I can't see what the advantages might be, but I think this would slow data transfer down while providing no extra protection.
Am I right or am I overlooking something?
-
1Slow data transfer will not be a concern. Comparing systems with LUKS and without it, the performance penalty is too small to be detected.– ThoriumBRCommented Jul 17, 2015 at 16:41
Add a comment
|
3 Answers
Do you trust the hardware encryption on the SSD? If you do then it's fine. If you don't trust it then you're better off with LUKS since not many vendors provide sources for the firmware, so you won't be able to audit it.
There's a lot more flexibility with dm-crypt than basic hardware encryption.
With dm-crypt LUKS (or plain), you can use keyfiles instead of passphrases. If you set it up correctly, you can have a USB drive that contains your boot partition and the keyfile to unlock the root partition.
After boot, you can remove the USB drive to keep it safe or leave it in if you need the system to be able to reboot by itself after a power loss (for a personal file-server, for instance).
If you only use hardware encryption, you will probably have no way of automatically recovering after a power outage. If you do, then your encryption isn't very resistant to attack.
With LUKS (but not plain mode), you can change the passphrase or keyfile you use to unlock the drive. You should probably read
man cryptsetup for the details. LUKS is powerful.
One SSD can get read speeds of near 500MiB/s, while using LUKS it can go down to less than 15MiB/s.
Laptop with slow CPU and no hardware encryption anywhere.
Do benchmarks on LUKS with cascace (Serpenter + Twofish for example).
In my case 2xSSD Samsung 740 EVO (one on normal 2.5 slot, the other on a caddy where dvd was) gives 9943MiB/s in Linux software RAID 0, while if i put on top of that LUKS cascade it only gives 13.8MiB/S.
A huge loose when using LUKS, caused by slow processor and very fast SSD.
Not to mention what would happen when using 5GiB/S NV.E cards!
