Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm going to reinstall my system (Ubuntu) on a Samsung 840 pro SSD. This disk can do AES hardware encryption. I wonder what would be the drawbacks and/or advantages of taking this approach versus using LVM full disk encryption from different perspectives:

  • security: are these methods equivalent in term of security?
  • convinience: I'd like to avoid typing to many passwords
  • recovery/compatibility: what if I have to take the disk and mount it in another computer to recover my data ?
share|improve this question
add comment

2 Answers

up vote 2 down vote accepted
  • security: The drive offers AES. dm-crypt offers your own choice, if you're not satisfied with AES. Both can be erased very quickly by erasing the key.
  • convenience: both methods will prompt for a password once, at startup; although you could store the LUKS keyfile on an external device, e.g. a USB memory stick
    • with dm-crypt, you have the flexibility to only encrypt parts of your system, e.g. only the /home directory (when put on a separate partition)
  • recovery: if you forget the drive password, you're busted. For LUKS, you could (depending on the level paranoia you want to accept) have multiple copies of your key. Printed on a sheet of paper, if you want to. Or hidden inside a book. Or ...
    • Both are not dependent on the surrounding hardware, so your disk can be recovered even if the original laptop/PC dies.
  • performance: the device built-in encryption should be mostly transparent, so I assume almost no overhead. With dm-crypt, your CPU does the en-/decryption.
    • Also: In linux 3.1 and up, support for dm-crypt TRIM pass-through can be toggled upon device creation or mount with dmsetup. So you need to take some steps, but TRIM is supported.

To summarize: the built-in encryption is the fast (runtime and setup) and convenient option with no frills. dm-crypt/LuKS offer many more options and features, but is more time-consuming to set up and reduces performance somewhat.

share|improve this answer
add comment

Use the built-in AES.
Why?

  • It's powerful enough.
  • It supports TRIM and it's supported by the manufacturer.
  • You don't have to use a strong password as your Linux login pass.
  • As far as I know, you can use it in an other system.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.