What algorithm does stock GELI full disk encryption use? reddit / freebsd ---------------------------------------------------------------------- Ith__ · 2021-05-16 15:11 I recently set up an encrypted FreeBSD 13.0 system using the encryption options in the installer. However it doesn't specify which algorithm is used and I couldn't find information on it in the man pages. Does anyone know what the standard algorithm is? ---------------------------------------------------------------------- edthesmokebeard · 2021-05-16 15:42 Unrelated, but what's the use case for an encrypted disk? If you're not there to boot the machine, how do you enter the key? And if the key is on disk, what does the encryption buy you? ---------------------------------------------------------------------- Ith__ · 2021-05-16 15:58 I'm setting up a laptop that I will have to store data on for school and that I don't want to get in the hands of the wrong people if stolen or such. Just a general measure of security. ---------------------------------------------------------------------- the_big_tech · 2021-05-16 16:05 According to [geli(8)](https://www.freebsd.org/cgi/man.cgi?query=geli& sektion=8&format=html), the default encryption algorithm is AES-XTS and the recommended integrity algorithm is HMAC/SHA256. ---------------------------------------------------------------------- Ith__ · 2021-05-16 16:07 Seems like I somehow skipped over it. Anyway thanks for taking your time! ---------------------------------------------------------------------- good_names_all_taken · 2021-05-16 16:57 If you want to confirm, just type "geli list" on command line and it will tell you what is being used. ---------------------------------------------------------------------- edthesmokebeard · 2021-05-16 18:04 makes total sense. I see a lot of talk about encryption and I can't imagine it's all laptops. ---------------------------------------------------------------------- Max-Normal-88 · 2021-05-16 19:04 I’d encrypt physical servers too, if I had any. I would never know who might get their hands on my hard drives against my will. ---------------------------------------------------------------------- mjb300 · 2021-05-16 20:10 Servers with ipmi/serial-over-LAN are one scenario where it would be safe (without having immediate physical access) to run an encrypted file system on a remote system. ---------------------------------------------------------------------- floriplum · 2021-05-17 06:11 It should also be possible to start a early ssh server that is used to unlock it. This way you obviously need your kernel on a non encrypted disk. But better than nothing for a not completely untrusted location. ---------------------------------------------------------------------- mjb300 · 2021-05-18 18:37 Sounds right. 🙂 (I realize GNU/Linux isn't *BSD, but they often have similar features...) I recall an ssh server being an option to unlock encrypted file systems. I went the IPMI route since I had it at my disposal. Thanks for mentioning the ssh option and keeping me straight. 😁 ---------------------------------------------------------------------- [deleted] · 2021-05-20 03:05 [deleted] ---------------------------------------------------------------------- system-user · 2021-05-20 14:38 servers with encrypted disks can be setup to load the key from a different server running a key exchange service, or you can simply get a terminal connection via SOL / ipmitool or use the BMC's iKVM to enter the passphrase. ---------------------------------------------------------------------- system-user · 2021-05-20 14:40 we have tens of thousands of servers in production, every single one has encrypted disks. these systems have between 10 and 26 drives each, so it's all automated. ---------------------------------------------------------------------- vivekkhera · 2021-05-20 17:31 Not just that but when you decommission the system all you need to do is destroy the key. No need to run any secure wipe of the drives which can take a long time.