Questions about LUKS / LVM
Hello everyone
I'm contemplating setting up my new laptop to make use of LUKS + LVM when I install Arch Linux on it, but I've got a few questions.
How much of a load on the system would LUKS + LVM be? Is it likely to result in a noticeable drop in performance? Does entering the key(s) at boot decrypt the whole volume, or just provide a means for the kernel module to decrypt and encrypt on-the-fly?
And… how does it work? The documentation makes mention of multiple key-slots; but I'm a little baffled as to how different keys can be used to decrypt the same volume. It is based on symmetric cryptography, isn't it?
I'd just like to get as much information as possible before I set this up, as I'm still not entirely sure if full-disk encryption is worth the effort for a personal laptop.
Cheers if you can advise
Robbie
Quoted 3 lines · Robbie Smith
How much of a load on the system would LUKS + LVM be? Is it likely to
result in a noticeable drop in performance?
It all depends, but generally no because cpu is _so_ much faster than disk these days.
Quoted 4 lines
Does entering the key(s)
at
boot decrypt the whole volume, or just provide a means for the kernel module to decrypt and encrypt on-the-fly?
The latter.
Quoted 7 lines
And… how does it work? The documentation makes mention of multiple key-slots; but I'm a little baffled as to how different keys can be used
to decrypt the same volume. It is based on symmetric cryptography, isn't
it?
Yes, but the master key is encrypted by each key, separately, and that's what your multiple passwords decrypt.
See the tks-1 paper (iirc) referenced on the wiki for more info.
Karl <[email protected]>
Free Software: "You don't pay back, you pay forward."
-- Robert A. Heinlein
Quoted 7 lines · Karl O. Pinc
Quoted 2 lines · Robbie Smith
How much of a load on the system would LUKS + LVM be? Is it likely to result in a noticeable drop in performance?
It all depends, but generally no because cpu is _so_ much faster than disk these days.
Indeed, you won't notice it on a modern computer, especially for every day use. It may be painful for data transfer from one encrypted disk to another encrypted disk, but you can expect very good rates anyway. It depends on the cipher you use, on your machine, ...
Quoted 11 lines
Quoted 3 lines
Does entering the key(s) at boot decrypt the whole volume, or just provide a means for the kernel module
to decrypt and encrypt on-the-fly?The latter.
Quoted 4 lines
And… how does it work? The documentation makes mention of multiple key-slots; but I'm a little baffled as to how different keys can be used to decrypt the same volume. It is based on symmetric cryptography isn't it?
Quoted 4 lines
Yes, but the master key is encrypted by each key, separately, and that's what your multiple passwords decrypt.
See the tks-1 paper (iirc) referenced on the wiki for more info.
This is important as it means your disk encryption is basically as strong as your "weaker key slot". e.g. a very bad password for one key slot make all other passwords/keys inefficient.
Thanks, Karl, for the link.
Best,
Quentin
Quoted 9 lines · Quentin Lefebvre
Quoted 2 lines
It all depends, but generally no because cpu is _so_ much faster than disk these days.
Indeed, you won't notice it on a modern computer, especially for every day use. It may be painful for data transfer from one encrypted disk to
another encrypted disk, but you can expect very good rates anyway. It depends on the cipher you use, on your machine, ...
Using a modern intel cpu with aesni helps a lot too.
Regards,
Signature · 1 line
Yves-Alexis