3

I need to encrypt an SSD drive and I have opted to use dm-crypt. This is not something I do on a regular basis.

So far I have successfully cleared the memory cells of my SSD with the ATA secure erase command. I have also filled the entire disk with random data using:

dd if=/dev/urandom of=/dev/sdx bs=4096 status=progress.

My question is in regards to the final step, which is encrypting the devices (my partitions) with the cryptsetup utility.

Since I’ve already filled my entire disk with random data, will I need to refill my partitions with random data after creating and encrypting them? In other words, will the random data that I generated with dd still reside inside of the encrypted partitions that i create?

Rui F Ribeiro
  • 56,709
  • 26
  • 150
  • 232
  • What are you trying to achieve? Preventing someone from getting to your data when you haven't entered the pass phrase, or preventing someone from even knowing that there is data there? – Petro Oct 26 '17 at 17:59
  • Adding random data after a trim is more or less pointless - the crypto headers kinda give it away anyway. The point with hard drives was to overwrite any potential old data there. That's achieved with a secure erase. – vidarlo Oct 26 '17 at 18:28
  • maybe related https://unix.stackexchange.com/a/387261/30851 – frostschutz Oct 26 '17 at 18:32

1 Answers1

5
dd if=/dev/urandom of=/dev/sdx bs=4096 status=progress

This command will overwrite the entire drive with random data. That random data will stay there until you write other data, or secure-erase, or TRIM.

In other words, will the random data that I generated with dd still reside inside of the encrypted partitions that i create?

Normally this is the case.

However, it's not always obvious when TRIM happens. For example, mkfs or mkswap/swapon silently imply TRIM and you have to use additional parameters to disable it. I do not know if partitioners picked up the same idea and TRIM newly created partitions. If using LVM instead of partitions, note that lvremove / lvresize / etc. does imply TRIM if you have issue_discards = 1 in your lvm.conf. Other storage layers such as mdadm support TRIM as a simple pass-through operation.

cryptsetup open by default does not allow TRIM unless you specify --allow-discards, however some distributions might choose to change those defaults.

After all, it's very unusual to random-wipe SSD for encryption. The only use case I can think of is getting rid of old data while not trusting the hardware to do this for free when you TRIM or secure-erase.

Even with encryption, it's normal for free space to be visible on SSD. Most people will want to use TRIM weekly/monthly to avoid possible performance degradation in the long term, so distributions might follow that trend and use allow-discards on encrypted devices by default.

Once trimmed, your overwriting with random data was for naught.

But as long as you are in control, and disable TRIM in everything you do, the random data will stay.

frostschutz
  • 48,978
  • Yeah I won’t be using TRIM. Basically, I wasn’t sure if my partitions were going to overwrite the random data that I generated with /dev/urandom. So I will go ahead and make my partitions. Take care. –  Oct 26 '17 at 20:32