4

I've been looking at this topic for a long time, and am still paranoid about this.

I have an 1 TB SSD with Ubuntu 16.04 on it. From what I have read, using disk encryption is bad for an SSD due to wear and tear etc.

What about encryption of any kind especially password managers?

I am currently using Enpass but that is encryption and it is stored locally on my hard drive.

Is this bad, should I get rid of the password manager? Or am I OK?

7

TL;DR:

  • Full-disk encryption: do not blindly trust what is repeated on the Internet. While there is some technical truth behind these claims they may be incomplete or not match current technologies. Using FDE on SSD disks should be fine.
  • Password managers: there is no technical reason why a password manager would particularly increase SSD wear and tear, so you are guaranteed to be fine here.

The concern with full disk encryption (FDE) does not come from the fact that the data is encrypted.

With unencrypted file systems, the file system layer will inform the underlying SSD firmware when a block becomes free (using the TRIM ATA command). This will make the SSD firmware free to reset and reuse the corresponding storage cells as will, notably to do dynamic wear leveling, ie. spreading write operation onto free cells to gain some lifetime for the SSD.

Secure FDE file systems will not inform anymore the SSD firmware about free blocks. The result is that from the SSD firmware point-of-view the disk will soon appear as filled-up (as it will do from an attacker point-of-view: the disk content will appears as a huge BLOB of seemingly random data).

Due to the low amount of free storage cells (SSD always come with some spare cells so they are never really completely filled-up, unless when they reach their end-of-life), dynamic wear leveling will not be efficient anymore: write operation of frequently modified files would affect always the same storage cells, decreasing their lifespan and therefore shortening the SSD lifespan.

This is what is covered when one talks about the impact of FDE on SSD wear and leveling, and leads to recommendation such as allowing TRIM even when using FDE even if this lower FDE security.

However, decent SSD (if not all?) also provide static wear leveling, which allows to regularly exchange the storage cells occupied by frequently modified data with the occupied by rarely modified data, thus allowing effective wear leveling even on full and/or fully encrypted SSDs.

Therefore, thanks to this static wear leveling, most chances are that using secure FDE does not have any significant impact on SSD lifespan.

And as per your password manager file, this is a non-issue: a password manager file is a standard file, as would be a word document or anything else. It is handled way above the file system layer, far-away from these TRIM-related considerations, and has strictly no specific impact on the SSD wear and tear, so you are perfectly OK.

  • Note that FDE can indeed pass through TRIM commands to hardware. (They accept a slightly relaxed set of security guarantees to do so, but it's usually not a big deal.) Microsoft's BitLocker does this, for example. For example, you can use BitLocker on a sparsely-allocated VHD file. The NTFS driver will turn deletes into TRIMs, the BitLocker driver will pass through the TRIMs, and the VHD driver will convert the TRIMs into reclaimed sparse space. – Reid Rankin Sep 3 '16 at 13:13
  • @MrNerdHair: This is what I was thinking when mentioning "allowing TRIM even when using FDE even if this lower FDE security". AFAIK, this reveals the kind of file system used and possibly some information about its structure, I'm not aware of any further leak (yet...). As you said, this may not a big deal (for now at least), but if this can be avoided with apparently no side effect, why not benefit from the added security of a fully opaque FDE? – WhiteWinterWolf Sep 3 '16 at 13:20
  • The important leak is how much data has been stored. It could prove, for example, that a locked drive you claimed was empty, or only contained a few documents, contained a whole bunch of stuff. – Reid Rankin Sep 3 '16 at 13:24
  • @MrNerdHair: That's right, and depending the file system and encryption used one may be able to tell if you are storing a few large files or a large number of small files as this will result in different allocation scheme by the file system. – WhiteWinterWolf Sep 3 '16 at 13:40
  • Btw, it there a way I can find out if my SSD does the following above? – Thomas Byerly Sep 4 '16 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.