I've got a laptop, and bought an intel ssd for it. On a mobile device encryption is a must. But what is the best option? Because when i use luks cryptsetup, trim of my ssd is no longer working which causes serious performance degradation.

I don't care much for alignment of the drive, but trim should work. I googled my ass of, and all i found that luks is not working well with trim support of the ssd's.

Is there another option to use full encryption of at least my home partition? Or should i just place back the original drive, and use the ssd for my desktop?

Well, there is not really a support for TRIM yet, but you could try this patch

Be sure to backup you data before!

I read about it in the dm-crypt-newsgroup:

http://thread.gmane.org/gmane.linux.....dm-crypt/4075


I have no expierience with it btw...

Using trim would provide an attacker with information on which parts of the filesystem contain data and which are empty. I'm not a crypto expert, so I don't know how harmful this would be.

However, have you tried the `discard' option with ext4? I think if it doesn't work, it is due to device-mapper not supporting trim (in April, 2010 anyway). This may change in the future or might be different now.

Part of a performance hit may be due to the drive being prefilled with pseudo random data when creating the encrypted device, so until a delete, there are no discarded areas. The SSD drive doesn't have information on invalid regions of the filesystem. The purpose of trim is to tell it this after a delete.

As an experiment (if the discard option works) you could try filling much of the free space with a file (using dd) and then delete it.

Thanks for the replies.

to jschiwal: discard is not working, unfortunately.
to gorillus: i'm not really willing to use experimental patches, because everything with datastorage should be tested and stable, and this is not a testing environment. But really thanks for the reference.

Unfortunately we live in the present, as we always will. And in the present luks is a bitch, but i'll have to use it. I'll just accept the low performance in favor of security.

Have you had a look at using either EncFS or ecryptfs? They're not quite the same thing as a block level encryption, but they might meet your needs.

2 members found this post helpful.

I was thinking the same, I wanted to mention it...
A lot of tips to speed up your ssd you can find in the Arch-Wiki by the way...

No, not yet, but looking at EncFS website, it seems perfect for me. So thanks! I only need to use very simple encryption of my home dir. Simply to defend my data in case of a theft of the laptop, not to defend against some secret agency or so.

I'll try to implement it and let you know the results.