Keys and encryption: do I still need full disk encryption?

A fair question, once you know that Wren Linux keeps your most sensitive files encrypted on their own: your password database (KeePassXC), the Whonix vault, an SSH key's passphrase, a GPG key's passphrase. If all of that is already ciphertext, is full disk encryption (FDE) still worth it?

Short answer: yes, keep it. Here is the reasoning, so it is a choice and not a rule. For the wider picture — tampering, borders, what a thief can really do — see opsec.md; for passwords themselves, passwords.md; for GPG keys, gpg.md.

A login or sudo password does not encrypt anything

It is easy to think "they can't get past my login" or "they don't have my sudo password." Neither protects a file on the disk:

• Someone with the powered-off laptop **boots it from a USB stick, or takes the drive out, and reads the whole disk** — your login and sudo passwords never come up. They gate a live session, not the bytes on the disk.
• With autologin (Wren's default on an encrypted disk), whoever turns the laptop on is you: they land in your session and read your files. Reading your own ~/.ssh, your configs, your downloads needs no sudo at all — sudo only guards root actions.

So a login/sudo password is not a lock on your data at rest. **Full disk encryption is the only thing that is.**

What is actually sensitive on the disk

More than the vault. A working laptop collects, among other things:

• SSH keys (e.g. ~/.ssh/) — including, for a Wren server, the key to your VPS.
• GPG private keys (~/.gnupg/) — and, for whoever signs Wren releases, the release signing key, the most dangerous key of all: with it, someone can sign a fake Wren Linux that your users' machines would trust.
• Traces: logs, caches, shell history, the desktop browser's profile, the plain fact that you run Tor and Whonix, and the plaintext an amnesic Whonix session briefly leaves on disk (deleted, not wiped — host FDE is its backstop).

A private key with a passphrase is ciphertext at rest even without FDE, which is good. But it is not the whole story (next section), and a **passphrase-less key is plaintext on the disk** — so the first rule is: every private key gets a passphrase.

Three layers, each for a different job

1. Per-file encryption — the passphrase on each key, the app password on each vault file. It keeps that file unreadable at rest. It does not stop someone who can change your system.
2. Full disk encryption — the blanket over everything at rest, and the thing that resists tampering. Without FDE, someone with brief physical access (a border, a hotel, an "evil maid") does not need to read your encrypted files: they alter your unencrypted system — plant a keylogger — hand it back, and capture your vault, wallet and key passphrases the next time you type them. FDE, with Secure Boot, is what makes that hard. On Wren, **FDE + autologin is one passphrase at boot** and nothing after — one prompt, everything protected.
3. A hardware security key (a FIDO2/OpenPGP token) — for the few keys that could do the most harm. The private key never touches the disk, so booting the laptop can't reach it, and a keylogger can't extract it. This is the right home for the release signing key especially; it matters more there than FDE does.

Per-file encryption protects a stolen file. FDE protects everything, and protects you from tampering. A hardware key protects the crown jewels even from a tampered machine. They stack; they don't replace each other.

What to do

• Keep full disk encryption, set up at install (the guided "encrypted LVM" option; see install-base.md). With autologin it costs you one passphrase at boot and nothing more.
• Put a passphrase on every private key — SSH and GPG alike.
• Keep the Whonix wallets, messenger and passwords in the vault, each under its own password; host FDE is the layer beneath them.
• For a release signing key, use a hardware security key, so it is never on the disk at all.

If your machine never leaves a place you fully trust, leaning on the per-file encryption alone is more defensible. For a laptop that travels, keep FDE: the keys you most want to protect — your SSH key, your GPG keys — are exactly what tampering goes after, and FDE is the cheap, one-passphrase defence against it.