Re: retrofitting LUKS encryption on installed system

2013-07-01 Thread Reindl Harald
Am 01.07.2013 20:11, schrieb Junk: > On Sat, 2013-06-29 at 23:51 +0200, Reindl Harald wrote: >> >> Am 29.06.2013 23:38, schrieb Bill Davidsen: >>> Reindl Harald wrote: "model name: QEMU Virtual CPU version 1.0.1" what the hell - on VMware you have the same CPU as the host and only

Re: retrofitting LUKS encryption on installed system

2013-07-01 Thread Junk
On Sat, 2013-06-29 at 23:51 +0200, Reindl Harald wrote: > > Am 29.06.2013 23:38, schrieb Bill Davidsen: > > Reindl Harald wrote: > >> "model name: QEMU Virtual CPU version 1.0.1" > >> what the hell - on VMware you have the same CPU as the host and only > >> "VMware EVC" > >> is filtering CPU capa

Re: retrofitting LUKS encryption on installed system

2013-07-01 Thread Reindl Harald
Am 29.06.2013 23:38, schrieb Bill Davidsen: > Reindl Harald wrote: >> "model name: QEMU Virtual CPU version 1.0.1" >> what the hell - on VMware you have the same CPU as the host and only "VMware >> EVC" >> is filtering CPU capabilities to provide relieable hot-migration between >> hosts >> by m

Re: retrofitting LUKS encryption on installed system

2013-07-01 Thread Reindl Harald
Am 29.06.2013 23:12, schrieb Bill Davidsen: > And right again. Unfortunately I didn't say or mean vSphere, but rather KVM, > the facility used by qemu-kvm to run > virtual machines. > > Hardware CPU: > vendor_id : GenuineIntel > model name : Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz

Re: retrofitting LUKS encryption on installed system

2013-07-01 Thread Reindl Harald
Am 29.06.2013 22:23, schrieb Bill Davidsen: > Mateusz Marzantowicz wrote: >> On 28.06.2013 17:21, j.witvl...@mindef.nl wrote: >>> It surely works, but at a performance price. And the certainty that you >>> have to enter the LUKS-key each time you >>> boot. >> >> Intel Sandy/Ivy Bridge processors

Re: retrofitting LUKS encryption on installed system

2013-07-01 Thread Tim
Allegedly, on or about 01 July 2013, j.witvl...@mindef.nl sent: > sometimes you see drastic overkills. Sure, private data needs to be > protected! But the rest?? First analyze _what_ you exactly need to > protect, and against _who_ . At least make it hard for a thief to boot up the computer an

Re: retrofitting LUKS encryption on installed system

2013-07-01 Thread J.Witvliet
you exactly need to protect, and against _who_ . - Oorspronkelijk bericht - Van: Heinz Diehl [mailto:h...@fritha.org] Verzonden: Sunday, June 30, 2013 08:16 PM W. Europe Standard Time Aan: users@lists.fedoraproject.org Onderwerp: Re: retrofitting LUKS encryption on installed system

Re: retrofitting LUKS encryption on installed system

2013-06-30 Thread Fred Smith
On Sun, Jun 30, 2013 at 08:16:44PM +0200, Heinz Diehl wrote: > On 30.06.2013, j.witvl...@mindef.nl wrote: > > > Full disc encryption on a athom demands some extra patience :-) > > :-) > > "..if you expect performance on any > general loads from Atom, you need to get your head examined." Well,

Re: retrofitting LUKS encryption on installed system

2013-06-30 Thread Heinz Diehl
On 30.06.2013, j.witvl...@mindef.nl wrote: > Full disc encryption on a athom demands some extra patience :-) :-) "..if you expect performance on any general loads from Atom, you need to get your head examined." (Linus Torvalds 01.09.2011 in ) -- users mailing list users@lists.fedoraproject.

Re: retrofitting LUKS encryption on installed system

2013-06-30 Thread J.Witvliet
athom demands some extra patience :-) - Oorspronkelijk bericht - Van: Bill Davidsen [mailto:david...@tmr.com] Verzonden: Saturday, June 29, 2013 10:07 PM W. Europe Standard Time Aan: Community support for Fedora users Onderwerp: Re: retrofitting LUKS encryption on installed system j.

Re: retrofitting LUKS encryption on installed system

2013-06-30 Thread Mateusz Marzantowicz
On 29.06.2013 22:23, Bill Davidsen wrote: > Leaving the card in the machine kind of defeats the purpose, doesn't it? > > And adds to the possibility of forgetting to remove the card when you > walk away. Security and convenience are to some extent mutually > exclusive. > > Every security mechanism

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Bill Davidsen
Reindl Harald wrote: Am 29.06.2013 23:38, schrieb Bill Davidsen: Reindl Harald wrote: "model name: QEMU Virtual CPU version 1.0.1" what the hell - on VMware you have the same CPU as the host and only "VMware EVC" is filtering CPU capabilities to provide relieable hot-migration between hosts b

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Bill Davidsen
Reindl Harald wrote: Am 29.06.2013 23:12, schrieb Bill Davidsen: And right again. Unfortunately I didn't say or mean vSphere, but rather KVM, the facility used by qemu-kvm to run virtual machines. Hardware CPU: vendor_id : GenuineIntel model name : Intel(R) Core(TM) i5-2400 CP

