4 ms·

Good article. I would disagree with his assertion that keeping time synchronized is not a security feature; since everyone and his mother adopted TLS, it defin

Good article. I would disagree with his assertion that keeping time synchronized is not a security feature; since everyone and his mother adopted TLS, it definitely is. I'd also recommend changing the title to, "What security does a default OpenBSD installation offer?" While it deviates from what the author wrote, I'm guessing English is not his first language and that is what he intended, and it makes it clearer for readers. As an aside, he mentions encrypted swap. Can any OpenBSD users comment on how that affects performance?

lmohseni 6y ago
I have FDE enabled on a laptop with an m.2 ssd, and I don't notice much (if any) slowness compared to an unencrypted install. but since the m.2 ssd's are so fast, YMMV on other media types.
- 867-5309 6y ago
  modern high class SSDs have a hardware encryption chip, sort of like Intel's AES-NI for CPUs, which greatly reduces the burden on the CPU. you only really notice a difference when accessing larger files and the SSD's internal buffer fills up and offloads
  - tedunangst 6y ago
    OpenBSD doesn't use any on drive encryption features.
    - chungus_khan 6y ago
      And for good reason considering some of them lie about actually encrypting the data, or are very bad about keeping it safe. https://www.tomshardware.com/news/bitlocker-encrypts-self-encrypting-ssds,40504.html https://www.tomshardware.com/news/bitlocker-encrypts-self-en...
  - michaelmrose 6y ago
    These rely on the vendors secret sauce and an analysis years back found these frequently horribly broken like my password is password levels of broken. Bitlocker by default on windows will happily depend on these broken implications in favor of actually secure options that are now and for years specifically accelerated by your cpu. They are also potentially worthless at protecting data in suspended laptops which for some is a machines condition 99% of the time when it is apt to be lost or stolen.
    - fomine3 6y ago
      Any citations about broken AES-NI?
      - michaelmrose 6y ago
        To be clear the parent post and mine were discussing self encrypting drives. Drives which handle the encryption and decryption on drive instead of relying on your CPU. This is what is insecure. https://www.tomshardware.com/news/crucial-samsung-ssd-encryption-bypassed,38025.html https://www.tomshardware.com/news/crucial-samsung-ssd-encryp... https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self-encrypting-drives/ https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self... https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/ https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks... Self encrypting drives are have been insecure for years.
        fomine3 6y ago
        Thanks, I misunderstood.
    - athms 6y ago
      >Bitlocker by default on windows will happily depend on these broken implications... This was changed September 2019, when Microsoft pushed an update that defaults Bitlocker to software encryption.
  - Spooky23 6y ago
    Most of those are black boxes. If you have a compliance requirement for encryption, your hardware crypto probably doesn’t meet it. For modern devices, there is no performance impact from software FDE. To be meaningful, you need to have specific configurations in place as well as appropriate handling. If you’re not doing that, don’t bother.
    - mhitza 6y ago
      > For modern devices, there is no performance impact from software FDE Ha! https://blog.cloudflare.com/speeding-up-linux-disk-encryption/ https://blog.cloudflare.com/speeding-up-linux-disk-encryptio... At least since october last year the story around dm-crypt seems to have changed with their patches. I dropped FDE last year in spring after a tormented year of often caused ui freezes. With an SSD mind you. I just think that in this particular case dm-crypt devs don't actually encrypt their drives and haven't experienced the degraded performance. Otherwise, I'd agree with you. Had no problem with FDE and my smartphone.
daneel_w 6y ago
She's French, I believe. I don't know how to easily/accurately measure the I/O performance of the encrypted swap in itself, but if it's to any value I do run OpenBSD with FDE (full-disk encryption) on an old mechanical 2.5" drive, on a somewhat modern low-power Celeron setup, and I see around 45-50 MB/s transfer speeds for both reads and writes. I don't know what the same setup and drive reaches without FDE.
IcePic 6y ago
I think someone said it costs +50% in time to swap out pages when it was enabled, but as soon as you are swapping, such timings have very little bearing on your experience, since any time a program have to wait for a page to get in from a disk, the process is already running 1000x slower than it should.

lmohseni 6y ago

I have FDE enabled on a laptop with an m.2 ssd, and I don't notice much (if any) slowness compared to an unencrypted install. but since the m.2 ssd's are so fast, YMMV on other media types.

867-5309 6y ago
modern high class SSDs have a hardware encryption chip, sort of like Intel's AES-NI for CPUs, which greatly reduces the burden on the CPU. you only really notice a difference when accessing larger files and the SSD's internal buffer fills up and offloads
- tedunangst 6y ago
  OpenBSD doesn't use any on drive encryption features.
  - chungus_khan 6y ago
    And for good reason considering some of them lie about actually encrypting the data, or are very bad about keeping it safe. https://www.tomshardware.com/news/bitlocker-encrypts-self-encrypting-ssds,40504.html https://www.tomshardware.com/news/bitlocker-encrypts-self-en...
- michaelmrose 6y ago
  These rely on the vendors secret sauce and an analysis years back found these frequently horribly broken like my password is password levels of broken. Bitlocker by default on windows will happily depend on these broken implications in favor of actually secure options that are now and for years specifically accelerated by your cpu. They are also potentially worthless at protecting data in suspended laptops which for some is a machines condition 99% of the time when it is apt to be lost or stolen.
  - fomine3 6y ago
    Any citations about broken AES-NI?
    - michaelmrose 6y ago
      To be clear the parent post and mine were discussing self encrypting drives. Drives which handle the encryption and decryption on drive instead of relying on your CPU. This is what is insecure. https://www.tomshardware.com/news/crucial-samsung-ssd-encryption-bypassed,38025.html https://www.tomshardware.com/news/crucial-samsung-ssd-encryp... https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self-encrypting-drives/ https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self... https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/ https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks... Self encrypting drives are have been insecure for years.
      - fomine3 6y ago
        Thanks, I misunderstood.
  - athms 6y ago
    >Bitlocker by default on windows will happily depend on these broken implications... This was changed September 2019, when Microsoft pushed an update that defaults Bitlocker to software encryption.
- Spooky23 6y ago
  Most of those are black boxes. If you have a compliance requirement for encryption, your hardware crypto probably doesn’t meet it. For modern devices, there is no performance impact from software FDE. To be meaningful, you need to have specific configurations in place as well as appropriate handling. If you’re not doing that, don’t bother.
  - mhitza 6y ago
    > For modern devices, there is no performance impact from software FDE Ha! https://blog.cloudflare.com/speeding-up-linux-disk-encryption/ https://blog.cloudflare.com/speeding-up-linux-disk-encryptio... At least since october last year the story around dm-crypt seems to have changed with their patches. I dropped FDE last year in spring after a tormented year of often caused ui freezes. With an SSD mind you. I just think that in this particular case dm-crypt devs don't actually encrypt their drives and haven't experienced the degraded performance. Otherwise, I'd agree with you. Had no problem with FDE and my smartphone.

daneel_w 6y ago

She's French, I believe. I don't know how to easily/accurately measure the I/O performance of the encrypted swap in itself, but if it's to any value I do run OpenBSD with FDE (full-disk encryption) on an old mechanical 2.5" drive, on a somewhat modern low-power Celeron setup, and I see around 45-50 MB/s transfer speeds for both reads and writes. I don't know what the same setup and drive reaches without FDE.

IcePic 6y ago

I think someone said it costs +50% in time to swap out pages when it was enabled, but as soon as you are swapping, such timings have very little bearing on your experience, since any time a program have to wait for a page to get in from a disk, the process is already running 1000x slower than it should.