Goal: (mostly) full disk encryption with several volumes, some independently encrypted
Rationale: Encryption will secure a disk that is not booted, but for a system that is on 24/7 it does not offer much security while in place. Also, it would be desirable to keep certain data unmounted and secured when not needed even from an authorized user.
Multiple LUKS on LVM
- Drawback: Should work, but generally ill-advised and complicated.
LVM on LUKS + separate partition with LVM on LUKS
- Drawback: Having a partition reduces the benefit of LVM flexibility.
LVM on LUKS with some volumes as LVM-on-LUKS-on-LVM-on-LUKS, i.e. double encryption
- Drawback: Possible performance hit of double encryption. Also, complicated/convoluted. But maintains flexibility of LVM.
Which if any of these options might be best?
How much of a performance penalty would be caused by double encryption?
hdparm -t showed effectively no difference in disk reads on my SATA SSD between unencrypted, encrypted, or double-encrypted volumes.
Any other solutions?