Encryption setup

I would say in Qubes words:

LUKS
reasonably secure encryption algorithm :wink:

As you probably already know (Installation Guide) Qubes OS uses AES Full Disk Encryption (FDE)

Concerning the cipher parameters I found this:

For customization I found this:

Some thoughts

  • As important as the OS disk encryption itself is the backup encryption: Qubes Backup, Restoration, and Migration. Luckily, Qubes OS also uses LUKS encryption here. Depending on your security vs. comfort level you can add additional encryption layers on top to cascade your backup i.e. using VeraCrypt or hardware encrypted disks. Just keep in mind that you do not automatically add more security by adding more encryption tools.
  • If you want to have more trust to your hardware you can browse through here: Why Purism? – Purism or here https://www.nitrokey.com/ … open-source is a fundamental thing when it comes to security / trust questions.
  • At least as important as the encryption algorithm / method is the password (key, token).
    I like this one: How to make good passwords
  • My advice for password management: Qubes OS > valut VM > KeePassXC (master password + token file or Yubikey). With that you need to remember only two strong passwords.

Last remark do not overdo with encryption since at the end you still want a system which is usable and maintainable.

Have fun !

3 Likes