Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm moving over to Linux when the new SSD arrives. SSD gives increased performance, so I thought that I could encrypt everything.

But then I came to think about TRIM, and garbage collection on the drive. Will a LUKS encrypted drive affect the garbage collection system? (TRIM).

share|improve this question

5 Answers 5

From man 5 crypttab:

Options

discard

Allow using of discards (TRIM) requests for device.

WARNING: Assess the specific security risks carefully before enabling this option. For example, allowing discards on encrypted devices may lead to the leak of information about the ciphertext device (filesystem type, used space etc.) if the discarded blocks can be located easily on the device later.

Kernel version 3.1 or more recent is required. For older versions is the option ignored.

share|improve this answer

Most of the tutorials I've read about setting up LUKS drives ask you to badblocks the entire drive with random data first. This way an attacker cannot know which sectors contain data and which ones haven't been used yet. This information could be used to discover things about the data and correlate with other time-based information which could lead to a compromise.

So, even if the LUKS modules supported sending groups of unused blocks to TRIM, you wouldn't want to do it anyway.

share|improve this answer
up vote 6 down vote accepted

I emailed them. And TRIM will not work. Because the OS doesn't know where files are stored. Only the encrypted system knows it. Due to the fact that the encryption comes first. I'll use truecrypt instead. On top of the file system for my home folder.

share|improve this answer
    
Just for reference: Could you tell us who is "them"? The ubuntu developers? –  c089 Feb 26 '11 at 9:53
    
I guess he means the LUKS developers. Ubuntu uses ecryptfs, afaik. –  Manuel Faux Apr 26 '11 at 17:59

No. An empty block will still be listed as empty and thus be TRIMed.

Even if your drive is encrypted, the drive itself knows nothing of the encryption, just where which data is (and which space isn't used at the moment). So it'll be fine.

As for the performance, I don't know how the impact might be. It would seem that certain optimizations in the SSD might not work, but I cannot figure which ones require knowledge about the actual data so there will probably be no impact from a storage point of view.
Note that encryption requires extra CPU cycles, so the impact might be noticeable there.

share|improve this answer
    
+1 for the comment about blocks. The reason this works is that LUKS encrypts each block individually. As to CPU load: according to benchmarks, a P3@1GHz can encrypt AES at about 13MB/s, so unless your HD can sustain that rate, you should not notice a performance decline (unless your CPU is already fully loaded doing something different). –  sleske Mar 26 '10 at 9:37
    
Funny you should mention write speed. As the question is about SSDs there's a chance the drive itself is faster than the connection to its controller. And we have come quite a long way since the P3 1GHz days, so that figure is in no way representative for modern PCs, I'm afraid. –  Zsub Mar 26 '10 at 9:45
    
My is running Core Duo 1.3Ghz. 4GB ddr3 ram. I don't it should be to much of a strain on the cpu, I'll choose an ok encrypten. Not the best. After all, it's just so the thief won't get access to my files. Not to keep NSA out. :p –  Algific Mar 26 '10 at 10:14
1  
Note are you sure about this? Because as I understood it TRIM needs the kernel to talk to ext4. And since ext4 is on top of the encrypted drive one could think that trim would get the info it needs. ? –  Algific Mar 26 '10 at 10:16
1  
No. TRIM is functionality independent of the OS or filesystem on a drive. The OS needs to support it to send the appropriate commands to the drive, but the filesystem doesn't need to know about it. –  Zsub Mar 26 '10 at 11:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.