Which is the best SSD for cryptsetup benchmark?
I’m looking for recommended options for cryptsetup to create fully encrypted SSD ( SanDisk SSD U100 128GB ), which achive: # cryptsetup benchmark # Tests are approximate using memory only (no storage IO).
Do you need 256 bit AES key for LUKS?
There is no rational need for going to 256-bit keys — i.e. 512-bit in the context of ” aes-xts “. 256-bit keys for AES imply some CPU overhead, which the benchmarks duly observe (300 MB/s vs 375 MB/s). With a SSD under the hood, you really want a fast encryption system, so do that.
Do you need CBC or AES for LUKS?
With a SSD under the hood, you really want a fast encryption system, so do that. Any combination of the above operation modes will provide you with ample security against most threats. That said, CBC is no longer recommended due to certain information leakage attacks.
Which is better FPGA or GPU for LUKS?
Attackers will want to use some GPU and/or FPGA to speed up their attack, while you use a normal PC. Nowadays, normal PC are at ease with 64-bit arithmetic operations, and run SHA-512 about as fast as SHA-256; however, GPU much prefer 32-bit operations, and mapping them on FPGA is also easier than 64-bit operations.
What are the most common questions about cryptsetup?
General Questions 1.1 What is this? This is the FAQ (Frequently Asked Questions) for cryptsetup. It covers Linux disk encryption with plain dm-crypt (one passphrase, no management, no metadata on disk) and LUKS (multiple user keys with one master key, anti-forensic features, metadata block at start of device.).
Why does cryptsetup treat the NUM-pad differently?
KEYBOARD NUM-PAD: Apparently some pre-boot authentication environments (these are done by the distro, not by cryptsetup, so complain there) treat digits entered on the num-pad and ones entered regularly different. This may be because the BIOS USB keyboard driver is used and that one may have bugs on some computers.
Is there a warning when feeding cryptsetup from stdin?
NO WARNING ON NON-INTERACTIVE FORMAT: If you feed cryptsetup from STDIN (e.g. via GnuPG) on LUKS format, it does not give you the warning that you are about to format (and e.g. will lose any pre-existing LUKS container on the target), as it assumes it is used from a script.