[Hatjorn]

I have spending some time to figure out witch encryption is best for Windows. As i understand its VeraCrypt.

Any other suggestions?

[JohnFitzgeraldKennedy]

For encrypted volumes on Windows I think bitlocker is probably the "best" option. But if you're worried about the secrecy of the information on your machine to that extent you should probably not be using Windows as your host OS in the first place, just saying 😉

[Hatjorn]

For encrypted volumes on Windows I think bitlocker is probably the "best" option. But if you're worried about the secrecy of the information on your machine to that extent you should probably not be using Windows as your host OS in the first place, just saying 😉

I just hear bitlocker is easy to decrypt. What type of OS do you prefer? Linux?

I appriciate your input

[JohnFitzgeraldKennedy]

I just hear bitlocker is easy to decrypt. What type of OS do you prefer? Linux?

I appriciate your input

Yes some Linux distro is probably the best option, or maybe Grapheneos, as Windows is basically spyware in itself at this point. I just assume anything done on a Windows machine is logged in a Microsoft/NSA database.

Something like Debian 12 with Gnome would probably be a good starting distro if you're not very experienced with Linux. If you're super paranoid use Tails.

You can set up an encrypted partition with LUKS: https://en.m.wikipedia.org/wiki/Linux_Unified_Key_Setup

[DramaKing]

I just hear bitlocker is easy to decrypt. What type of OS do you prefer? Linux?

I appriciate your input

BitLocker is so easy to decrypt. With a powerful GPU, you could have a 50% chance of cracking the recovery key in about 11 undecillion years.

[Hatjorn]

BitLocker is so easy to decrypt. With a powerful GPU, you could have a 50% chance of cracking the recovery key in about 11 undecillion years.

I guess you think I should go with Bitlocker then

---

Yes some Linux distro is probably the best option, or maybe Grapheneos, as Windows is basically spyware in itself at this point. I just assume anything done on a Windows machine is logged in a Microsoft/NSA database.

Something like Debian 12 with Gnome would probably be a good starting distro if you're not very experienced with Linux. If you're super paranoid use Tails.

You can set up an encrypted partition with LUKS: https://en.m.wikipedia.org/wiki/Linux_Unified_Key_Setup

Thank you for your info JohnFitz. I will be looking into it

[DramaKing]

I guess you think I should go with Bitlocker then

---

Point is that all FDE software probably uses AES for encryption. I'd never worry about a brute force attack unless you set up a simple password or something.

I also meant to add that BitLocker has the added bonus of not bricking Windows 10/11 computers.

[Hatjorn]

Point is that all FDE software probably uses AES for encryption. I'd never worry about a brute force attack unless you set up a simple password or something.

I also meant to add that BitLocker has the added bonus of not bricking Windows 10/11 computers.

Great answer. It's nice to get information I can learn from. I guess some people would have wrote redicules answers to a noob question

[7]

Well personally I use veracrypt and encrypt hidden partitions rather than focus so much on full disk encryption.
If I use full disk encryption I use luks
"The default cipher used for LUKS is aes-xts-plain64 . The default key size for LUKS is 512 bits."

But for veracrypt I use
(Serpent(Twofish(AES)) with SHA-512
"Three ciphers in a cascade operating in XTS mode. Each block is first encrypted with AES (256-bit key), then with Twofish (256-bit key), and finally with Serpent (256-bit key). Each cipher uses its own key. All keys are mutually independent.""

[Hatjorn]

Well personally I use veracrypt and encrypt hidden partitions rather than focus so much on full disk encryption.
If I use full disk encryption I use luks
"The default cipher used for LUKS is aes-xts-plain64 . The default key size for LUKS is 512 bits."

But for veracrypt I use
(Serpent(Twofish(AES)) with SHA-512
"Three ciphers in a cascade operating in XTS mode. Each block is first encrypted with AES (256-bit key), then with Twofish (256-bit key), and finally with Serpent (256-bit key). Each cipher uses its own key. All keys are mutually independent.""

