2

I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption.

My question is, is there any reason to do Both Hardware-based encryption and Software (DM-crypt/Luks), or would it better to do only one or the other? If there are concerns about hardware encryption, could using both compromise the software-based encryption in any way?

I understand there are concerns about hardware-based encryption having backdoors etc, but it also sounds like it is significantly faster. Using this setup, will there be a significant performance hit using just LUKS?

My primary concern is security; performance is secondary to that, but I don't want to go over-the-top if it will make no real difference.

Does the hardware-encryption support (in the SSD) at all speed up software encryption in linux?

Improve this question

1 Answer 1

Reset to default
4

Using only hardware encryption means you have to trust the SSD in addition to trusting the OS and CPU/RAM. With LUKS, you only need to trust the OS and CPU/RAM.

In practice, either one should do the job. But I'd trust LUKS slightly more because it's open source. Hardware encryption can be convenient though.

If you are really paranoid, you want to use both to hedge your bet such that flaws in either would not compromise your security. As far as I can tell, there's no reduction in security by using both at the same time, a they're independent from each other. It might complicate data recovery if you ever need to do it.

Does the hardware-encryption support (in the SSD) at all speed up software encryption in linux?

No.

Improve this answer
1
  • Definitely no reduction in doing the double encryption provided that the keys are both random and unrelated.
    – Neil Smithline
    Commented Dec 24, 2015 at 3:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .