Truecypt on SSD RAID 0?

ithenoob

Junior Member
Apr 22, 2013
11
0
0
I have done much research on truecrypt on SSDs.

Just a few questions for clarifying:

Fresh SDDs -> install win7 -> truecrypt fully encrypt booting partition, then encrypt some other partitions on same SSDs. All encrypting is done prior writing of data. I do not intend to ever change passwords.

>Isn't the data written to any logically encrypted partition always fully encrypted, even if the system hibernates? Any chance of security leak?
>Would the levels of wear differ at all during use after encryption?
>Comments on full disk encryption?

On a RAID 0 system of two SSD, integrated RAID controller on motherboard with motherboard integrated TRIM.
 

Bubbaleone

Golden Member
Nov 20, 2011
1,803
4
76
I have done much research on truecrypt on SSDs.

Just a few questions for clarifying:

Fresh SDDs -> install win7 -> truecrypt fully encrypt booting partition, then encrypt some other partitions on same SSDs. All encrypting is done prior writing of data. I do not intend to ever change passwords.

>Isn't the data written to any logically encrypted partition always fully encrypted, even if the system hibernates? Any chance of security leak?
>Would the levels of wear differ at all during use after encryption?
>Comments on full disk encryption?

On a RAID 0 system of two SSD, integrated RAID controller on motherboard with motherboard integrated TRIM.


There are "logical partitions", but in all the years I've been in this field I've never heard of a "logically encrypted partition". From the TrueCrypt quote below, you can see that sleep and hibernation would have no effect on encrypted data whatsoever. The problem with wear leveling on SSDs was addressed by virtually all manufacturers several years ago, thus it's a non-problem, and Windows 7 and 8 both handle TRIM natively.

Windows Disk Management doesn't treat an SSD any differently than a HDD, and an array is simply seen as a single large volume. There is absolutely no data protection in a RAID 0 array, which makes me wonder why you would even consider such a configuration if you're that concerned with data security.

I believe you would gain a much better understanding of how TrueCrypt actually functions by doing a bit more learning and a bit less research. A good place for you to start would be taking the time to study the documentation on their website: TrueCrypt Introduction

From TrueCrypt:
Note that TrueCrypt never saves any decrypted data to a disk – it only stores them temporarily in RAM (memory). Even when the volume is mounted, data stored in the volume is still encrypted. When you restart Windows or turn off your computer, the volume will be dismounted and files stored in it will be inaccessible (and encrypted). Even when power supply is suddenly interrupted (without proper system shut down), files stored in the volume are inaccessible (and encrypted). To make them accessible again, you have to mount the volume (and provide the correct password and/or keyfile).
.
 

smakme7757

Golden Member
Nov 20, 2010
1,487
1
81
Truecrypt will work fine.

The only security flaw when a PC hybernates that's using Truecrypt or Bitlocker is that the encryption key is unencrypted in memory.

So someone with the correct equipment and software would be able to extract the contents of your memory (via firewire for example) and then find the encryption key.

With for example:
http://www.elcomsoft.com/efdd.html

It's a reason why I've disconnected and disabled firewire on my home server that uses Bitlocker.
 

imagoon

Diamond Member
Feb 19, 2003
5,199
0
0
Truecrypt will work fine.

The only security flaw when a PC hybernates that's using Truecrypt or Bitlocker is that the encryption key is unencrypted in memory.

So someone with the correct equipment and software would be able to extract the contents of your memory (via firewire for example) and then find the encryption key.

With for example:
http://www.elcomsoft.com/efdd.html

It's a reason why I've disconnected and disabled firewire on my home server that uses Bitlocker.

Full system encryption takes care of the hibernation and ram dump issues (short of "parasitic memory" dumps. The firewire one obviously requires disabling the ports.

If you have a system that needs encryption, it is normally wise to do the entire OS.
 

PrincessFrosty

Platinum Member
Feb 13, 2008
2,300
68
91
www.frostyhacks.blogspot.com
>Isn't the data written to any logically encrypted partition always fully encrypted, even if the system hibernates? Any chance of security leak?
>Would the levels of wear differ at all during use after encryption?
>Comments on full disk encryption?

On a RAID 0 system of two SSD, integrated RAID controller on motherboard with motherboard integrated TRIM.

The data written the disk is encrypted in memory first, on the fly, and then written to disk, it never appears at all on the disk as plain text.

System hibernation is a problem, while the system is on and encrypted partitions are mounted the keys to encrypt and decrypt the hard drive are stored in memory and with hibernation the contents of memory are written to the disk. Full disk encryption of the OS drive solves this problem so make sure you're encrypting the OS drive when mounting other partitions.

Wear levels are the same encrypted as non encrypted, the only additional wear is a one time pass on the drive to do initial encryption. Truecrypt encrypts the free space in partitions so even empty drives go through an initial full drive write, no big deal.

Additional comments:

1) RAID 0 is built for speed only and not redundancy, in fact it has a greater chance of failure because fragging one drive breaks the entire array, make sure to take precautions for redundancy, RAID 0+1 is a good option for speed but reuqires 2x more drives.

2) Performance - With any full disk encryption the speed at which you can read/write may be limited by the CPU doing the encryption/decryption, truecrypt comes with a benchmark tool that allows you to see the max read/write speeds based on your hardware and encryption type.

Normally with a decent CPU (high end Intel) and slowish drives (single spindle) and fast encryption (AES) it's not a problem. However you plan on running RAID 0 for speed on faster SSD's, you have a potentially HUGE data transfer per second so it's worth benchmarking the max throughput of the drives non-encrypted and then benchmarking your CPU with Truecrypt and comparing the data rates.

Even if the CPU isn't a bottleneck for reading/writing data it's likely the CPU would be under significant load during read/writes and that could be problematic if the box has other roles that require CPU time.

It's also worth noting the newer Intel CPUs have hardware based AES acceleration which truecrypt supports which MASSIVELY boosts the speed at which the CPU can encrypt/decrypt the data (from 100's of MB/sec to several GB/sec), this would be a good route to go to keep performance of the array nice and fast if you're struggling.
 
Last edited:

PrincessFrosty

Platinum Member
Feb 13, 2008
2,300
68
91
www.frostyhacks.blogspot.com
Oh and also check the local laws regarding encryption in your country, see what legal repercussions there are for people who know the encryption keys.

Some countries have laws that force key holders to give up the keys under certain conditions, if you consider this an issue you should consider encrypting with hidden partitions to further protect your data.
 

ithenoob

Junior Member
Apr 22, 2013
11
0
0
Thanks guys and gals
I was just thinking that if an entire logical partition were encrypted, wouldn't the SSD consider all the bytes as "used", thereby inhibiting wear-levelling.
 

redyouch

Junior Member
Aug 6, 2013
18
0
0
Thanks guys and gals
I was just thinking that if an entire logical partition were encrypted, wouldn't the SSD consider all the bytes as "used", thereby inhibiting wear-levelling.

There is an option to encrypt the whitespace during the initial volume encryption. Deselect that option if you are concerned.
 
sale-70-410-exam    | Exam-200-125-pdf    | we-sale-70-410-exam    | hot-sale-70-410-exam    | Latest-exam-700-603-Dumps    | Dumps-98-363-exams-date    | Certs-200-125-date    | Dumps-300-075-exams-date    | hot-sale-book-C8010-726-book    | Hot-Sale-200-310-Exam    | Exam-Description-200-310-dumps?    | hot-sale-book-200-125-book    | Latest-Updated-300-209-Exam    | Dumps-210-260-exams-date    | Download-200-125-Exam-PDF    | Exam-Description-300-101-dumps    | Certs-300-101-date    | Hot-Sale-300-075-Exam    | Latest-exam-200-125-Dumps    | Exam-Description-200-125-dumps    | Latest-Updated-300-075-Exam    | hot-sale-book-210-260-book    | Dumps-200-901-exams-date    | Certs-200-901-date    | Latest-exam-1Z0-062-Dumps    | Hot-Sale-1Z0-062-Exam    | Certs-CSSLP-date    | 100%-Pass-70-383-Exams    | Latest-JN0-360-real-exam-questions    | 100%-Pass-4A0-100-Real-Exam-Questions    | Dumps-300-135-exams-date    | Passed-200-105-Tech-Exams    | Latest-Updated-200-310-Exam    | Download-300-070-Exam-PDF    | Hot-Sale-JN0-360-Exam    | 100%-Pass-JN0-360-Exams    | 100%-Pass-JN0-360-Real-Exam-Questions    | Dumps-JN0-360-exams-date    | Exam-Description-1Z0-876-dumps    | Latest-exam-1Z0-876-Dumps    | Dumps-HPE0-Y53-exams-date    | 2017-Latest-HPE0-Y53-Exam    | 100%-Pass-HPE0-Y53-Real-Exam-Questions    | Pass-4A0-100-Exam    | Latest-4A0-100-Questions    | Dumps-98-365-exams-date    | 2017-Latest-98-365-Exam    | 100%-Pass-VCS-254-Exams    | 2017-Latest-VCS-273-Exam    | Dumps-200-355-exams-date    | 2017-Latest-300-320-Exam    | Pass-300-101-Exam    | 100%-Pass-300-115-Exams    |
http://www.portvapes.co.uk/    | http://www.portvapes.co.uk/    |