Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I consider to buy an ssd for my laptop (something like Samsung 830 or 840) to make the system more responsive. I want my system (at least my home partition) to be encrypted. However I know about rumors that there may be problems with encryption on ssd's and although that statements about this change very fast with time. Especially I don't want to have a big performance drop (as said above, I want the ssd to make the system significantly more responsive) and I don't want to shorten the lifetime of my ssd.

Having this in mind, what is the best way to encrypt the system on an ssd?

You can assume that the ssd will be a samsung 830, 840 or 840 pro if this matters.

Edit

My CPU is a pretty old Core2 Duo P8700 with 2,53 GHz without AES-NI and I have only SATA II. So I want to add the question: Does it make sense at all to upgrade say to a Samsung 830 and use dm-crypt/luks or ecryptfs? Or does the CPU and SATA port slow down the SSD too much? I don't want to win any benchmark contest, just want to have an clear improvement in my system responsiveness.

I am not sure if the following is a good indicator about how fast the system will be, so it would be great if someone could comment it:

Currently I am using ecryptfs to encrypt my home partition.

An

LC_ALL=C dd if=/dev/zero of=tempfile bs=1M count=1024 conv=fdatasync,notrunc on my encrypted home partition gives:

1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB) copied, 56.4674 s, 19.0 MB/s

and the CPU is working between 40 and 60%.

The same on an unencrypted partition gives

LC_ALL=C dd if=/dev/zero of=tempfile bs=1M count=1024 conv=fdatasync,notrunc
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB) copied, 29.6554 s, 36.2 MB/s

and the CPU is working between 0 and 20%.

My /tmp folder is mounted via tempfs i.e. it lies in RAM. Doing the same in /tmp gives:

1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB) copied, 0.941708 s, 1.1 GB/s

Then I created a new ecryptfs directory below /tmp and did it there again.

1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB) copied, 10.1884 s, 105 MB/s

and one core working at 100% the other at 20%.

The creation of the ecryptfs dir was as follows:

sudo mount -t ecryptfs /tmp/encrypted/ /tmp/decrypted

As options I choosed the default ones (ubuntu-system): AES, 16 bit, no plaintext passthrough, no filename encryption.

Considering this result I would expect that the writing rate will increase from 19.0 MB/s to 105 MB/s when replacing my old WD-scorpion black 7200 with a Samsung 830 SSD and using ecryptfs. Which seems to be a clear performance improvement. I guess that dm-crypt will even be a bit faster.

Any suggestions to make more reliable tests which will predict if the SSD will bring a clear performance boost.

Edit 2 Here is a similar test in a German debian wiki using dm-crypt: http://wiki.debianforum.de/Benchmark_f%C3%BCr_Festplattenverschl%C3%BCsselung

I did that and got ~95 MB/s.

share|improve this question
    
If you have AES-NI, cryptsetup/LUKS works fine (using one of the AES ciphers). Without AES-NI, you will see a performance penalty when reading/writing. cat /proc/cpuinfo to check. –  frostschutz Apr 9 '13 at 18:41
    
It seems I don't have AES-NI, it's a Core 2 Duo CPU P8700, 2.53GHz –  student Apr 10 '13 at 15:44
add comment

1 Answer

On Linux, use dm-crypt, which is Linux's native block device encryption mechanism. Dm-crypt is supported by many distribution's installers (you may have to use the “advanced” or “server” installation media). The cryptsetup utility manages encrypted volumes. You do need a recent version to support TRIM: kernel ≥3.1 and cryptsetup ≥1.4.

share|improve this answer
    
So if I choose for example the standard lvm full system encryption of ubuntu (alternate) there should be no problems concerning performance/responsiveness and lifetime of the ssd? –  student Mar 30 '13 at 9:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.