This one is a more advanced. I will have to dig into it later today when I have time

[Hackers]

encrypt hidden partitions rather than focus so much on full disk encryption.

I'm a fan of partitions, or external drives, or other storage that is encrypted > full encrypted OS. Yes, data can be cached, yes, there may be tmp files, so full disk encryption has a use case, but for most people this level of protection isn't needed. but obviously depends on what people are up to.

[7]

I'm a fan of partitions, or external drives, or other storage that is encrypted > full encrypted OS. Yes, data can be cached, yes, there may be tmp files, so full disk encryption has a use case, but for most people this level of protection isn't needed. but obviously depends on what people are up to.

This is true. I actually have disk encryption on with everything but overall its not the winner for me as most of my work is done on remote servers anyway. But encrypted hidden volumes are what make my life much more simple.

Personally, I say if you don't hide everything they stop looking. I don't want to not login to my laptop if stopped or checked, I don't want my computer to appear to have nothing on it. Just the stuff I need to keep private is very well protected.

But, yes depends on who's doing what, where and how

[slezer]

ChaCha20 Poly is probably one of the best options out there next to AES256.

[nucleo_type09]

ChaCha20 Poly is probably one of the best options out there next to AES256.

well why not use sha[x] or other e-funcs from crypto++? is agood library, cross platform and versatile, but is not that good for partition/volume encryption tho, but.... but... the nsa also uses a sha256 for they security crap btw, i would not recommend bitlocker unless u r ok with compatibility issues as bitlocker is a microsoft proprietary software, and i've heard is not even compatible with all it's windows versions as well, let alone the fact that microsoft itself is spying on you so you might also have to be concerned about potential backdoors in your system you might not be aware of, there are a couple of other reasons not to pick bitlocker, go for AES (Advanced Encryption Standard) or RSA, but you didn't specify if u're looking for asymmetric or symmetric encryption, sha does't provide asymmetry while RSA does, SHA[X] supports a wide range of encryption algorithms as well, i would go for SHA if i were you. Also some SHA variants, such as SHA-1, are vulnerable to length extension attacks, where an attacker can appendd additional data to a hash without knowing the original input, so be careful with that one, go for SHA3 and over, for example, in SHA-256, which has a block size of 512 bits, the input message is padded with a '1' bit followed by '0' bits until the length is 448 bits less than a multiple of 512, then, the original message length is appended as a 64-bit binary :).

If you're not familiar with padding, padding prevents certain attacks, such as *length extension attacks*, then you have salts, used for protection against hash collision attacks which is another good point for sha functions.

[Hatjorn]

well why not use sha[x] or other e-funcs from crypto++? is agood library, cross platform and versatile, but is not that good for partition/volume encryption tho, but.... but... the nsa also uses a sha256 for they security crap btw, i would not recommend bitlocker unless u r ok with compatibility issues as bitlocker is a microsoft proprietary software, and i've heard is not even compatible with all it's windows versions as well, let alone the fact that microsoft itself is spying on you so you might also have to be concerned about potential backdoors in your system you might not be aware of, there are a couple of other reasons not to pick bitlocker, go for AES (Advanced Encryption Standard) or RSA, but you didn't specify if u're looking for asymmetric or symmetric encryption, sha does't provide asymmetry while RSA does, SHA[X] supports a wide range of encryption algorithms as well, i would go for SHA if i were you. Also some SHA variants, such as SHA-1, are vulnerable to length extension attacks, where an attacker can appendd additional data to a hash without knowing the original input, so be careful with that one, go for SHA3 and over, for example, in SHA-256, which has a block size of 512 bits, the input message is padded with a '1' bit followed by '0' bits until the length is 448 bits less than a multiple of 512, then, the original message length is appended as a 64-bit binary :).

If you're not familiar with padding, padding prevents certain attacks, such as *length extension attacks*, then you have salts, used for protection against hash collision attacks which is another good point for sha functions.

This sounds so technical bro. Im a complete newbie in this field. Would Vera crypt alone be enough to encrypt my who pc's harddrive?