BcalcOS provides two different types of disk encryption. Home encryption is optional, while swap encryption is automatic.
Home Encryption
During installation, you can choose whether to encrypt your /home partition.
The /home partition contains your personal files and user data. If home encryption is enabled, that data is stored in an encrypted LUKS2 container.
You will create a separate encryption password during installation. This password is used to unlock your encrypted home partition during the boot process.
Your encryption password is not the same as your login password. The login password is used to log in to your user account; the encryption password is used to unlock the encrypted home partition.
Swap Encryption
Swap is encrypted automatically.
BcalcOS generates a new random encryption key each time the system boots.
This means that swap is protected while the system is running without requiring any additional action from the user.
Why Are They Different?
Home encryption protects your personal data stored on disk. Because that data needs to remain accessible across reboots, it requires a password to unlock it.
Swap is temporary working space used by the operating system. Swap is automatically encrypted with a temporary random key rather than requiring a persistent user password.
In short:
- Home encryption: Optional, password protected, protects your personal files.
- Swap encryption: Automatic, uses a random key at each boot.
- Login password: Used to log in to your BcalcOS account. Sudo password.