until you decrypt it. Hopefully you can and it's not actually just random data...
- yholio 8y ago
  The outer volume is itself encrypted so if you correctly initialized it as recommended, the raw disk should be full of random bits. When read from within the encrypted outer volume, these decrypt to random data as well, so there should be no way to detect the inner volume, either by looking at the raw disk sectors or at the decrypted outer volume sectors. Most importantly, you have the plausible deniability that the disk looks exactly as it should per recommendations of security experts, that the boot-loader and initrd are the stock versions that exist on any other Ubuntu machine with encrypted volumes etc. Another caveat here is that the inner volume must use the implicit encryption parameters of cryptsetup, or that the correct parameters are supplied in the command line. A LUKS header should absolutely not be used, as it will be plainly visible inside the partition, and would indicate, at the very least, that some other encrypted data was stored in the past on the disk leading to new questions about its password etc., killing plausible deniability.
  - Laforet 8y ago
    TrueCrypt/VeraCrypt can do this for you with the intention that the existence of a hidden partition is plausibly deniable unless the correct key is provided. The only downside to this is gross inefficiency, you may only be able to get 20GB useful space out of a 500GB disc.
  - ldarby 8y ago
    See the cryptsetup FAQ 5.2 (https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAsk...): "This means that if you have a large set of random-looking data, they can already lock you up." In the UK, with RIPA legislation, there is a real risk of someone dropping a USB key full of random data on you, telling the cops there's child porn in it, then you get locked up for 5 years for failing to decrypt it.