3

I have bought a Samsung 850 EVO 250GB yesterday and I am preparing to install Arch on it. But I have some questions before starting.

My SSD supports encryption (ENCRYPTION SUPPORT: AES 256-bit Encryption (Class 0) TCG/Opal IEEE1667 (Encrypted drive)). What does this mean? Can I encrypt the SSD from my BIOS (it suppots ATA password setup) in my PC and not set dm-crypt on it, or any third-party encryption software? I read about security problems with enabling SSD's TRIM function and dm-crypt/LUKS. If I make full-disk encryption with dm-crypt on my SSD and do Periodic TRIM, not Continuous, will this stop the "potential security implications" or it affects both, and the Periodic TRIM and the Continuous TRIM?

And do you have any extra tips about installing Arch on a SSD?

Thank you!:)

Improve this question
1

1 Answer 1

Reset to default
0

Your SSD supporting encryption means you can set an ATA password on the BIOS to ensure that data stored in the disk is encrypted transparently by hardware all done by the disk's circuitry. This ensures that your data cannot be recovered by analysing the disk physically. It also means that if you forget your password, the data is lost. IF you try to use the disk on another computer, you will have to set it up to unlock with your password on the BIOS.

Alternatively you can dm-crypt the disk, that's not an issue at all. Software encryption layers are efficient nowadays. You gain flexibility by opting for dm-crypt, not necessarily security. And you're not losing anything either.

Having hardware and dm-crypt gives you no advantage.

I am not aware of the current research re: TRIM vs dm-crypt.

Arch Linux will work fine under an SSD with or without hardware encryption, with or without dm-crypt.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .