On a mailing list some questions were asked about disk encryption, I decided to blog the answer for the benefit of others:
What type of encryption would be the strongest? the uncrackable if you will? im not interested in DES as this is a US govt recommendation – IDEA seems good but what kernel module implements this?
The US government (which incidentally employs some of the best cryptologists in the world) recommends encryption methods for data that is important to US interests (US military and banking operations for starters). Why wouldn’t you want to follow those recommendations? Do you think that they are putting back-doors in their own systems?
If they were putting in back-doors do you think that they would use them (and potentially reveal their methods) for something as unimportant as your data?
I think that if the US military wanted to apply a serious effort to breaking the encryption on your data then you would have an assortment of other things to worry about, most of which would be more important to you than the integrity of your data.
I’ve read some good things about keeping a usb key for system boot so that anything on the computer itself is unreadable without the key – but thats simply just a physical object – I’d like both the system to ask for the passphrase for the key as well as needing the usb key
I believe that can be done with LUKS, however it seemed broken last time I experimented with it so I’ve stuck with the older operation of cryptsetup.
What kind of overheads does something like this entangle? – will my system crawl because of the constant IO load of the disk?
My laptop has a Pentium-M 1.7GHz and a typical laptop drive. The ratio of CPU power to hard drive speed is reasonable. For most operations I don’t notice the overhead of encryption, the only problem is when performing CPU intensive IO operations (such as bzip compression of large files). When an application and the kernel both want to use a lot of CPU time then things can get slow.
More recent machines have a much higher ratio of CPU power to disk IO as CPU technology has been advancing much faster than disk technology. A high-end desktop system might have 2-3x the IO capacity
of my machine, but a single core would have 2-3x the computer power of the CPU in my laptop and for any system you might desire nowadays 2 cores is the minimum. Single-core machines are still on sale and still work well for many people – I am still deploying Pentium-3 machines in new installations, but for machines that make people drool it’s all dual-core in laptops and one or two dual-core CPUs in desktop systems (with quad core CPUs on sale soon).
If you want to encrypt data on a P3 system with a RAID array (EG a P3 server) then you should expect some performance loss. But for a typical modern desktop system you shouldn’t expect to notice any overhead.