Dual booting encrypted, hidden OS

Question

Hello,
I recently discovered Arch Linux, and am somewhat of a linux noob in general. I have yet to install Arch (computer is in repair).
I know that truecrypt allows users to fully encrypt an operating system, and to then create a hidden operating system within it. At boot, users are prompted for a passphrase, and depending on which one they enter, either one or another of the operating systems boots up.
As I understand it however, truecrypt doesn't encrypt a full system when it comes to linux.
Do you guys think it's possible to use Arch to make an encrypted partition for windows 7, and within it another encrypted partition with Arch? The idea is that while I don't intend to use windows 7 for anything beyond a few simple work-related programs, if I had it encrypted as well, it would give plausible deniability as to the existence of the linux system.
If such a thing is not possible, then another question. I've been looking at the guide here https://wiki.archlinux.org/index.php/Sy … _with_LUKS and it seems like the first thing to be done is to wipe the entire hard disk. I don't want to destroy my existing windows system unless I have to, only create a new partition and then encrypt that with linux. What would change in that guide for that to be the case? How do I tell it to use urandom and encryption only on a specific partition?
Last question: for those of you who have encrypted an entire OS like windows or Arch before, would you say there was a significant or perceptible slowing down (whether on boot or during normal operation). I'd be using a regular 7200 rpm HDD.
Thanks for any help!

Answer 1

kalofet wrote:I'm not sure I really understand how one would enter the OS with the first method.
So, I haven't used Phonebook myself. The fact that it's unmaintained is a barrier; I've also heard it's a PITA to set up and use.
In principle, it would work as follows. You would have a file on some partition that you're willing to leave unencrypted, or at worst, have decrypted. The file would appear to be filled with random data. Suppose you're given a decryption order on this random data. You would have two passwords, like in truecrypt. One password would decrypt innocuous stuff, another password would give access all areas.
The access-all-areas password could hide, say, a mini filesystem. It could hide some directories called usr, dev, lib, proc, and so forth. These could contain some binaries. This is all you need to enter a chroot. Inside the chroot, you could have hidden users that access hidden files and so forth.
After you leave the chroot and close the encrypted userspace filesystem, no one suspects a thing.
kalofet wrote:That seems interesting, but doesn't not having a header risk programs trying to overwrite that space, since they'll think it's unused? But I suppose if it was on it's own partition that I didn't touch, that would work. I'll have to look into this.
That's the idea. The headerless encrypted partition acts just like any other partition filled with random data. Such partitions, filled with random data, are pretty common for people who like distro-hopping, as it's standard to fill partitions with random data before installing on top of them.
kalofet wrote:Does there happen to be a GUI in which I could select which partition to overwrite with random data? Since I wouldn't know what I was doing when using terminal commands unknown to me, I'd more than likely screw up along the way. And screwing up when pointing my computer at which partition to overwrite wouldn't look good
No. If you want to play around with this stuff, I suggest you get used the command line. Take it slowly, and do some practice runs first on a harddrive that doesn't have any data you care about.
If you've never even done an encrypted install before, you should just start there for practice. Really. Just make some new partition on your machine for playing around with, and try making it a LUKS partition containing some distro, and see if you can get to the point where you can boot into it.
If you can't even do that much without help, then really you're playing with fire here.