Is LUKS far more secure on a HDD than on a SSD with Trim?

linustalman · 06-23-2017, 12:00 PM

Hi.

Is LUKS far more secure on a HDD than on a SSD with trim? How big is the security hit if any?

Thanks.

rknichols · 06-23-2017, 12:58 PM

It's slightly more secure on the HDD. When you trim the SSD, you reveal what blocks on the drive are not in use. It's a fairly coarse granularity, since those are the "erase blocks" (perhaps 256KB or larger) and not the 4KB filesystem blocks, but if you erased, for example, 200GB of illegal movie downloads, it would be apparent that ~200GB of space had become free. For those so concerned, there is also the issue of the unencrypted low-bandwidth side channel provided by manipulating the amount of free space.

jefro · 06-23-2017, 08:12 PM

I'd think either way would take some time to break into with less than professional industrial or government support. It is possible that one could access the actual chips on a ssd and gather more information that may be there. The average Joe won't get past either easily.

You'd have to suspect that many of the top 500 supercomputers have some workload devoted to ......

linustalman · 06-24-2017, 02:55 PM

On a scale of 1 to 10 (10 being unbreakable), how would 'LUKS on SSD + trim' compare in rating to 'Luks on HDD'? A rough estimate?