Arch Linux

daankata

Member

Registered: 2017-05-21

Posts: 47

SSD Encryption Arch Linux / dm-crypt

Hello!
I have bought a Samsung 850 EVO 250GB yesterday and I am preparing to install Arch on it. But I have some questions before starting.

My SSD supports encryption (ENCRYPTION SUPPORT: AES 256-bit Encryption (Class 0) TCG/Opal IEEE1667 (Encrypted drive)). What does this mean? Can I encrypt the SSD from my BIOS (it suppots ATA password setup) in my PC and not set dm-crypt on it, or any third-party encryption software? I read about security problems with enabling SSD's TRIM function and dm-crypt/LUKS. If I make full-disk encryption with dm-crypt on my SSD and do Periodic TRIM, not Continuous, will this stop the "potential security implications" or it affects both, and the Periodic TRIM and the Continuous TRIM?

And do you have any extra tips about installing Arch on a SSD?

Thank you!:)

Rethil

Member

Registered: 2014-08-21

Posts: 83

Re: SSD Encryption Arch Linux / dm-crypt

This may help:
https://bbs.archlinux.org/viewtopic.php … 6#p1642186
https://wiki.archlinux.org/index.php/So … encryption

I'm using same SSD with LUKS/dm-crypt on it with periodic TRIM, after some searches, I decided to stop being so paranoid about it.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: SSD Encryption Arch Linux / dm-crypt

TRIM works fine with LUKS if you add the allow_discards flag in the appropriate places. You can check `dmsetup table` if this flag is present.

There is no security problem. People will be able to tell that you have "free space" (and where) but your data is still encrypted and stays that way.

I don't like ATA passwords, at least not as long as there is no way to "factory reset" the drive and make it work again. I'm not sure how to feel about encryption built into the drives - I trust LUKS more in any case and if your system has AES-NI you won't notice a difference.

R00KIE

Forum Fellow

From: Between a computer and a chair

Registered: 2008-09-14

Posts: 4,734

Re: SSD Encryption Arch Linux / dm-crypt

What frostschutz said about trim on luks is right, your data will still be encrypted. The place where you've read about the possible security implications of knowing where the free space is should explain why, it's up to you to decide if it matters to _you_. Personally I wouldn't lose sleep over it, but my concerns about a stolen/lost laptop. That said, my personal subjective experience says using luks even with aes-ni might use more power than using the ssd's built in encryption, which according to what I've seen so far is always being done, even on what looks to be an unencrypted drive.

Regarding your ssd encryption support, I have always been very skeptical about the claim that by using a password set by the bios you are doing encryption the right way. If you decide to go the proper TCG/Opal way it is a whole different can of worms and you should be aware that for now there are caveats, the most important is if you are using a sata drive you will not be able to suspend your laptop, or better, you can but there is no way to unlock the ssd before the OS tries to use it again and as such it will not end well.

There is work being done on the kernel for nvme drives that allows you to tell the kernel the unlock password so it can unlock the ssd after a resume, but I suspect that someone still has to do the userspace side of things, this means coding and properly testing things.

Regarding regaining access to the ssd if you forget the encryption password, I don't know how it is for nvme drives, but for sata drives using encryption the TCG/Opal way you do a PSID revert and the drive will become usable again, but all your data will be lost obviously.

---

R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K