Introduction to LUKS

You can create other encrypted volumes using LUKS to encrypt, for example, another USB stick or an external hard disk. LUKS is the standard for disk encryption in Linux.

• GNOME Disks allows you to create encrypted volumes.
• The GNOME desktop allows you to open encrypted volumes.

Comparison between LUKS and VeraCrypt

You can also open VeraCrypt encrypted volumes in Tails. VeraCrypt is a disk encryption tool for Windows, macOS, and Linux. See our documentation about VeraCrypt.

We recommend you use:

• VeraCrypt to share encrypted files across different operating systems.
• LUKS to encrypt files for Tails and Linux.

1. See the difference between file containers and partitions.

2. Plausible deniability: in some cases (for example, with VeraCrypt hidden volumes), it is impossible for an adversary to technically prove the existence of an encrypted volume.

   Still, deniable encryption might not protect you if you are forced to reveal the existence of the encrypted volume. See:

   • VeraCrypt: Plausible Deniability
   • Security-in-a-Box: Creating a hidden volume

Creating an encrypted partition

Choose Applications ▸ Utilities ▸ Disks to open GNOME Disks.

Identifying your external storage device

Disks lists all the current storage devices on the left side of the screen.

1. دستگاه ذخیرهٔ خارجی که قصد استفاده از آن را دارید وصل کنید.

2. دستگاهی جدید در فهرست دستگاه‌های ذخیره ظاهر می‌شود. روی آن کلیک کنید:

   

۱. توضیحات دستگاه را سمت چپ صفحه ببینید، از جمله مارک، گنجایش آن و غیره.

Formatting the device

1. Click on the button in the titlebar and choose Format Disk… to erase all the existing partitions on the device.

2. In the Format Disk dialog:

   • If you want to securely erase all data on the device, choose to Overwrite existing data with zeroes in the Erase menu.

   • Choose Compatible with all systems and devices (MBR/DOS) in the Partitioning menu.

   Then click Format….

3. In the confirmation dialog, make sure that the device is correct. Click Format to confirm.

Creating a new encrypted partition

Now the schema of the partitions in the middle of the screen shows an empty device:

1. Click on the button to create a new partition on the device.

2. Configure the various settings of your new partition in the partition creation assistant:

   • In the Create Partition screen:

     • Partition Size: you can create a partition on the whole device or only on part of it.

       In the example below, we are creating a partition of 4.0 GB on a device of 8.1 GB.

   • In the Format Volume screen:

     • Volume Name: you can give a name to the partition. This name remains invisible until the partition is open but can help you to identify it during use.

     • Erase: you can choose to securely erase all data on the partition.

       Secure deletion does not work as expected on USB sticks and SSDs (Solid-State Drives). Choose instead to overwrite existing data on the whole device when formatting the device.

       See also our warning about secure deletion on USB sticks and SSDs.

     • Type: choose Internal disk for use with Linux systems only (Ext4) and Password protect volume (LUKS).

   • In the Set Password screen:

     • Password: type a passphrase for the encrypted partition and repeat it to confirm.

       We recommend choosing a long passphrase made of 5 to 7 random words. Learn about the maths behind memorizable and secure passphrases.

       It is impossible to recover your passphrase if you forget it!

       To help you remember your passphrase, you can write it on a piece of paper, store it in your wallet for a few days, and destroy it once you know it well.

     Then click Create.

   • Creating the partition takes from a few seconds to a few minutes. After that, the new encrypted partition appears in the volumes on the device:

     

   • If you want to create another partition in the free space on the device, click on the free space and then click on the button again.

Using the new partition

You can open this new partition from the sidebar of the file browser with the name you gave it.

After opening the partition with the file browser, you can also access it from the Places menu.

Opening an existing encrypted partition

When plugging in a device containing an encrypted partition, Tails does not open the partition automatically but you can do so from the file browser.

1. Choose Places ▸ Computer to open the file browser.

2. Click on the encrypted partition that you want to open in the sidebar.

   

3. Enter the passphrase of the partition in the password prompt and click Unlock.

4. After opening the partition with the file browser, you can also access it from the Places menu.

5. To close the partition after you finished using it, click on the button next to the partition in the sidebar of the file browser.

Storing sensitive documents

این درایوهای رمزگذاری‌شده مخفی نیستند. یک مهاجم که دستگاه را در اختیار دارد می‌تواند متوجه وجود یک پارتیشن رمزگذاری‌شده روی آن بشود. در نظر داشته باشید ممکن است در مواجهه با زور یا فریب گذرواژه را لو دهید.

Opening encrypted volumes from other operating systems

It is possible to open such encrypted volumes from other operating systems. But, doing so might compromise the security provided by Tails.

For example, image thumbnails might be created and saved by the other operating system. Or, the contents of files might be indexed by the other operating system.

Changing the passphrase of an existing encrypted partition

To open GNOME Disks choose Applications ▸ Utilities ▸ Disks.

1. Plug in the external storage device containing the encrypted partition that you want to change the passphrase for.

2. The device appears in the list of storage devices. Click on it:

   

3. Check that the description of the device on the right side of the screen corresponds to your device: its brand, its size, etc.

4. Click on the partition displaying a at the bottom-right corner.

5. Click on the button and choose Change Passphrase…