Linux Full Disk Encryption Performance For The AMD Ryzen 7 PRO / HP Dev One

[phoronix]

Phoronix: Linux Full Disk Encryption Performance For The AMD Ryzen 7 PRO / HP Dev One

One of the great defaults when installing Pop!_OS or receiving a pre-loaded laptop/desktop from System76 or the new HP Dev One is that it encourages full-disk encryption by default and prominently shown during the install process. I highly recommend full-disk encryption especially for laptops. As it's been a few years since running benchmarks looking at the overhead of LUKS encryption, here are some benchmarks of Pop!_OS 22.04 on the HP Dev One with the full disk encryption enabled and then a fresh install without encryption.

https://www.phoronix.com/vr.php?view=31237

[Guest]

I haven’t looked into FDE for a few years now, but I recall there being something about trim on SSDs. Can you run fstrim with FDE?

[pWe00Iri3e7Z9lHOX2Qx]

Nice to see a recent run of benchmarks for FDE. The Pop!_OS installer is really nice. Not only is encryption on by default, but it uses the same password you set up for your user so there aren't any extra setup steps that add friction for newcomers. It's obvious that System76 is one of the few Linux companies that actually give a shit about the experience for desktop users.

[johncall]

What parameters were used to encrypt the disk? Just the Pop! _OS defaults, or did you choose a particular cipher?

[birdie]

I haven’t looked into FDE for a few years now, but I recall there being something about trim on SSDs. Can you run fstrim with FDE?

Yes, it's been possible for ages even if you use LVM. I wouldn't use it otherwise.

[mazumoto]

I haven’t looked into FDE for a few years now, but I recall there being something about trim on SSDs. Can you run fstrim with FDE?

I'm quite sure you can do trim nowadays. But be aware that trim gives away information to a possible attacker - like patterns where data is located on the disk. It might also make "plausible deniability" impossible.

[Guest]

I'm quite sure you can do trim nowadays. But be aware that trim gives away information to a possible attacker - like patterns where data is located on the disk. It might also make "plausible deniability" impossible.

Yeah that sounds familiar; can anything be done to decrypt or bypass the encryption with trim in that case? I don’t necessarily mind attackers knowing the drive is encrypted.

[Michael]

What parameters were used to encrypt the disk? Just the Pop! _OS defaults, or did you choose a particular cipher?

Pop defaults

[birdie]

Yeah that sounds familiar; can anything be done to decrypt or bypass the encryption with trim in that case? I don’t necessarily mind attackers knowing the drive is encrypted.

Nothing that I'm aware of.

[kiffmet]

Does the PSP/CCP of Ryzen work on mobile devices? Theoretically it could be used as an accelerator for different crypto algorithms. I was pretty much out of luck with the driver claiming "ccp: unable to access the device: you might be running a broken BIOS." on a 3900X and a 5900X w/ the GB X570 Aorus Pro r1.0 with every BIOS up to AGESA 1.2.0.3C