61

I would assume that a full-disk encryption deployment would introduce additional writes each time the computer is booted up and shut down. Given that solid state disks are considered to have a lower average capacity for writes before failure, can a full-disk encryption solution lower the expected lifetime of the disk on which it is deployed?

If my assumptions are incorrect, then I suppose this is a moot point. Thanks in advance.

3
  • this is an exact duplicate of superuser.com/questions/57573/…
    – user22908
    Jul 15, 2012 at 19:59
  • 1
    @JarrodRoberson you mean this question? superuser.com/questions/39719/… Either way, the related questions all have inferior answers, so I wouldn't close them as dupes of those
    – Ivo Flipse
    Jul 15, 2012 at 20:10
  • @IvoFlipse the crux of the question I flagged as a duplicate states "...Will this effectively put the drive into a fully used state and how will this effect the wear leveling and performance of the drive?..." that is exactly this same question.
    – user22908
    Jul 15, 2012 at 20:16

4 Answers 4

52

Think of encryption as an adapter. The data is simply encoded before being written or decoded before being read. The only difference is that a key is passed at some point (usually when the drive/driver is initialized) to be used for the encryption/decryption.

Here is a (rough) graphic I threw together to show the basic pattern:

Schematic demonstrating full—drive-encryption

As you can see, there is no need to perform extra reads or writes because the encryption module encrypts the data before the data is written to the platters and decrypts it before it is sent to the process that performed the read.

The actual location of the encryption module can vary; it can be a software driver or it can be a hardware module in the system (e.g., controller, BIOS, TPM module), or even in the drive itself. In any case, the module is “in the middle of the wire” between the software that performs the file operations and the actual data on the drive’s platters.

20
  • 28
    This answer is logically incorrect! It depends on how many blocks OS encrypt at a time. Suppose it encrypts 4K at a time, then simply modifying a byte will cause writes to 8 512-byte-blocks to SSD, while without encryption, OS (if it optimizes well) only needs to write to 1 512-byte-block. So encryption adds to 8x disk writes. In practise, OS may choose an appropriate block size for encryption, but the answer doesn't address this problem and make any assertion for that. So in practise this answer may be correct but logically it is wrong, at least it is incomplete.
    – icando
    Jul 15, 2012 at 2:58
  • 22
    @icando, it’s a generic simplification. Besides, what you are talking about is a stream-cipher. The most common/popular full-disk-encryption program, TrueCrypt, uses block ciphers. If you can point out a full-disk-encryption system that is poorly designed and/or uses a stream-cipher that incurs that sort of impact, then please do so and I will happily expound the answer.
    – Synetech
    Jul 15, 2012 at 3:05
  • 1
    If the encryption module is in the drive itself, then you can be sure that it takes the nature of SSDs into account (otherwise the mfg is dumb and you want a refund). If the module is in the BIOS, then it can easily be updated to include a better algorithm if needed.
    – Synetech
    Jul 15, 2012 at 3:32
  • 1
    As for software, that is even easier to update. TrueCrypt for example has been updated analyzed in terms of SSD wear [1] [2] and the main problem isn’t the wear, but that it may vulnerable to attack.
    – Synetech
    Jul 15, 2012 at 3:33
  • 9
    The concern with full disk encryption is that DISCARD/TRIM is usually disabled for security reasons. All SSD drives have a logical 4kb block size, the actual underlying implementation below this layer is kept secret by most manufacturers, even with the newer drives that show as 8kb page sizes, they are still 4kb under the covers with firmware doing translations. None of this is a concern the firmware does the correct thing with concatenation of writes so the assertion that encryption adds anything much less 8X writes is ignorance of encryption and filesystem and firmware write strategies.
    – user22908
    Jul 15, 2012 at 6:27
25

Short answer:
If the disk controller does not use compression, then Synetech's answer is correct and encryption will not change anything. If the controller uses compression then encryption will probably reduce the lifespan of the disk (compared to an identical disk where encryption is not used).