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Bill Davidsen
Reindl Harald wrote: Am 29.06.2013 22:23, schrieb Bill Davidsen: Mateusz Marzantowicz wrote: On 28.06.2013 17:21, j.witvl...@mindef.nl wrote: It surely works, but at a performance price. And the certainty that you have to enter the LUKS-key each time you boot. Intel Sandy/Ivy Bridge process

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Heinz Diehl
On 29.06.2013, Roberto Ragusa wrote: > You should try aes-cbc-essiv:sha256, it could give you 330 MB/s. After encountering the mentioned performance drop, I didn't encrypt at all. The only purpose of encrypting for me is to protect my data in case my laptop gets lost or stolen. I decided to have

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Bill Davidsen
Mateusz Marzantowicz wrote: On 28.06.2013 17:21, j.witvl...@mindef.nl wrote: It surely works, but at a performance price. And the certainty that you have to enter the LUKS-key each time you boot. Intel Sandy/Ivy Bridge processors and later (AMD also) have something called AES-NI which signifi

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Bill Davidsen
Fred Smith wrote: On Fri, Jun 28, 2013 at 05:21:34PM +0200, j.witvl...@mindef.nl wrote: -Original Message- From: users-boun...@lists.fedoraproject.org [mailto:users-boun...@lists.fedoraproject.org] On Behalf Of Fred Smith Sent: Friday, June 28, 2013 3:42 PM To: users@lists.fedoraproject

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Bill Davidsen
j.witvl...@mindef.nl wrote: -Original Message- From: users-boun...@lists.fedoraproject.org [mailto:users-boun...@lists.fedoraproject.org] On Behalf Of Fred Smith Sent: Friday, June 28, 2013 3:42 PM To: users@lists.fedoraproject.org Subject: retrofitting LUKS encryption on installed syste

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Roberto Ragusa
On 06/29/2013 12:31 PM, Heinz Diehl wrote: > On 29.06.2013, Roberto Ragusa wrote: > >> CPUs with AES-NI make encryption speed penalty basically null (even on a >> SSD); > > This is not true in my case. My OCZ Vertex delivers 465 MB/s > unencrypted, and 167 MB/s encrypted with aes-xts-plain64:sh

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Heinz Diehl
On 29.06.2013, Roberto Ragusa wrote: > CPUs with AES-NI make encryption speed penalty basically null (even on a SSD); This is not true in my case. My OCZ Vertex delivers 465 MB/s unencrypted, and 167 MB/s encrypted with aes-xts-plain64:sha256 using the Core i5-2450's AES-NI and AVX instruction s

Re: retrofitting LUKS encryption on installed system

2013-06-29 Thread Roberto Ragusa
On 06/28/2013 03:41 PM, Fred Smith wrote: > I've got a F19 installation that I'd like to turn into a fully encrypted > system with LUKS. > > There are many howtos on the web for encrypting a partition, but they > all show doing it to /home. > > the implication is that you need to be logged in as

Re: retrofitting LUKS encryption on installed system

2013-06-28 Thread Fred Smith
On Fri, Jun 28, 2013 at 10:44:09PM +0200, Mateusz Marzantowicz wrote: > On 28.06.2013 17:21, j.witvl...@mindef.nl wrote: > > It surely works, but at a performance price. And the certainty that you > > have to enter the LUKS-key each time you boot. > > Intel Sandy/Ivy Bridge processors and later (

Re: retrofitting LUKS encryption on installed system

2013-06-28 Thread Mateusz Marzantowicz
On 28.06.2013 17:21, j.witvl...@mindef.nl wrote: > It surely works, but at a performance price. And the certainty that you have > to enter the LUKS-key each time you boot. Intel Sandy/Ivy Bridge processors and later (AMD also) have something called AES-NI which significantly speeds up disk encryp

Re: retrofitting LUKS encryption on installed system

2013-06-28 Thread Fred Smith
On Fri, Jun 28, 2013 at 05:21:34PM +0200, j.witvl...@mindef.nl wrote: > -Original Message- > From: users-boun...@lists.fedoraproject.org > [mailto:users-boun...@lists.fedoraproject.org] On Behalf Of Fred Smith > Sent: Friday, June 28, 2013 3:42 PM > To: users@lists.fedoraproject.org > Subj

Re: retrofitting LUKS encryption on installed system

2013-06-28 Thread Heinz Diehl
On 28.06.2013, j.witvl...@mindef.nl wrote: > The only valid reason I can think about, > is that other people have physically access to your machine If somebody has physical access to your machine, you're hosed. A hardware keylogger could have been installed, a camera which spies on you and capt

RE: retrofitting LUKS encryption on installed system

2013-06-28 Thread J.Witvliet
-Original Message- From: users-boun...@lists.fedoraproject.org [mailto:users-boun...@lists.fedoraproject.org] On Behalf Of Fred Smith Sent: Friday, June 28, 2013 3:42 PM To: users@lists.fedoraproject.org Subject: retrofitting LUKS encryption on installed system I've got a F19 installation

Re: retrofitting LUKS encryption on installed system

2013-06-28 Thread Dr. Michael J. Chudobiak
So, my question(s): -can you do it while being booted into a recovery environment? -if not, is there any way to convert the whole thing that I'm not able to figure out on my own (perhaps I'm having a whole series of senior moments) ??? -Or would it simply be best to do a fresh installa