6

I'm considering purchasing a 850 Evo but I'm unsure as to the security of the encryption, especially on Linux. My research has shown that bitlocker can be used on windows instead of the insecure ATA password, but is there a similar solution for Linux?

  • If your box supports AES-NI, just use LUKS. – frostschutz Aug 22 '15 at 19:05
  • @frostschutz I'm currently using LUKS for software based encryption. Would LUKS also work with hardware based encryption then? – Wilhelm Erasmus Aug 22 '15 at 19:08
  • 2
    With AES-NI and when actually using AES cipher, it would be CPU accelerated encryption. The SSD is not involved other than actually storing the encrypted data. – frostschutz Aug 22 '15 at 19:15
  • 1
    @frostschutz I know of this solution, but I want to benefit from the actual hardware encryption though. – Wilhelm Erasmus Aug 22 '15 at 19:18
  • Some pointers elsewhere on the SE network: security.stackexchange.com/questions/45542/… askubuntu.com/questions/506556/… (Can not vouch for any of these as I've never used Opal). – derobert Aug 22 '15 at 21:29
3

If you have the AES-NI instructions set in your CPU, then it is also hardware accelerated.

Also I don't see a difference between BitLocker and LUKS. It's a similar approach but at least LUKS is open source, so I tend to trust that better.

And I would trust more LUKS than the OPAL hw standard found in some HDD/SSD. At least it is better auditable. If the Samsung SSD is OPAL compliant and your BIOS/EFI supports it, then it is transparent to Linux: the "decryption" happens before the boot loader is called.

My work laptop as an OPAL HDD and all I had to do is first boot from the HDD once to unlock it, stick the USB installation stick and reboot, then proceed with the installation from the stick.

Note: call me paranoid, but even though this HDD was encrypted using OPAL , I still used LUKS to encrypt the Linux partition. Our IT is taking care of the Windows part, I take care of the Linux one and I don't want it to be messed up. I'm lucky that my employer allows that though!

  • Hi, are you saying that thanks to AES-NI, the perfs are unaffected by the use of software encryption ? – Elzo Apr 6 '16 at 14:03
  • It depends what you mean by perf and for which applications. With AES-NI, throughput should not be affected for SATA3 SSD and for most PCIe SSD. Latency might be affected though and therefore the IOPS too, but for a desktop/laptop PC that's should not make too much difference for Internet browsing or office work. But specialized applications could be affected. This is also true for the hardware encryption of your SSD but differently. – Huygens Apr 6 '16 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.