On Sat, Aug 13, 2011 at 11:18:15PM +0200, Steve Verniers wrote: > Hi, > > Just a quick question. I have encrypted my FS with cryptsetup and see it's > 256bit but I found that it is too taxing on my systems resources (only > Pentium 4 machine with 2GB ram) "256" bit does not say a lot about encryption speed. The most important facto is the cipher. Mode also plays a role. If you look here: http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/ you will find that AES256 is close to the maximum speed you can get and AES128 is only about 20% faster. The perception limit for computing speed changes is around 20%, i.e. it is possible you would not even notice the change. It would seem that you will not get any significant speed improvement by changing the cipher. Also note that you need to use cbc-essiv or xts mode at this time to be seucre, the others have data-leackage issues. > Could I "re-encrypt" the FS without loosing > the data which is already stored on it ? I have no room to backup so much > space. You could, but there is a massive risk of complete data-loss. Don't do this without a full, verifed backup. If you have that backup, you can just re-create the encrypted device and be done, so I will not go into any bizzare solutions for doing this. Side note, you need a full backup of the encrypted data anyways, if it is worth anything, see also the FAQ. If you do not have a backup, I recommend just deleting all data and starting over with an empty device, as your data is obviously not worth anything. > Also what would be a recommanded bit for a system such as > mine ? 64bit ? 128? As a shorter key does not give significant speed improvement, aes256-cbc-essiv or aes256-xts is close to optimal. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
