Goal: (mostly) full disk encryption with several volumes, some independently encrypted
Rationale: Encryption will secure a disk that is not booted, but for a system that is on 24/7 it does not offer much security while in place. Also, it would be desirable to keep certain data unmounted and secured when not needed even from an authorized user.
Possible solutions:
Multiple LUKS on LVM
- Drawback: Should work, but generally ill-advised and complicated.
LVM on LUKS + separate partition with LVM on LUKS
- Drawback: Having a partition reduces the benefit of LVM flexibility.
LVM on LUKS with some volumes as LVM-on-LUKS-on-LVM-on-LUKS, i.e. double encryption
- Drawback: Possible performance hit of double encryption. Also, complicated/convoluted. But maintains flexibility of LVM.
Which if any of these options might be best?
How much of a performance penalty would be caused by double encryption? hdparm -t
showed effectively no difference in disk reads on my SATA SSD between unencrypted, encrypted, or double-encrypted volumes.
Any other solutions?