Re: Whole Disk Encryption + SSD

From	piorunz <piorunz@gmx.com>
Newsgroups	linux.debian.user
Subject	Re: Whole Disk Encryption + SSD
Date	2021-06-29 14:10 +0200
Message-ID	<CvkIV-5dg-3@gated-at.bofh.it> (permalink)
References	<Cv0TT-1C0-3@gated-at.bofh.it> <Cv6cV-4QX-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi David,

Thanks for your reply.

On 28/06/2021 21:36, David Christensen wrote:

> Software encryption (dm-crypt, Linux Unified Key System (LUKS), etc.)
> for a system drive is typically applied to the swap, root, and/or data
> partitions, but the master boot record (partition table and boot
> loader), extensible firmware interface (EFI) system partition contents,
> and boot partition contents are plaintext and easily modified by an
> attacker with physical access.  You will want a CPU with AES-NI or
> equivalent to accelerate encryption/ decryption (should get 90%+
> performance).  Without AES-NI, performance will be fractional.

Thanks. I will check out AES-NI on this CPU.

> The simplest way to protect a drive at rest (e.g. powered off) is to get
> a self-encrypting drive (SED).  The motherboard firmware prompts for the
> passphrase after the power on self test (POST) and before reading the
> drive.  Once the SED passphrase is entered, the entire drive appears as
> plaintext.  Encryption/ decryption is handled by hardware inside the
> drive controller, at full performance.

I don't trust SED, after listening to Steve Gibson analysis on state of
this feature.

Audio podcast: http://media.GRC.com/sn/SN-689.mp3
Transcript: https://www.grc.com/sn/sn-689.pdf

His findings were sourced, among other things, on work of security
researchers at the Radboud University in the Netherlands, titled:
"Self-Encrypting Deception: Weaknesses in the encryption of solid-
state drives."
https://ieeexplore.ieee.org/abstract/document/8835339

> I do not set the 'discard' (trim) option in fstab(5).  If and when I
> want to erase unused blocks (such as before taking an image), I use
> fstrim(8).

Yes, I use fstrim on weekly basis via crontab on all my SSD based
computers. I don't use discard option in fstab.
Will fstrim work with Debian-encrypted /home partition? fstrim will show
trimmed gigabytes, just like on normal system?
If yes then that's in, my enquiry is solved.

> I would not worry about wearing out a good SSD in a daily driver laptop.
>   I have been using Intel SSD 520 Series 2.5" SATA in my SOHO laptops,
> desktops, and servers for many years; they all work and have available
> lifespans in the high 90%'s.

I prefer to preserve SSD life if I can. And with this problem, it's a
matter of proper configuring it ONCE during install, and then reap the
benefits for years to come. I don't want to throw away free performance
and longevity boost.

> Along with SED, I suggest that you also implement Secure Boot.  This
> provides cryptographic signatures and chain of trust for critical files,
> such as boot loaders and the kernel, whenever those files are to be
> executed (e.g. boot, dynamic loading, etc.).

Thanks, I plan to use that. I already use it on my desktop.

--

With kindest regards, piorunz.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

Thread

Whole Disk Encryption + SSD piorunz <piorunz@gmx.com> - 2021-06-28 17:00 +0200
  Re: Whole Disk Encryption + SSD Jochen Spieker <ml@well-adjusted.de> - 2021-06-28 18:00 +0200
  Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-28 22:40 +0200
    Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-29 00:00 +0200
    Re: Whole Disk Encryption + SSD Stefan Monnier <monnier@iro.umontreal.ca> - 2021-06-29 02:00 +0200
      Re: Whole Disk Encryption + SSD <tomas@tuxteam.de> - 2021-06-29 09:50 +0200
        Re: Whole Disk Encryption + SSD Stefan Monnier <monnier@iro.umontreal.ca> - 2021-06-30 00:50 +0200
        Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-30 01:00 +0200
    Re: Whole Disk Encryption + SSD Jonathan Dowland <jon+debian-user@dow.land> - 2021-06-29 11:30 +0200
    Re: Whole Disk Encryption + SSD piorunz <piorunz@gmx.com> - 2021-06-29 14:10 +0200
      Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-30 02:20 +0200
    Re: Whole Disk Encryption + SSD David Wright <deblis@lionunicorn.co.uk> - 2021-07-02 05:00 +0200
      Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 05:50 +0200
        Useless use of "dd" Teemu Likonen <tlikonen@iki.fi> - 2021-07-02 07:50 +0200
          Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 09:50 +0200
            Re: Useful use of dd [was: Useless use of "dd"] Teemu Likonen <tlikonen@iki.fi> - 2021-07-02 12:30 +0200
              Re: Useful use of dd "Thomas Schmitt" <scdbackup@gmx.net> - 2021-07-02 13:00 +0200
                Re: Useful use of dd <tomas@tuxteam.de> - 2021-07-02 13:20 +0200
                Re: Useful use of dd Teemu Likonen <tlikonen@iki.fi> - 2021-07-02 13:30 +0200
                Re: Useful use of dd David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 23:50 +0200
              Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 13:20 +0200
              Re: Useful use of dd Michael Stone <mstone@debian.org> - 2021-07-02 14:50 +0200
              Re: Useful use of dd [was: Useless use of "dd"] Kushal Kumaran <kushal@locationd.net> - 2021-07-02 21:10 +0200
                Creation of empty files [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 23:40 +0200
                Re: Creation of empty files [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-03 00:00 +0200
                Re: Creation of empty files [was: Useful use of dd] Michael Stone <mstone@debian.org> - 2021-07-03 15:50 +0200
                Re: Creation of empty files [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-03 23:40 +0200
                Re: Creation of empty files [was: Useful use of dd] Michael Stone <mstone@debian.org> - 2021-07-04 06:00 +0200
            Re: Useful use of dd [was: Useless use of "dd"] Greg Wooledge <greg@wooledge.org> - 2021-07-02 13:40 +0200
              Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 13:40 +0200
                Re: Useful use of dd [was: Useless use of "dd"] David Wright <deblis@lionunicorn.co.uk> - 2021-07-02 17:10 +0200
                Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 17:40 +0200
                Re: Useful use of dd [was: Useless use of "dd"] Gunnar Gervin <dofeelok@gmail.com> - 2021-07-03 09:20 +0200
                Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-03 09:30 +0200
            Useless use of shell pipelines [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 23:40 +0200
              Re: Useless use of shell pipelines [was: Useful use of dd] l0f4r0@tuta.io - 2021-07-03 10:30 +0200
                Re: Useless use of shell pipelines [was: Useful use of dd] Greg Wooledge <greg@wooledge.org> - 2021-07-03 15:40 +0200
          Re: Useless use of "dd" David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 21:40 +0200
        Re: Whole Disk Encryption + SSD David Wright <deblis@lionunicorn.co.uk> - 2021-07-02 17:10 +0200
          Re: Whole Disk Encryption + SSD Michael Stone <mstone@debian.org> - 2021-07-02 17:30 +0200
          Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 20:40 +0200

csiph-web