On 1141137392 seconds since the Beginning of the UNIX epoch
sp4rc wrote:
>

>I have red throught the great netbsd guide about cgd [1]. So far I think
>it would be better, from a point of performance view, to only encrypt
>those partitions where data is kept from the above mentioned services. 

Basically, what I do is encrypt all of the partitions where I expect
to be writing sensitive data, so I have:

$ df
Filesystem  1K-blocks      Used     Avail Capacity  Mounted on
/dev/wd0a      198831     31190    157700    16%    /
/dev/cgd0a    2039480   1671632    265880    86%    /var
/dev/wd0e     4963478   3488719   1226586    73%    /usr
/dev/cgd0f   36516616  32800688   1890104    94%    /u
mfs:502        191975         5    182372     0%    /tmp
kernfs              1         1         0   100%    /kern

/usr is for the OS and its packages which are publically available
so I don't feel the need to encrypt them.  After all, I'm sure that
people can pretty easily guess that I run NetBSD on my laptop.

I don't use swap on this machine because I always seem to have
around a half GB of unused RAM at any point in time, but if I did
then I would definitely want to encrypt it.

>I have red throught the paper from Roland Dowdeswell [3], so far I think
>aes-128 would at best fit my needs. What experiences do you people have
>out there? Is a dual MP with 1Ghz fast enough for this task? Also I
>would like to setup this services running in a chroot environment and
>setting veriexec's strict [2] level to 1. 

Performance mostly depends on the relative speeds of the CPU(s)
compared to the disk.  But it's quite easy to just first up some
examples on your system and see how they perform.  Since you read
my paper, you have a pretty good idea of what I've seen.  My new
laptop has radically different performance depending on whether
it's plugged in or not since the CPU speed is cut to a third when
I take the A/C out.

aes128 is the fastest AES variant, so it's a reasonable choice for
most applications.  Blowfish is a bit faster, so depending on the
situation you might consider it as well, if aes128 turns out to be
too slow.  The main drawback of Blowfish is that modern disks are
reaching sizes where a small bit of structural analysis might work
on it.

>How would you split the partions for this purposes? Any other
>recommendations on this? 

I've been looking into Xen for separation of processes.

--
    Roland Dowdeswell                      http://www.Imrryr.ORG/~elric/