Long answer:
Some SSD controllers use compression in order to minimize the amount of data written to the actual flash chips and in order to improve read performance (SandForce controllers are a prime example, there may be others). This will work best if the data written to the disk is easily compressible. Text files, executables, uncompressed images (BMP for example) and similar can usually be compressed quite a lot while files that are already compressed or are encrypted are almost impossible to compress since the data will look almost completely random to the compression algorithm in the controller.

Tom's Hardware made a nice test about precisely this on an Intel SSD 520 which can be found at
http://www.tomshardware.com/reviews/ssd-520-sandforce-review-benchmark,3124-11.html

What they basically do is measure the write amplification (the ratio of the amount of data written to flash and the amount of data sent to the drive) of the drive when writing completely compressible data and completely random data. For completely random data, the write amplification is 2.9* which means that for every GB of data sent to the disk, 2.9 GB are written to flash. The article notes that this seems to be roughly the same number measured on drives that do not use compression. For completely compressible data, the ratio is 0.17 which is quite a bit lower.

Normal usage will probably end up somewhere in between unless the data is encrypted. The lifetime predictions in the article are somewhat academic, but shows that encryption could definitely affect lifetime on an SSD with a SandForce controller. The only way to get around this would be if the controller itself can do the encryption after compression has occurred.

*The article does not specify why 2.9 is considered a normal value and I have not really researched it. A logical explanation could be that most SSDs use MLC NAND which is a bit error prone (bit flips in other parts of erase blocks can occur while writing if I recall correctly). In order to correct for this, data is probably written to several places so that recovery or correction is always possible.

10
  • encrypted data isn't bigger it is just encrypted, encryption doesn't cause the data to grow in size. who uses automatically compressing file systems in 2012?
    – user22908
    Jul 15, 2012 at 8:29
  • 7
    @JarrodRoberson: SandForce SSD controllers compress data to minimise writes. There may well be other examples too. Jul 15, 2012 at 12:30
  • @JohnBartholomew I said, filesystems, which come before disk controllers. And to your unrelated point, the SandForce compression scheme supposedly detects "uncompressable" or "precompressed" data and doesn't compress it in its attempts to miminize writes, this is a secret so we will never know for sure. Either way, it doesn't take up more space, just more time in that specific case.
    – user22908
    Jul 15, 2012 at 16:18
  • 1
    @JarrodRoberson: The point is that if the controller tries to compress everything then performance (in time and in space) will be worse if all the data you send to the disk is encrypted. It will be worse in time because the controller will waste time detecting that the data is uncompressible, and it will be worse in space compared to giving the disk unencrypted (and therefore, in some cases, compressible) data. Jul 15, 2012 at 16:22
  • 4
    @JarrodRoberson: Not getting the benefit of less writes sounds exactly like what the OP was asking about and is a direct consequence of encryption being used.
    – Leo
    Jul 16, 2012 at 13:46
7

Full disk encryption does not increase the amount of data written to a disk, aside from any metadata that the encryption layer needs to store along with the filesystem (which is negligible). If you encrypt 4096 bytes, 4096 bytes are written.

0
4

The answer depends on what you mean by "full disk encryption".

If you simply mean that all files and filesystem metadata are encrypted on the disk, then no, it should have no impact on SSD lifespan.

However, if you mean a more traditional "The entire contents of the disk, including unused space, is encrypted" then yes, it will reduce the lifespan, perhaps significantly.

SSD devices use "wear levelling" to spread the writes across the device so as to avoid wearing out a few sections prematurely. They can do this because modern filesystem drivers specifically tell the SSD when the data in a particular sector is no longer being used (has been "discard"ed), so then the SSD can set that sector back to zero and proceed to use whatever sector has the least amount of use for the next write.

With a traditional, full-disk encryption scheme, none of the sectors are unused. The ones that do not contain your data are still encrypted. That way an attacker doesn't know what part of your disk has your data, and what part is just random noise, thereby making decryption much more difficult.

To use such a system on an SSD, you have two options:

  1. Allow the filesystem to continue performing discards, at which point the sectors that don't have your data will be empty and an attacker will be able to focus his efforts on just your data.
  2. Forbid the filesystem to perform discards, in which case your encryption is still strong, but now it can't do significant wear levelling, and so the most-used sections of your disk will wear out, potentially significantly ahead of the rest of it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .