LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices



Reply
 
Search this Thread
Old 11-20-2012, 11:15 PM   #1
TracyTiger
Member
 
Registered: Apr 2011
Location: California, USA
Distribution: Slackware
Posts: 304

Rep: Reputation: 77
Faster Disk Preparation for Encryption


I'm looking for a faster way to prepare hard disk drives for encryption (dm-crypt, LUKS) writing random numbers to the entire disk. I'd like to know how other slackers handle this and solicit suggestions.

I have been using the old, usually good enough, standby ...
Code:
dd if=/dev/urandom of=/dev/sdx bs=xxxx
This worked fine for a single 120GB drive. I just let it run overnight and built the machine the next day.

But /dev/random and /dev/urandom aren't good sources for generating large numbers of bits. When I install five 2TB drives in a system this takes a loooong time. I have to start preparing the disks more than a week before I can build the system.

Is there any way to speed this up when booting then installing a system from a Slack CD/DVD?

--------------

These are the options I can think of in order of preference.

1. Boot an empty system from a Slack CD/DVD and use the resources available to prepare the disks for RAID & encryption Just like I do now but only faster.

2. Boot a standalone utility/OS from CD to write non-repeating random number sequences to the disk (quickly). Perhaps on option in a disk erase utility?

3. Boot from a Slack CD/DVD as #1 above but then mount a CD or USB flash drive with an utility to to the job (quickly write random numbers to hard disks) and works in the environment currently running.

4. Install Slack from CD/DVD then install the libraries/utilities/hardware needed to prepare the disks (e.g. gpg, openssl, haveged, rng-tools, hardware entropy generators, etc). Then re-install the final version of Slack on the now prepared hard disks.

5. First attach each disk to a separate "disk preparation" computer already built and configured for this job. Then transport the disks and install on the new machine.

6. Ignore disk preparation and hope the perpetrator isn't sophisticated enough to take advantage of knowing which sectors of the disk are written and which ones aren't.

---------

I'm guessing that option # 1 doesn't offer the resources to speed things up (increase entropy). Please speak up if I'm wrong on this, as this is my preference.

Perhaps there is a standalone utility (option # 2) out there that I can use. The random number sequence run length should be large before repeating (>2TB) or else the utility should re-seed the generator before the sequence repeats. (even though /dev/urandom with a depleted entropy pool may produce repeating sequences now)

Does anyone know of a standalone utility that boots from CD and properly prepares the disks for encryption? (I know ... not really a Slackware question)

I'm normally not in a hurry when I work with computers, but working with large capacity disk drives now encourages me to look for faster methods of disk preparation.

Thanks.
 
Old 11-21-2012, 12:40 AM   #2
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 1,619

Rep: Reputation: 676Reputation: 676Reputation: 676Reputation: 676Reputation: 676Reputation: 676
The way I do it is to fill the device with zeros that have been encrypted with a random key. For a decent encryption algorithm, the result will be indistinguishable from random numbers.
Code:
cryptsetup --key-file=/dev/urandom create tmpjunk /dev/sdb1
dd if=/dev/zero of=/dev/mapper/tmpjunk bs=4k
cryptsetup remove tmpjunk

Last edited by rknichols; 11-21-2012 at 11:15 PM. Reason: Fix bad cryptsetup args
 
1 members found this post helpful.
Old 11-21-2012, 03:26 AM   #3
TracyTiger
Member
 
Registered: Apr 2011
Location: California, USA
Distribution: Slackware
Posts: 304

Original Poster
Rep: Reputation: 77
Interesting approach and it works with just booting the Slack install disk.

What kind of speed do you see with this method. Is it about the same as writing /dev/zero to /dev/sdx?

Since all the data is identical (all zeros) do you know if there is a problem with the numbers produced having repeating sequences when filling up large disk drives?
 
Old 11-21-2012, 12:11 PM   #4
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
You can use 'wipe' to wipe the disk faster than /dev/urandom. It uses the MT algorithm with a very large period and is seeded before it ever reaches it. There is also an SIMD based MT implementation:
http://www.math.sci.hiroshima-u.ac.j...FMT/index.html
You would have to write your own seeding program, which I did, and it is faster than 'wipe', but probably won't make a difference for a HDD.
http://www.linuxquestions.org/questi...-c-4175434150/
I used it for different purposes.
 
1 members found this post helpful.
Old 11-21-2012, 01:29 PM   #5
TracyTiger
Member
 
Registered: Apr 2011
Location: California, USA
Distribution: Slackware
Posts: 304

Original Poster
Rep: Reputation: 77
Thanks for the suggestions/links.

The SFMT program has a very large period and doesn't appear to need re-seeding before filling up many disks.
 
Old 11-21-2012, 02:01 PM   #6
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 1,619

Rep: Reputation: 676Reputation: 676Reputation: 676Reputation: 676Reputation: 676Reputation: 676
Quote:
Originally Posted by Tracy Tiger View Post
What kind of speed do you see with this method. Is it about the same as writing /dev/zero to /dev/sdx?

Since all the data is identical (all zeros) do you know if there is a problem with the numbers produced having repeating sequences when filling up large disk drives?
With a less than top-of-the-line processor (AMD E-350 dual-core 1.6GHz) I get about 40 MB/s writing to an SSD. That's over 10X the speed I get writing from /dev/urandom to the same device.

Any reasonably recent cryptsetup should not default to a cipher whose initialization vector would repeat while filling a large drive. Personally, I've never needed more than the 2TB that the "plain" IVs can cover.
 
Old 11-21-2012, 02:26 PM   #7
TracyTiger
Member
 
Registered: Apr 2011
Location: California, USA
Distribution: Slackware
Posts: 304

Original Poster
Rep: Reputation: 77
Quote:
Originally Posted by rknichols View Post
That's over 10X the speed I get writing from /dev/urandom to the same device.
A 10 times increase would bring my current large-disk scenarios down to less than a day for disk preparation. A tremendous improvement. Although I usually use magnetic drives and only use SSDs occasionally and with smaller capacities.

The best I can hope for is a number generator that runs fast enough so that the disk drives are the bottleneck.
 
Old 11-21-2012, 11:19 PM   #8
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 1,619

Rep: Reputation: 676Reputation: 676Reputation: 676Reputation: 676Reputation: 676Reputation: 676
Note that I've gone back and fixed those bad cryptsetup args in #2.
 
Old 11-22-2012, 04:05 AM   #9
jjthomas
Member
 
Registered: Jan 2004
Location: Tacoma, WA
Distribution: Slackware 14
Posts: 246
Blog Entries: 2

Rep: Reputation: 28
In the old days... I would encrypt my drive and then append a text file to itself until the drive ran out of space. Not as fancy as some of the MIT or NSA utilities, but I figured after someone found the 1000th text listing of "Hi my name is JJ" they would give up.

-JJ
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
disk full, encryption dawee Ubuntu 2 07-03-2012 03:46 AM
[SOLVED] linux mint 8 install step 4 "disk preparation" results in empty list michielv Linux Mint 4 05-17-2010 04:05 PM
dd and disk encryption Feeg Linux - Security 6 12-13-2008 06:55 PM
NAS + disk encryption Chris594 Linux - Networking 4 07-11-2006 01:31 PM
disk encryption ankscorek Linux - Security 5 05-03-2006 01:59 PM


All times are GMT -5. The time now is 10:22 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration