Comment by 2bluesc | Hacker News Reader

Comment by 2bluesc | Hacker News Reader

Dug in trying to understand what's wrong with dm-crypt (+ LUKS on my desktop) I use on Android already. No real answers.

Interesting quote from dm-crypt dev:

> As the primary DM maintainer I've yet to see a single report about dm-crypt performance being a pain point for android. Yet ext4 developers have gotten to a point where AOSP changes were introduced to use their newly crafted encryption support. Amazing really.

ref: https://lwn.net/Articles/639736/

No real answers or benchmark data. Anyone know why I'd want to use this over dm-crypt?

This is about trying to "catch up" to the encryption Apple has in HFS+. On iOS, there are a number of different policies that can protect a file: it can always be accessible, be accessible only after the user first unlocks their device, or only be accessible while the device is unlocked. The ability to say "I have locked my device: destroy the in-memory keys used to decrypt most of my data" is really powerful and important, as otherwise I can attack your running phone that I steal out of your pocket to obtain your data. This kind of flexibility just doesn't fit at the level of a block device.

> Anyone know why I'd want to use this over dm-crypt?

    - mixing unencrypted with encrypted data (why encrypting object files during bulk builds?)
    - file-based, encrypted backups for free (including incremental jobs!)
    - passwords/keys per directory
    - passwords/keys per user
    - passwords/keys per group
    - (...)

People who like encfs/cryptfs will probably like this too.

Reply on news.ycombinator.com