[dm-crypt] "re-encrypting" ?
arno at wagner.name
Sun Aug 14 10:32:01 CEST 2011
On Sat, Aug 13, 2011 at 11:18:15PM +0200, Steve Verniers wrote:
> Just a quick question. I have encrypted my FS with cryptsetup and see it's
> 256bit but I found that it is too taxing on my systems resources (only
> Pentium 4 machine with 2GB ram)
"256" bit does not say a lot about encryption speed. The most
important facto is the cipher. Mode also plays a role.
If you look here:
you will find that AES256 is close to the maximum speed you can
get and AES128 is only about 20% faster. The perception limit
for computing speed changes is around 20%, i.e. it is possible
you would not even notice the change.
It would seem that you will not get any significant speed improvement
by changing the cipher. Also note that you need to use cbc-essiv or
xts mode at this time to be seucre, the others have data-leackage
> Could I "re-encrypt" the FS without loosing
> the data which is already stored on it ? I have no room to backup so much
You could, but there is a massive risk of complete data-loss.
Don't do this without a full, verifed backup. If you have that
backup, you can just re-create the encrypted device and be done,
so I will not go into any bizzare solutions for doing this.
Side note, you need a full backup of the encrypted data anyways,
if it is worth anything, see also the FAQ. If you do not have
a backup, I recommend just deleting all data and starting
over with an empty device, as your data is obviously not
> Also what would be a recommanded bit for a system such as
> mine ? 64bit ? 128?
As a shorter key does not give significant speed
improvement, aes256-cbc-essiv or aes256-xts is close
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
If it's in the news, don't worry about it. The very definition of
"news" is "something that hardly ever happens." -- Bruce Schneier
More information about the dm-crypt