Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot. Our Windows and Linux laptops are Dells, and they have some good BIOS integration with the Seagate drives (such as the ST9160314AS). That's working well. However, on the Mac, the BIOS support (well, EFI support) just isn't there.

A coworker tried WinMagic, which claims to support these drives, but have a slew of issues that killed the project at the time (lockups, slow OS, bad interaction with FileVault). I'd really like to get it working.

Is there anything that will work for me? FileVault is better than nothing, but it slows the machines down noticeably when doing heavy IO (which is common for our users, being Java developers). One of the available software FDE packages (such as PGPDisk) would probably work, but I doubt it would be much faster than FileVault.

Also, if someone with some rep could create some tags for me (fde, winmagic, filevault), that would be awesome.

share|improve this question
    
Hi @Bill, as you see the disk-encryption already exists. No need to create such specific product-tags, there's not enough questions on each of those to populate the tag... Besides, we usually deal here in principles, and the choice of winmagic (which you dont want anyway :) ) is mostly irrelevant to the principle of the question. –  AviD Jan 4 '11 at 11:29
    
Ah, I didn't even look for disk-encryption, I started with full. Thanks. –  Bill Weiss Jan 4 '11 at 16:27
add comment

3 Answers

up vote 3 down vote accepted

WinMagic is the only one I know that even claims to support hardware encryption, and they claim to be the only one to support Seagate Momentus drives. The Sophos/Utimaco and PGP products don't support hardware-encrypted drives, and TrueCrypt can't encrypt the boot volume.

By the way, I worked on implementing one of the FDE products listed above, and while I'm no longer associated with that company I would still advise that FDE is a better choice than FileVault. Without getting too nerdy on the details, FileVault has a kernel-userspace communication that acts as a measurable bottleneck and even causes deadlocks in some heavy-use situations. Also, it clearly doesn't protect data written outside the home folder, e.g. to the default temp location in /var/folders. Conversely, the FDE software encryption is typically all done block-at-a-time inside a kernel extension, and the vendors know that they'll get destroyed in reviews if it slows anything down :-)

As described in Apple's marketing blurb, there will be built-in full disk encryption in OS X version 10.7.

share|improve this answer
    
Don't worry, I'm on-board with the FDE. The performance of FileVault isn't anything to get excited about. –  Bill Weiss Jan 4 '11 at 16:25
add comment

PGP's WDE (Whole Disk Encryption) works pretty well. Its worth noting that you can use a drive encrypted with PGP WDE as a local Time Machine backup drive, allowing a fully encrypted continuous backup solution. Note - use a complex password to encrypt the drive, NOT a key.

share|improve this answer
add comment

FWIW PGPDisk works ok on Mac OSX in my experience, had it running on a MacBook Pro with Leopard without any major issues (although I wasn't doing much in the way of heavy development with it, so hard to guage the performance hit)

share|improve this answer
    
Good to know. I'd really like to see hardware encryption, but I'll look at PGPDisk if I resign myself to software :) –  Bill Weiss Jan 4 '11 at 16:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.