Re: [dm-crypt] simple ideas addressing ssd TRIM security concern

[alban bernard <alban.bernard@yahoo.fr>]

--- On Sat, 4/14/12, Arno Wagner <arno@wagner.name> wrote:
> The Design "error" is of course that the raw device is told
> about
> some things that should only be visible after decryption.
>

In a way, TRIMing leads to the same situation as not writing garbage before device encryption.

> The information leakage is very small. If it is a concern,
> then TRIM must never be used. If not, TRIM can be used in
> unlimited
> fashion. It is a standard security trade-off. Your options
> can
> in some circumstances decrease the information lekage, but
> they
> will not so so reliably (comments below), and hence do not
> reduce
> the worst-case. But the risk-analysis that form the basis of
> the
> decision to allow TRIM or not has to use the worst-case as
> there
> is no basis for forming an average-case and an attacker may
> be able
> to provoke the worst-case scenario.

In case the user chooses the performance trade-off, an option to maximize security is still interesting to him. I agree with you, a layer that cryptographically randomize TRIMed blocks while limiting information leakage is not a key point to decide to allow TRIM or not (the worst case is still possible), but it is still important to have the option from the user perspective.

> > - randomize device usage pattern when choosing blocks
> to TRIM (hide
> >   filesystem)
>
> I don't quite understand how that could work, do you mean to
> have
> a random mapping between encrypted and hysical secors? That
> would
> kill performance a lot worse than not using TRIM in the
> first place.
>

I meant to randomly distribute TRIMed blocks across the device by choosing to not TRIM contiguous blocks of some files. E.g. when a big file is deleted, allow TRIM only on a randomly chosen set of its blocks limited to about 1 percent of its size. The 99 percent of it would stay unTRIMed on the device.

So, these ideas could only limit the information leakage that could be used by an attacker. To complete my understanding, if the device is completely used (no more free space), an attacker could not benefit of any leakage from TRIMed space. So, there is a relation between information leakage rate and amount of TRIMed space. A question rises to me: does an amount of TRIMed space exist to keep performance and still harden crypto-analysis in a controllable manner?