Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm going to reinstall my system (Ubuntu) on a Samsung 840 pro SSD. This disk can do AES hardware encryption. I wonder what would be the drawbacks and/or advantages of taking this approach versus using LVM full disk encryption from different perspectives:

  • security: are these methods equivalent in term of security?
  • convinience: I'd like to avoid typing to many passwords
  • recovery/compatibility: what if I have to take the disk and mount it in another computer to recover my data ?
share|improve this question
An added comment regarding security: using built-in AES also requires you trust your hardware manufacturer... (well, simply using their disk probably implies you have to trust them) – alci Sep 14 '15 at 8:36
up vote 2 down vote accepted
  • security: The drive offers AES. dm-crypt offers your own choice, if you're not satisfied with AES. Both can be erased very quickly by erasing the key.
  • convenience: both methods will prompt for a password once, at startup; although you could store the LUKS keyfile on an external device, e.g. a USB memory stick
    • with dm-crypt, you have the flexibility to only encrypt parts of your system, e.g. only the /home directory (when put on a separate partition)
  • recovery: if you forget the drive password, you're busted. For LUKS, you could (depending on the level paranoia you want to accept) have multiple copies of your key. Printed on a sheet of paper, if you want to. Or hidden inside a book. Or ...
    • Both are not dependent on the surrounding hardware, so your disk can be recovered even if the original laptop/PC dies.
  • performance: the device built-in encryption should be mostly transparent, so I assume almost no overhead. With dm-crypt, your CPU does the en-/decryption.
    • Also: In linux 3.1 and up, support for dm-crypt TRIM pass-through can be toggled upon device creation or mount with dmsetup. So you need to take some steps, but TRIM is supported.

To summarize: the built-in encryption is the fast (runtime and setup) and convenient option with no frills. dm-crypt/LuKS offer many more options and features, but is more time-consuming to set up and reduces performance somewhat.

share|improve this answer
Regarding recovery, notice that built-in AES is dependant on the way the BIOS passes the password to the disk. For example, see – alci May 11 '15 at 16:09

Use the built-in AES.

  • It's powerful enough.
  • It supports TRIM and it's supported by the manufacturer.
  • You don't have to use a strong password as your Linux login pass.
  • As far as I know, you can use it in an other system.
share|improve this answer

built in: + much faster + easier to set up - you have no idea about the implementation, might be superb, might be crap

dm-crypt: + slower - you can check the implementation yourself (theoretically anyway)

recovery - with dm crypt what ypu said works, with the build in it's unknown, theoretically if the bios passes the ata password unchanged it should work fine, otherwise...

share|improve this answer
Regarding recovery, I've found that my Bios does not leave ata password unchanged (Lenovo Thinkpad bios). Seems to be working like this but as hdparm --security-set-pass cannot cope with binary password, I couldn't test... – alci Oct 29 '14 at 13:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.