9

I'm moving over to Linux when the new SSD arrives. SSD gives increased performance, so I thought that I could encrypt everything.

But then I came to think about TRIM, and garbage collection on the drive. Will a LUKS encrypted drive affect the garbage collection system? (TRIM).

Improve this question

5 Answers 5

Reset to default
5

I emailed them. And TRIM will not work. Because the OS doesn't know where files are stored. Only the encrypted system knows it. Due to the fact that the encryption comes first. I'll use truecrypt instead. On top of the file system for my home folder.

Improve this answer
3
  • Just for reference: Could you tell us who is "them"? The ubuntu developers?
    – c089
    Feb 26, 2011 at 9:53
  • I guess he means the LUKS developers. Ubuntu uses ecryptfs, afaik.
    – Manuel Faux
    Apr 26, 2011 at 17:59
  • How does this relate to other answers here? I guess that this one is outdated now.
    – d33tah
    May 2, 2016 at 14:29
2

No. An empty block will still be listed as empty and thus be TRIMed.

Even if your drive is encrypted, the drive itself knows nothing of the encryption, just where which data is (and which space isn't used at the moment). So it'll be fine.

As for the performance, I don't know how the impact might be. It would seem that certain optimizations in the SSD might not work, but I cannot figure which ones require knowledge about the actual data so there will probably be no impact from a storage point of view.
Note that encryption requires extra CPU cycles, so the impact might be noticeable there.

Improve this answer
8
  • +1 for the comment about blocks. The reason this works is that LUKS encrypts each block individually. As to CPU load: according to benchmarks, a P3@1GHz can encrypt AES at about 13MB/s, so unless your HD can sustain that rate, you should not notice a performance decline (unless your CPU is already fully loaded doing something different).
    – sleske
    Mar 26, 2010 at 9:37
  • Funny you should mention write speed. As the question is about SSDs there's a chance the drive itself is faster than the connection to its controller. And we have come quite a long way since the P3 1GHz days, so that figure is in no way representative for modern PCs, I'm afraid.
    – Zsub
    Mar 26, 2010 at 9:45
  • My is running Core Duo 1.3Ghz. 4GB ddr3 ram. I don't it should be to much of a strain on the cpu, I'll choose an ok encrypten. Not the best. After all, it's just so the thief won't get access to my files. Not to keep NSA out. :p
    – Algific
    Mar 26, 2010 at 10:14
  • 1
    Note are you sure about this? Because as I understood it TRIM needs the kernel to talk to ext4. And since ext4 is on top of the encrypted drive one could think that trim would get the info it needs. ?
    – Algific
    Mar 26, 2010 at 10:16
  • 1
    No. TRIM is functionality independent of the OS or filesystem on a drive. The OS needs to support it to send the appropriate commands to the drive, but the filesystem doesn't need to know about it.
    – Zsub
    Mar 26, 2010 at 11:02
2

From man 5 crypttab:

Options

discard

Allow using of discards (TRIM) requests for device.

WARNING: Assess the specific security risks carefully before enabling this option. For example, allowing discards on encrypted devices may lead to the leak of information about the ciphertext device (filesystem type, used space etc.) if the discarded blocks can be located easily on the device later.

Kernel version 3.1 or more recent is required. For older versions is the option ignored.

Improve this answer
1

Most of the tutorials I've read about setting up LUKS drives ask you to badblocks the entire drive with random data first. This way an attacker cannot know which sectors contain data and which ones haven't been used yet. This information could be used to discover things about the data and correlate with other time-based information which could lead to a compromise.

So, even if the LUKS modules supported sending groups of unused blocks to TRIM, you wouldn't want to do it anyway.

Improve this answer
1

Yes for the latest Fedora 17 with test updates

http://vpv.kapsi.fi/blog/2012/07/ssd-trimdiscard-on-fedora-17-with-encypted-partitions/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .