4 ms·

Sadly this feature comes just as SSDs are heading toward ubiquity -- whole disk encryption greatly slows down SSDs to near hard drive levels when done in softwa

by mapgrep 16y ago

Sadly this feature comes just as SSDs are heading toward ubiquity -- whole disk encryption greatly slows down SSDs to near hard drive levels when done in software, as PGP users have learned (http://forum.pgp.com/t5/PGP-Whole-Disk-Encryption-for/PGP-WDE-very-slow-with-OWC-Extreme-Pro-RE-SSD/td-p/35153 http://forum.pgp.com/t5/PGP-Whole-Disk-Encryption-for/PGP-WD...). That said, some SSDs can do their own encryption in hardware, but they need OS support (via Trusted Computing Group standards) for it to be effective (storing the key within the controller would defeat the point). Hopefully this, too, will be supported under Lion. Certain versions of Windows 7 already support it. In any case it's a very positive (if long overdue) move.

ryannielsen 16y ago
Whole drive encryption (e.g. TCG Opal) has many drawbacks. Most importantly: it's "whole drive". There's no way to segregate individual user data and still get the benefits of hardware accelerated encryption. For systems that need segregated users (or even something like an unencrypted system volume with a single encrypted user), you need to toss encryption hardware into the upstream IO pipeline for any benefit. Sticking such hardware into the drive is too restrictive, and also raises the cost of each drive. Furthermore, many chipsets (such as Nehalem and Sandy Bridge) have integrated AES acceleration that offer significant encryption/decryption performance improvements. While encrypted reads/writes will never match the performance of standard reads/writes, Nehalem and SB very much mitigate the performance hit and will still give multi-hundred MB/s throughput on fast SSDs. If I were Apple, I'd ignore TCG Opal and focus on distributing Nehalem and Sandy Bridge throughout the product lineup. (Or, in the case of iOS devices, toss custom ASICS on the upstream IO pipeline.) Then you can offer true encrypted user segregation (or one encrypted user and an unencrypted OS volume) while still buying standard HDDs and SDDs in bulk. Win-win.
- tptacek 16y ago
  The point of WDE isn't to do fine-grained separation of interests by security level; it's to ensure that a stolen drive yields nothing to an attacker. In a lot of settings, anything less than whole disk encryption sets a process in motion requiring formal disclosures. Segregated users and accelerated filesystem-level encryption is all good stuff, but even with it, you still need WDE.
  - ryannielsen 16y ago
    No, you don't. Only user data needs to be encrypted. There's no value in encrypting the OS or any apps. None. By definition, they must ship on unencrypted media. Why pay any encryption/decryption cost for information that exists unencrypted? Assuming a perfect implementation, whole disk encryption costs money and power. Any additional logic on the drives will raise their cost (at no benefit if there's already CPU provided acceleration for the same operations) and will raise power consumption. The biggest benefit comes from truly segregated, properly and completely encrypted user volumes, where all user-created is always encrypted with their private key at all times. Chrome OS does exactly this, and all OSs should strive to do the same. [1] Opal solves a single use case. Flexible per-user encryption solves all cases and offers better performance. [1] http://www.chromium.org/chromium-os/chromiumos-design-docs/protecting-cached-user-data http://www.chromium.org/chromium-os/chromiumos-design-docs/p...
    - kogir 16y ago
      Without WDE, how can you verify that the OS and apps haven't been altered? If a laptop with WDE is left in my control for days and then returned, you know you're still safe. Without WDE, you have to completely wipe the unencrypted portion lest modified apps upload your encrypted user data once the system boots.
      - borism 16y ago
        You can compare unencrypted system files to those on your Time Machine back-up or installation media. What if system and program files were modified from within the system? WDE doesn't help in this case. WDE doesn't solve integrity or availability problems. It's primary goal is confidentiality.
      - ryannielsen 16y ago
        Arguably, all binaries comprising the OS and installed apps should be individually signed to ensure they're never modified, even by a malicious user who can access the encrypted disk. Whole disk encryption guarantees nothing more than your disk is encrypted. On pure single-user systems that are never accessible by other users, that might be fine. The second you allow more that one user, remote or local, to access the disk, you may as well treat the disk as unencrypted. At that point, you need to rely on per-user data encryption and OS and app signature validation to prevent malicious attacks.

by mapgrep 16y ago

ryannielsen 16y ago

Whole drive encryption (e.g. TCG Opal) has many drawbacks. Most importantly: it's "whole drive". There's no way to segregate individual user data and still get the benefits of hardware accelerated encryption. For systems that need segregated users (or even something like an unencrypted system volume with a single encrypted user), you need to toss encryption hardware into the upstream IO pipeline for any benefit. Sticking such hardware into the drive is too restrictive, and also raises the cost of each drive. Furthermore, many chipsets (such as Nehalem and Sandy Bridge) have integrated AES acceleration that offer significant encryption/decryption performance improvements. While encrypted reads/writes will never match the performance of standard reads/writes, Nehalem and SB very much mitigate the performance hit and will still give multi-hundred MB/s throughput on fast SSDs. If I were Apple, I'd ignore TCG Opal and focus on distributing Nehalem and Sandy Bridge throughout the product lineup. (Or, in the case of iOS devices, toss custom ASICS on the upstream IO pipeline.) Then you can offer true encrypted user segregation (or one encrypted user and an unencrypted OS volume) while still buying standard HDDs and SDDs in bulk. Win-win.

tptacek 16y ago
The point of WDE isn't to do fine-grained separation of interests by security level; it's to ensure that a stolen drive yields nothing to an attacker. In a lot of settings, anything less than whole disk encryption sets a process in motion requiring formal disclosures. Segregated users and accelerated filesystem-level encryption is all good stuff, but even with it, you still need WDE.
- ryannielsen 16y ago
  No, you don't. Only user data needs to be encrypted. There's no value in encrypting the OS or any apps. None. By definition, they must ship on unencrypted media. Why pay any encryption/decryption cost for information that exists unencrypted? Assuming a perfect implementation, whole disk encryption costs money and power. Any additional logic on the drives will raise their cost (at no benefit if there's already CPU provided acceleration for the same operations) and will raise power consumption. The biggest benefit comes from truly segregated, properly and completely encrypted user volumes, where all user-created is always encrypted with their private key at all times. Chrome OS does exactly this, and all OSs should strive to do the same. [1] Opal solves a single use case. Flexible per-user encryption solves all cases and offers better performance. [1] http://www.chromium.org/chromium-os/chromiumos-design-docs/protecting-cached-user-data http://www.chromium.org/chromium-os/chromiumos-design-docs/p...
  - kogir 16y ago
    Without WDE, how can you verify that the OS and apps haven't been altered? If a laptop with WDE is left in my control for days and then returned, you know you're still safe. Without WDE, you have to completely wipe the unencrypted portion lest modified apps upload your encrypted user data once the system boots.
    - borism 16y ago
      You can compare unencrypted system files to those on your Time Machine back-up or installation media. What if system and program files were modified from within the system? WDE doesn't help in this case. WDE doesn't solve integrity or availability problems. It's primary goal is confidentiality.
    - ryannielsen 16y ago
      Arguably, all binaries comprising the OS and installed apps should be individually signed to ensure they're never modified, even by a malicious user who can access the encrypted disk. Whole disk encryption guarantees nothing more than your disk is encrypted. On pure single-user systems that are never accessible by other users, that might be fine. The second you allow more that one user, remote or local, to access the disk, you may as well treat the disk as unencrypted. At that point, you need to rely on per-user data encryption and OS and app signature validation to prevent malicious attacks.