On-the-fly / mounted volume encryption for RPi

Question

I have a Raspberry Pi B+, and I want a unitary, encrypted archive which I can read and write from/to at will. I want a single file on the RPi (or attached storage), which contains an entire directory structure + files, that I can modify (create, delete, edit) without having to duplicate ('extract', 'unpack') the contents in unencrypted form at any point.

The classic (though far from only, and obsolete) example is Truecrypt containers. If you don't know the password, they're a single file, indistinguishable from random bits. If you do know the password, you can mount that file to a mountpoint and manipulate its contents however you want. The conversion from 'plaintext' to encrypted form happens on-the-fly, ie. in RAM, and the otherwise homogeneous underlying chunk of encrypted bits on disk is updated as required. This is in contrast to encrypted compressed archives eg. .7z for instance, whereby - although they can be encrypted - the workflow for amending them involves temporarily extracting the whole lot in unencrypted format prior to editing.

In other words, one cannot securely store stuff in encrypted .7z without writing the unencrypted contents to disk at some point - every time one wants to edit the contents in fact. For infrequently updated content, this is inefficient as well as being insecure. Several options exist but they all tend to rely on FUSE, which RPi does not support due to its relatively obscure ARM v6 processor.

Does anybody know of software which does what I want? It's analogous to mounting any homogeneous volume eg. .iso , except with writing enabled too (plus of course the transparent encryption). It seems so generic I'd be surprised if there's no way of achieving it on RPi (though, FUSE is meant to be generic so maybe that's the show-stopper?)

Answer 1

FUSE is a File System in user space. The alternative is to let the kernel handle it. This requires root privileges to configure this.

If you want the aame functionaliyt as a TruecryptContainer then do this:

1. create a file that contains random data and has the right size. (dd if=/dev/random of=yourContainer.file)

2. mount the file with the loop module. Either crypto loop or normal loop. With normal loop you can then create a crypto file System on that new loop device.

If you add the mount to /etc/fstab you can allow this to be mounted by the user. Otherwise only root can mount the container.

To be sure that you did everything right you will have to read the documentation of all the tools involved. There is no one click secure option available.