There are three main storage encryption possibilities under Linux. Ordered from lowest level to highest level, from fastest to slowest, from least flexible to most flexible:
- Dm-crypt to encrypt a whole filesystem (or more generally any storage device). You get the best performance, but you have to decide to use it when you organize your storage partitions, and there's a key per partition.
- Ecryptfs to encrypt a user's home directory. Each user has their own key. The encryption is performed in the kernel, but the encryption is at the file level rather than at the block level which slows things down.
- Encfs to encrypt a few files. This can be set up by an ordinary user, as it only requires the administrator to provide FUSE. You can easily have multiple filesystems with different keys. It's slower than the other two.
Given your constraints, dm-crypt is clearly the right choice. You can get better performance by encrypting only the files that need to be encrypted, and not the operating system. If you haven't really started to use your new system, it'll be simpler to reinstall, but you can also work on your existing system by booting from a live CD such as SystemRescueCD.
Make a system partition and a separate
/home partition, or even a separate
/encrypted partition if you don't want the whole home directory to be encrypted but only some selected files. Make a dmcrypt volume for the one filesystem that you want to encrypt.
There might be a little to gain by choosing the fastest cipher. AES-128 instead of AES-256 should give you a very slight performance increase at no cost to security. Pick CBC rather than XTS for the cipher mode, since you don't need integrity:
cryptsetup luksCreate -c aes-cbc-sha256 -s 128. You can even choose
aes-cbc-plain as the cipher: it's insecure, but only if the attacker can plant chosen files on your system, which doesn't matter for your use case; I don't know if there's any gain in performance though. The choice of hash (
-h) only influences the time it takes to verify your passphrase when you mount the disk, so don't skimp on it.