4 ms·

I have FDE enabled on a laptop with an m.2 ssd, and I don't notice much (if any) slowness compared to an unencrypted install. but since the m.2 ssd's are so fa

I have FDE enabled on a laptop with an m.2 ssd, and I don't notice much (if any) slowness compared to an unencrypted install. but since the m.2 ssd's are so fast, YMMV on other media types.

867-5309 6y ago
modern high class SSDs have a hardware encryption chip, sort of like Intel's AES-NI for CPUs, which greatly reduces the burden on the CPU. you only really notice a difference when accessing larger files and the SSD's internal buffer fills up and offloads
- tedunangst 6y ago
  OpenBSD doesn't use any on drive encryption features.
  - chungus_khan 6y ago
    And for good reason considering some of them lie about actually encrypting the data, or are very bad about keeping it safe. https://www.tomshardware.com/news/bitlocker-encrypts-self-encrypting-ssds,40504.html https://www.tomshardware.com/news/bitlocker-encrypts-self-en...
- michaelmrose 6y ago
  These rely on the vendors secret sauce and an analysis years back found these frequently horribly broken like my password is password levels of broken. Bitlocker by default on windows will happily depend on these broken implications in favor of actually secure options that are now and for years specifically accelerated by your cpu. They are also potentially worthless at protecting data in suspended laptops which for some is a machines condition 99% of the time when it is apt to be lost or stolen.
  - fomine3 6y ago
    Any citations about broken AES-NI?
    - michaelmrose 6y ago
      To be clear the parent post and mine were discussing self encrypting drives. Drives which handle the encryption and decryption on drive instead of relying on your CPU. This is what is insecure. https://www.tomshardware.com/news/crucial-samsung-ssd-encryption-bypassed,38025.html https://www.tomshardware.com/news/crucial-samsung-ssd-encryp... https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self-encrypting-drives/ https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self... https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/ https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks... Self encrypting drives are have been insecure for years.
      - fomine3 6y ago
        Thanks, I misunderstood.
  - athms 6y ago
    >Bitlocker by default on windows will happily depend on these broken implications... This was changed September 2019, when Microsoft pushed an update that defaults Bitlocker to software encryption.
- Spooky23 6y ago
  Most of those are black boxes. If you have a compliance requirement for encryption, your hardware crypto probably doesn’t meet it. For modern devices, there is no performance impact from software FDE. To be meaningful, you need to have specific configurations in place as well as appropriate handling. If you’re not doing that, don’t bother.
  - mhitza 6y ago
    > For modern devices, there is no performance impact from software FDE Ha! https://blog.cloudflare.com/speeding-up-linux-disk-encryption/ https://blog.cloudflare.com/speeding-up-linux-disk-encryptio... At least since october last year the story around dm-crypt seems to have changed with their patches. I dropped FDE last year in spring after a tormented year of often caused ui freezes. With an SSD mind you. I just think that in this particular case dm-crypt devs don't actually encrypt their drives and haven't experienced the degraded performance. Otherwise, I'd agree with you. Had no problem with FDE and my smartphone.

I have FDE enabled on a laptop with an m.2 ssd, and I don't notice much (if any) slowness compared to an unencrypted install. but since the m.2 ssd's are so fast, YMMV on other media types.

867-5309 6y ago

modern high class SSDs have a hardware encryption chip, sort of like Intel's AES-NI for CPUs, which greatly reduces the burden on the CPU. you only really notice a difference when accessing larger files and the SSD's internal buffer fills up and offloads

tedunangst 6y ago
OpenBSD doesn't use any on drive encryption features.
- chungus_khan 6y ago
  And for good reason considering some of them lie about actually encrypting the data, or are very bad about keeping it safe. https://www.tomshardware.com/news/bitlocker-encrypts-self-encrypting-ssds,40504.html https://www.tomshardware.com/news/bitlocker-encrypts-self-en...
michaelmrose 6y ago
These rely on the vendors secret sauce and an analysis years back found these frequently horribly broken like my password is password levels of broken. Bitlocker by default on windows will happily depend on these broken implications in favor of actually secure options that are now and for years specifically accelerated by your cpu. They are also potentially worthless at protecting data in suspended laptops which for some is a machines condition 99% of the time when it is apt to be lost or stolen.
- fomine3 6y ago
  Any citations about broken AES-NI?
  - michaelmrose 6y ago
    To be clear the parent post and mine were discussing self encrypting drives. Drives which handle the encryption and decryption on drive instead of relying on your CPU. This is what is insecure. https://www.tomshardware.com/news/crucial-samsung-ssd-encryption-bypassed,38025.html https://www.tomshardware.com/news/crucial-samsung-ssd-encryp... https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self-encrypting-drives/ https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self... https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/ https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks... Self encrypting drives are have been insecure for years.
    - fomine3 6y ago
      Thanks, I misunderstood.
- athms 6y ago
  >Bitlocker by default on windows will happily depend on these broken implications... This was changed September 2019, when Microsoft pushed an update that defaults Bitlocker to software encryption.
Spooky23 6y ago
Most of those are black boxes. If you have a compliance requirement for encryption, your hardware crypto probably doesn’t meet it. For modern devices, there is no performance impact from software FDE. To be meaningful, you need to have specific configurations in place as well as appropriate handling. If you’re not doing that, don’t bother.
- mhitza 6y ago
  > For modern devices, there is no performance impact from software FDE Ha! https://blog.cloudflare.com/speeding-up-linux-disk-encryption/ https://blog.cloudflare.com/speeding-up-linux-disk-encryptio... At least since october last year the story around dm-crypt seems to have changed with their patches. I dropped FDE last year in spring after a tormented year of often caused ui freezes. With an SSD mind you. I just think that in this particular case dm-crypt devs don't actually encrypt their drives and haven't experienced the degraded performance. Otherwise, I'd agree with you. Had no problem with FDE and my smartphone.