Re: [dm-crypt] "re-encrypting" ?

[Arno Wagner <arno@wagner.name>]

On Sat, Aug 13, 2011 at 11:18:15PM +0200, Steve Verniers wrote:
> Hi,
> 
> Just a quick question. I have encrypted my FS with cryptsetup and see it's
> 256bit but I found that it is too taxing on my systems resources (only
> Pentium 4 machine with 2GB ram) 

"256" bit does not say a lot about encryption speed. The most 
important facto is the cipher. Mode also plays a role.
If you look here:

http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/

you will find that AES256 is close to the maximum speed you can 
get and AES128 is only about 20% faster. The perception limit
for computing speed changes is around 20%, i.e. it is possible
you would not even notice the change. 

It would seem that you will not get any significant speed improvement
by changing the cipher. Also note that you need to use cbc-essiv or 
xts mode at this time to be seucre, the others have data-leackage 
issues.

> Could I "re-encrypt" the FS without loosing
> the data which is already stored on it ?  I have no room to backup so much
> space.

You could, but there is a massive risk of complete data-loss. 
Don't do this without a full, verifed backup. If you have that
backup, you can just re-create the encrypted device and be done,
so I will not go into any bizzare solutions for doing this.

Side note, you need a full backup of the encrypted data anyways,
if it is worth anything, see also the FAQ. If you do not have 
a backup, I recommend just deleting all data and starting
over with an empty device, as your data is obviously not
worth anything.

> Also what would be a recommanded bit for a system such as 
> mine ? 64bit ? 128?

As a shorter key does not give significant speed
improvement, aes256-cbc-essiv or aes256-xts is close 
to optimal.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier