[Discuss] Full disk encryption

[blu at nedharvey.com (Edward Ned Harvey)]

> From: Chris O'Connell [mailto:omegahalo at gmail.com]
> 
> (snipped and moved top post to bottom)
> 
>> On Tue, Jan 3, 2012 at 12:07 PM, Edward Ned Harvey <blu at nedharvey.com>
>> wrote:
>> > 
>> > ALSO, NO FULL DISK ENCRYPTION should ever be used on an SSD drive.
>> >  Performance will drop by 30% and the drive's wear-leveling system and
>> > TRIM
>> > won't function correctly.
>>
>> First of all, the supposed 30% performance hit takes you down from 200%
to
>> 170% performance as compared to an HDD (or whatever arbitrary numbers
>> we
>> want to make up for comparing HDD vs SSD performance where SSD
>> performance >
>> HDD performance).
>> 
>> Second of all, some OSes support TRIM on encrypted drives.  They just
>> reduce
>> the size of disk they consume by some percentage, and TRIM the unused
>> blocks
>> as necessary, so there are always some blocks available for use that have
>> been TRIM'd.
>> 
>> Third of all, some SSD's support the virtual size reduction as above, but
do
>> it at the hardware level, so there are always TRIM'd blocks available.
>> 
>> In any of the above scenarios, the end result is no significant
performance
>> degradation on SSD's caused by TRIM vs Encryption.
>> 
> That has not been my experience at all.  I have personally encrypted two
> machines that had SSD drives, both had modern CPUS, one was an I3 and
> one an I7.  There was a substantially noticeable decrease in performance
> using TrueCrypt.  In fact, the wait times increased so much after
encrypting
> that I grew impatient waiting for boot times and Microsoft Office load
times.

Your first comment was about TRIM as it relates to SSD's.  TRIM is only
applicable for write performance.  Your read performance is the same
regardless of TRIM.

Your second comment is about booting windows (a bunch of read operations) on
SSD encrypted by truecrypt.  If this performs poorly, it's because of
truecrypt performing poorly, unrelated to SSD or TRIM.  I previously
commented, "There may be a performance hit in some situations, but not on
modern or decent computers with decent encryption."  I would have expected
truecrypt to perform well, and I am surprised that at least in your case,
truecrypt is not what I am calling "decent" encryption.  I don't know if
perhaps there's a configuration issue you're able to change and correct...
Upgrade to a later version of truecrypt, or change the encryption protocols
(AES vs Serpent vs Blowfish etc).  Perhaps there's a known issue where
truecrypt performs poorly on certain types of hardware - I don't know.  But
I do know that I deploy bitlocker on SSD's to users, and it works great.

You should expect it to work great, including truecrypt.  If your
performance is bad on truecrypt, I suggest tweaking it, I suggest trying
something else (like bitlocker, if it's acceptable to you) and I suggest
contacting the truecrypt guys for support.