Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #224047

Re: Advice on encrypted filesystem

Show all headers | View raw

On Fri 26 Jun 2020 at 11:47:34 (-0400), Michael Stone wrote:
> On Fri, Jun 26, 2020 at 08:25:49AM -0500, David Wright wrote:
> > If encrypting an entire disk, scramble the disk first, then partition.
> > If only encrypting a partition, partition the disk first.
> > Alignments should be at least 2M (4096 x 512B sectors).
> > Scramble any sensitive pre-existing contents:
> > 
> > # dd bs=1M if=/dev/urandom of=/dev/sdz[9]
> 
> I personally wouldn't do this. It's slow and doesn't gain much.

As I posted in https://lists.debian.org/debian-user/2020/06/msg01109.html
I get about 75% speed from /dev/urandom compared with /dev/zero (as
suggested by your good self, except that I'm writing directly to
/dev/sdXN, not to an encrypted device, which would itself be slower).

> I
> definitely wouldn't do it on an SSD.

Agreed. But I wouldn't be writing any sensitive information to an SSD
in the first place without encrypting it. (Not that I own any yet.)

> > # cryptsetup --align-payload 2048 luksFormat /dev/sdz9
> 
> I also would not add this align-payload option. (If you don't,
> cryptsetup will query the kernel for optimal parameters.)

You're right, but the problem comes when the kernel feeds LUKS a value
that it isn't designed to handle correctly. As elsewhere on my systems,
I tend to gravitate towards recipes/solutions that I can use across
all of them, rather than having to deal with lots of exceptions.

In this case, it's the "Optimal transfer size" which catches it out,
when the commonly occurring value of 33553920 bytes is received.
In plain speaking, that's 512*(2**16-1); which might be fine for
the kernel transferring over USB with 32MB buffers, but unfortunately
isn't actually divisible by 2048.

Cheers,
David.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 03:30 +0200
  Re: Advice on encrypted filesystem Roberto C. Sánchez <roberto@debian.org> - 2020-06-25 03:40 +0200
    Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-25 04:20 +0200
    Re: Advice on encrypted filesystem john doe <johndoe65534@mail.com> - 2020-06-25 09:50 +0200
    Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 13:40 +0200
      Re: Advice on encrypted filesystem David <bouncingcats@gmail.com> - 2020-06-25 15:30 +0200
        Re: Advice on encrypted filesystem Nicolas George <george@nsup.org> - 2020-06-25 15:40 +0200
          Sound in Jitsi/BBB [was: dvice on encrypted filesystem] <tomas@tuxteam.de> - 2020-06-25 16:00 +0200
            Re: Sound in Jitsi/BBB [was: dvice on encrypted filesystem] Nicolas George <george@nsup.org> - 2020-06-25 16:00 +0200
              Re: Sound in Jitsi/BBB [was: dvice on encrypted filesystem] <tomas@tuxteam.de> - 2020-06-25 16:10 +0200
        Zoom client for Linux (was: Re: Advice on encrypted filesystem) rhkramer@gmail.com - 2020-06-25 16:20 +0200
      Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 16:30 +0200
  Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-25 04:30 +0200
    Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 13:50 +0200
      Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-26 15:30 +0200
        Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-26 16:40 +0200
        Re: Advice on encrypted filesystem Michael Stone <mstone@debian.org> - 2020-06-26 17:50 +0200
          Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-26 21:10 +0200
            Re: Advice on encrypted filesystem Michael Stone <mstone@debian.org> - 2020-06-26 21:50 +0200
              Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-27 03:30 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 06:10 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 09:10 +0200
                Re: Advice on encrypted filesystem Admin4 <admin4@dwaves.de> - 2020-06-27 10:10 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 21:50 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 22:20 +0200
                Re: Advice on encrypted filesystem Andrei POPESCU <andreimpopescu@gmail.com> - 2020-06-27 10:50 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 23:30 +0200

csiph-web