You are not logged in.

#1 2016-07-18 20:23:24

famyse
Member
Registered: 2016-07-06
Posts: 4

SSD encryption the right way

When encrypting devices it is always recommended to fill it with random data first, or it would become evident that the drive is encrypted and how much encrypted data there is.
I've read that on a ssd this can cause performance problems since there are no empty blocks where the drive can quickly write to. Would TRIM help in this situation? Is it recommended to leave some zeroed out space anyway?
however,  TRIM cannot be used without security implications. Linux has a pretty good TRIM support for SSDs , but it is known that enabling TRIM on encrypted drives may give away both the size and the type of the filesystem that is being encrypted. According to the wiki, one must either accept the loss of performance or the loss of security.
Would setting up a raid0 with trim support perhaps help giving the best of both worlds? cheers.

Offline

#2 2016-07-18 20:31:11

frostschutz
Member
Registered: 2013-11-15
Posts: 1,409

Re: SSD encryption the right way

Adding RAID to the mix won't help you at all. If you had a problem without RAID you still have a problem with RAID because RAID is just as obvious as everything else really. Adding obscurity does not make it any more secure.

When encrypting devices it is always recommended to fill it with random data first, or it would become evident that the drive is encrypted and how much encrypted data there is.

Filling a device with anything is mainly to get rid of old unencrypted data.

it is known that enabling TRIM on encrypted drives may give away both the size and the type of the filesystem that is being encrypted

Yes, it will show how much encrypted data there is, and where. But who cares?

Some time ago I pasted a hexdump of my encrypted SSD online for anyone to see: https://bpaste.net/raw/505157

(random data segments shortened by -- but apart of that it gives you everything)

Now tell me what can you do with it?

And why do you worry about this issue instead of worrying what people could do to you with a $1 keylogger or $5 decryption wrench https://xkcd.com/538/

There is nothing wrong with using TRIM on an encrypted SSD (and just blkdiscard'ing the entire device instead of filling it with random data). Also there are many encryption solutions out there where "visible free space" is completely normal. This is the case with any file based encryption (ecryptfs, encfs, and the recent ext4 built-in encryption) and it does not make these solutions inherently insecure in any way.

It's not an issue at all, just a load of FUD out there. Most setups have glaring weak points elsewhere…

----

I wanted to add a bit more security to my own setup (I don't like setups I know how to break myself, e.g. by tampering initramfs) so what I did was move bootloader and /boot to an USB stick (which stays in my pocket next to my keys, so it's not easy to tamper with my /boot), and on that I have encrypted keyfiles, so when I enter my passphrase it's a passphrase for the keyfile itself, if someone grabs it with a keylogger it's useless without also having a copy of my USB stick, so for a successful hands-on attack, you'd have to log all USB traffic not just the keyboard. And if that's not good enough you pretty much have already lost anyway.

And then there's obviously keeping the running system itself secure. Don't run crap services that expose everything to the internet. I use proprietary software (like steam) but I don't let it run under my own user account, it runs as a separate user with no rights to my private data at all. That rm -rf bug that steam had some time ago, on my system it would have deleted steam, and nothing else.

Things such as these are very much higher on the list of things to take care of, the visible free space issue on the other hand is pretty much at the bottom of this list yet people seem to worry about it a lot more than anything else.

Last edited by frostschutz (2016-07-18 20:39:23)

Offline

#3 2016-07-18 20:42:07

jasonwryan
Anarchist
From: .nz
Registered: 2009-05-09
Posts: 30,424
Website

Re: SSD encryption the right way

Not a Sysadmin issue, moving to NC...


Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

Offline

#4 2016-07-18 22:27:28

famyse
Member
Registered: 2016-07-06
Posts: 4

Re: SSD encryption the right way

Sorry, I didn't know where to place this post.
thank you for your tips Frost, your analysis makes a lot of sense.

Offline

Board footer

Powered by FluxBB