3

I have a Raspberry Pi B+, and I want a unitary, encrypted archive which I can read and write from/to at will. I want a single file on the RPi (or attached storage), which contains an entire directory structure + files, that I can modify (create, delete, edit) without having to duplicate ('extract', 'unpack') the contents in unencrypted form at any point.

The classic (though far from only, and obsolete) example is Truecrypt containers. If you don't know the password, they're a single file, indistinguishable from random bits. If you do know the password, you can mount that file to a mountpoint and manipulate its contents however you want. The conversion from 'plaintext' to encrypted form happens on-the-fly, ie. in RAM, and the otherwise homogeneous underlying chunk of encrypted bits on disk is updated as required. This is in contrast to encrypted compressed archives eg. .7z for instance, whereby - although they can be encrypted - the workflow for amending them involves temporarily extracting the whole lot in unencrypted format prior to editing.

In other words, one cannot securely store stuff in encrypted .7z without writing the unencrypted contents to disk at some point - every time one wants to edit the contents in fact. For infrequently updated content, this is inefficient as well as being insecure. Several options exist but they all tend to rely on FUSE, which RPi does not support due to its relatively obscure ARM v6 processor.

Does anybody know of software which does what I want? It's analogous to mounting any homogeneous volume eg. .iso , except with writing enabled too (plus of course the transparent encryption). It seems so generic I'd be surprised if there's no way of achieving it on RPi (though, FUSE is meant to be generic so maybe that's the show-stopper?)

Improve this question
3
  • You can achieve this by mounting images with encryption enabled, I forgot the details, each time you need to provide the key. There is some thing built in to linux already. – Piotr Kula Apr 22 '15 at 20:35
  • You mean like this? techrepublic.com/blog/linux-and-open-source/… sudo modprobe cryptoloop ; and sudo modprobe aes both produce no output :( – benxyzzy Apr 22 '15 at 20:55
  • I asked a similar question but cant remember on which stack about this and got a good answer there, about encrypting the entire hard drive before the system loads. Maybe it was not form image but on partition only.. sorry, I cant find it now. – Piotr Kula Apr 22 '15 at 21:10
2

FUSE is a File System in user space. The alternative is to let the kernel handle it. This requires root privileges to configure this.

If you want the aame functionaliyt as a TruecryptContainer then do this:

  1. create a file that contains random data and has the right size. (dd if=/dev/random of=yourContainer.file)

  2. mount the file with the loop module. Either crypto loop or normal loop. With normal loop you can then create a crypto file System on that new loop device.

If you add the mount to /etc/fstab you can allow this to be mounted by the user. Otherwise only root can mount the container.

To be sure that you did everything right you will have to read the documentation of all the tools involved. There is no one click secure option available.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.