1

I encrypt my external backup devices with AES256 using GELI on FreeBSD 11. I have recently changed the disks to 240GB SSDs whereby only half the capacity is usable which is causing the backup to fail.

  • Windows 10; SSD shows 232GB

  • FreeBSD 11; SSD shows 207GB

    dd if=/dev/zero of=/dev/da0 bs=1M count=10
    gpart add -t freebsd /dev/da0
    newfs /dev/da0 >& /dev/null
    mount /dev/da0 /mnt/backup
    df -g
    /dev/da0   225  0  207  0%  /bk/disk
    
  • FreeBSD 11; SSD shows 116GB

    da0.eli created
    da0.elis1 added
    =>       40  244198504  da0.eli  GPT  (116G)
             40  244198504        1  freebsd  (116G)
    /dev/da0.elis1   112  0  103  0%  /bk/disk
    

Is this expected or is it related to sector sizes?

  • I don't know specific details of FreeBSD, but this looks strange. Encryption is usually designed to have just a constant overhead, or a small factor overhead. Factor 2 is quite much. – v6ak Mar 12 '18 at 20:48
2

The verification option -ahmac/sha256 requires 11% according to the man page. The problem was having verification enabled without setting the default sector size specified requiring 50%. i.e. specify -s4096 with -ahmac/sha256

# geli init -l256 -eaes -ahmac/sha256 -J /root/da0.txt -B /root/da0.eli -K /root/da0.key /dev/da0
# geli attach -k /root/da0.key /dev/da0
# geli list
1. Name: da0.eli
   Mediasize: 125029674496 (116G)
   Sectorsize: 512
   Mode: r0w0e0
Consumers:
1. Name: da0
   Mediasize: 250059350016 (233G)
   Sectorsize: 512
   Mode: r1w1e1

# geli init -l256 -eaes -J /root/da0.txt -B /root/da0.eli -K /root/da0.key /dev/da0
# geli attach -k /root/da0.key /dev/da0
# geli list
1. Name: da0.eli
   Mediasize: 250059349504 (233G)
   Sectorsize: 512
   Mode: r0w0e0
Consumers:
1. Name: da0
   Mediasize: 250059350016 (233G)
   Sectorsize: 512
   Mode: r1w1e1

# geli init -s4096 -l256 -eaes -ahmac/sha256 -J /root/da0.txt -B /root/da0.eli -K /root/da0.key /dev/da0
# geli attach -k /root/da0.key /dev/da0
# geli list
1. Name: da0.eli
   Mediasize: 222274973696 (207G)
   Sectorsize: 4096
   Mode: r0w0e0
Consumers:
1. Name: da0
   Mediasize: 250059350016 (233G)
   Sectorsize: 512
   Mode: r1w1e1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.