Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My understanding (I'm not sure I'm getting this all right) is that if one uses Trim on an encrypted SSD, it defeats some of the security benefits, because the drive will write zeros to empty space (as files are deleted).

See: http://www.askubuntu.com/questions/115823/trim-on-an-encrypted-ssd And: http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html

My question is: From the perspective of the performance of the SSD and the functioning of Trim, would it therefore be better to simply zero out the SSD, before setting up an encrypted system, rather than writing random data to the drive, with urandom, as one usually does?

Would this basically leave one with the same level of security anyway? And more importantly, would it better enable the Trim functionality to work as intended, with the encrypted SSD?

share|improve this question

1 Answer 1

The linked article only seems to indicate that an attacker can see what sectors are unused ( who cares? ) and complain about trim making recovering deleted files impossible ( having nothing to do with encryption ), so no, there is no security problem.

Writing to the whole SSD wears it out and kills its performance, so you don't want to do that. Enabling trim may recover from that by effectively undoing your initial write, so that write is just a waste of time ( that shortens the life off the disk ).

share|improve this answer
    
Well, revealing how much data is on a disk might be considered a problem in some cases. Also, it is worth noting that zeroing out every block on the disk is likely to kill the performance of many SSDs, since they usually rely on not having to keep track of uninitialised blocks. –  James Henstridge Apr 12 '12 at 4:42
    
Please Note My question is not about the security implications of using Trim with an encrypted SSD. It's about how writing random data to the drive, before setting up an encrypted system, will effect the performance of the drive and the functioning of the Trim protocol (and whether zeroing out the drive would be better for the functioning of the SSD and Trim). –  cb474 Apr 12 '12 at 5:00
    
@cb474, writing anything, be it random or zeros, to the whole SSD both wears it out, and hurts its performance. –  psusi Apr 12 '12 at 13:44
    
@psusi Thanks. For performance and wear, what would be the best way to proceed with an encrypted system (so TRIM and wear leveling work)? Should I secure erase the SSD (e.g. wiki.archlinux.org/index.php/SSD_Memory_Cell_Clearing) and then set up the encrypted system, without first writing random data? Or I've seen some people suggest leaving some unpartitioned space on the SSD, which the controller can use for wear leveling. I'm not concerned so much about plausible deniability, gained through a drive first overwritten with all random data. I just don't want my files readable. –  cb474 Apr 13 '12 at 0:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.