Home / server / Questions / 339880
In Process
Poni
Asked: 2011-12-12 03:15:45 +0800 CST

TrueCrypt for production server - what are my risks?

  • 772

I want the data on a server to be secure as possible so I intend to use TruCrypt which served me well so far (as a Windows user).

Installing, running & mounting isn't an issue.

I'm worried about sudden server shutdowns, power spikes, reboots, I don't know..
What if a data is being written and then power off, before it wrote all the data?
This is even more worrying since the whole encrypted volume is a one file, and if a byte or few are corrupted then everything is gone, I think, not sure.

So, does anyone knows better? Any link regarding this kind of issue?

Edit #1:
I've found part of an answer to my question in TrueCrypt's FAQ:
What will happen when a part of a TrueCrypt volume becomes corrupted? In encrypted data, one corrupted bit usually corrupts the whole ciphertext block in which it occurred. The ciphertext block size used by TrueCrypt is 16 bytes (i.e., 128 bits). The mode of operation used by TrueCrypt ensures that if data corruption occurs within a block, the remaining blocks are not affected.

truecrypt

1 Answers

  1. Be aware that there is no in-place "decrypt" or "unencrypt" utility or function for non-system partitions/drives. Encryption for data partitions/drives is a one-way process.

    This means to unencrypt a non-system volume, you need to copy the data to another location (or back it up), reformat the drive, then restore it.

    Another risk is the amount of time required to perform an in-place volume encryption. The in-place process can require significant amounts of time, perhaps a full day or longer. For large data volumes, the in-place option may not be feasible. It may be quicker to setup a new encrypted volume, and migrate data over in phases.

    Encrypted volumes may not be supported by all applications. For example, using an encrypted volume as a Windows Backup dedicated drive did not work for me. This may be due to the inability of TrueCrypt to work with the Volume Shadow Copy service on non-system volumes. I would not be surprised if other features such as "Restore Previous Versions" did not work.

    More information:

    http://www.truecrypt.org/docs/removing-encryption
    http://www.truecrypt.org/docs/issues-and-limitations

    • 1