Recommendations on SD card encryption

[TheCrazyCanuck]

I just got done putting a 2TB M.2 drive into my Steamdeck and my plans are to move all my steam games to the new drive and leave all emulator games on the SD card. I would like to encrypt the SD card and have done similar things for USB thumb drives. I daily drive Linux Mint so I would rate myself as a "harmful goober" as far as my Linux knowledge goes but I'm capable enough if pointed in the right direction.

So my question for you is how would you do this in the most "seamless" way? I'm hoping that I can launch a script that would tie into whatever encryption used and have a keyboard pop up to type the key into. I've tried to add a backup shell script to the steam application as a non-steam game and didn't have much luck so I'm hoping someone knows of a way to do "handy" stuff like this. It would be great if there was a TPM that could be leveraged and this all automated so that when I unlock my steamdeck using the built in security setting that this would decrypt the SD card automatically (<--- Valve if you end up reading this). Obviously decryption will impact the CPU performance a bit, I haven't used an AMD CPU in a while but I wouldn't imagine decryption wouldn't put too much of a dent in the performance. The types of games I'm going to be playing off the SD card are so old they barely warm the Steamdeck so I don't care about any reasonable performance hit.

[tyl0413]

Obviously use LUKS, it's as good as it gets, I prefer using the GNOME Disk Utility to set it up in a few clicks (and as a general partition manager too).

[TheCrazyCanuck]

Originally posted by tyl0413:

Obviously use LUKS, it's as good as it gets, I prefer using the GNOME Disk Utility to set it up in a few clicks (and as a general partition manager too).

That was the plan but I'm missing the "and then?" part. So after you drop to desktop mode and create the encrypted partition how do you leverage this without having to go to desktop mode each time?

[tyl0413]

Originally posted by TheCrazyCanuck:

Originally posted by tyl0413:

Obviously use LUKS, it's as good as it gets, I prefer using the GNOME Disk Utility to set it up in a few clicks (and as a general partition manager too).

That was the plan but I'm missing the "and then?" part. So after you drop to desktop mode and create the encrypted partition how do you leverage this without having to go to desktop mode each time?

Yeah I don't have a Deck so I can't help with that but I don't think that would be possible unless they explicitly support it. Maybe if you tick on automount it'll just mount it regardless during boot but idk if that would even work without unlocking the filesystem to modify the necessary files.

[Minneyar]

Originally posted by TheCrazyCanuck:

So after you drop to desktop mode and create the encrypted partition how do you leverage this without having to go to desktop mode each time?

Right now, there's no way to do that.

It might be possible to make a plugin for Decky Loader that could handle prompting for a password and using LUKS to unlock and mount a partition while in gaming mode, but as far as I know, nothing like that exists. (and I haven't actually looked into plugin development before, so I'm not 100% certain that's possible)