I'm considering purchasing a 850 Evo but I'm unsure as to the security of the encryption, especially on Linux. My research has shown that bitlocker can be used on windows instead of the insecure ATA password, but is there a similar solution for Linux?
5
-
If your box supports AES-NI, just use LUKS.– frostschutzAug 22, 2015 at 19:05
-
@frostschutz I'm currently using LUKS for software based encryption. Would LUKS also work with hardware based encryption then?– Wilhelm ErasmusAug 22, 2015 at 19:08
-
2With AES-NI and when actually using AES cipher, it would be CPU accelerated encryption. The SSD is not involved other than actually storing the encrypted data.– frostschutzAug 22, 2015 at 19:15
-
1@frostschutz I know of this solution, but I want to benefit from the actual hardware encryption though.– Wilhelm ErasmusAug 22, 2015 at 19:18
-
Some pointers elsewhere on the SE network: security.stackexchange.com/questions/45542/… askubuntu.com/questions/506556/… (Can not vouch for any of these as I've never used Opal).– derobertAug 22, 2015 at 21:29
Add a comment
|
1 Answer
If you have the AES-NI instructions set in your CPU, then it is also hardware accelerated.
Also I don't see a difference between BitLocker and LUKS. It's a similar approach but at least LUKS is open source, so I tend to trust that better.
And I would trust more LUKS than the OPAL hw standard found in some HDD/SSD. At least it is better auditable. If the Samsung SSD is OPAL compliant and your BIOS/EFI supports it, then it is transparent to Linux: the "decryption" happens before the boot loader is called.
My work laptop as an OPAL HDD and all I had to do is first boot from the HDD once to unlock it, stick the USB installation stick and reboot, then proceed with the installation from the stick.
Note: call me paranoid, but even though this HDD was encrypted using OPAL , I still used LUKS to encrypt the Linux partition. Our IT is taking care of the Windows part, I take care of the Linux one and I don't want it to be messed up. I'm lucky that my employer allows that though!
-
Hi, are you saying that thanks to AES-NI, the perfs are unaffected by the use of software encryption ?– HeyApr 6, 2016 at 14:03
-
It depends what you mean by perf and for which applications. With AES-NI, throughput should not be affected for SATA3 SSD and for most PCIe SSD. Latency might be affected though and therefore the IOPS too, but for a desktop/laptop PC that's should not make too much difference for Internet browsing or office work. But specialized applications could be affected. This is also true for the hardware encryption of your SSD but differently.– HuygensApr 6, 2016 at 14:36