SSD, TrueCrypt and performance

Greetings.

I have a Samsung SSD 830 series 128GB drive (model number: MZ-7PC128), fresh out of the box.

This drive does not have the SandForce compression controller. This drive utilizes wear-leveling.

I want to put this SSD into my Asus eee 1015PEM (it has 2GB RAM and a Intel® Atom™ N550 (Dual Core; 1.5GHz) Processor).

I want to protect the data I store on the drive from an opportunistic thief who snatches my laptop and wants to snoop around for data he can exploit.

I aim to do this as follows:

• 
  ■create two physical partitions; a boot partition, and a system partition, the sum of which will be 75% of the total NAND flash capacity of the drive (for performance reasons; see below).
  ■encrypt the system partition using TrueCrypt (AES encryption) (I realize the security implications of not encrypting /boot; see below).
  ■install Arch Linux on the system partition (splitting it into logical partitions).

Compared to an unencrypted setup, what kind of performance hit (slowed disk read-write, processor load) should I expect in this setup? I expect up to 50% slower read, up to 25% slower write, and not noticeable added CPU load (eventhough my CPU does not implement the AES instruction set). Are there other/recent results which make the proposed setup ill-advised, performance or security-wise?

What are your thoughts on this setup, and on my expectations of its performance?

Cheers,
Willard.


Related TomsHardware threads:

http://www.tomshardware.co.uk/forum/282373-32-native-encryption-truecrypt
http://www.tomshardware.co.uk/forum/270227-32-truecrypt
http://www.tomshardware.co.uk/forum/268261-32-full-disk-encryption


Benchmarks:

This benchmark (January 2010) suggests that when an SSD is full-disk-encrypted (encryption: TrueCrypt, AES), read speed is reduced by up to 50%, and write speed is reduced by up to 25% (compared to the same drive without full-disk-encryption).

http://media-addicted.de/ssd-and-truecrypt-durability-and-performance-issues/744/

and that even with these performance degradations, the drive still outperforms HDDs.

This benchmark (April 2010) shows a more abysmal result (encryption: PGP); a 66-75% performance degradation.

http://anthonyvance.com/blog/security/ssd_encryption/

and that even with these performance degradations, the drive still outperforms an *encrypted* HDDs.

This benchmarks indicates that you may get slightly-better numbers if you leave more space on your drive unallocated (leaving 25% of the total NAND storage space unallocated seems to be a sweet spot in terms of performance_gain / space_loss).

http://www.anandtech.com/show/6489/playing-with-op


Compression:

If the SSD firmware optimizes write speeds by compressing the data sent to the drive before it is physically written to the drive, then full-disk-encryption kills this optimization (as all data sent to the disk is encrypted, it will look random to the compression algorithm, and thus cannot be compressed efficiently).

http://superuser.com/questions/448965/does-full-disk-encryption-on-ssd-drive-reduce-its-lifetime

My SSD does not utilize compression, so to me, this is a non-issue.


Self-encryption:

Performance wouldn't be an issue if the SSD was a self-encrypting drive (SED), that is, had onboard hardware which efficiently encrypted data sent to it before physically writing it to the disk.

Current support in SSD hardware for encryption seems to be insecure; see Bricktop's comment in

http://www.tomshardware.co.uk/forum/268261-32-full-disk-encryption

My SSD is not a SED, so to me, this is a non-option.


Reliability/Durability/Wear:

Some people have said that full-disk-encrypting a SSD reduces its durability, as the disk needs to do more writes. Is this, in practice, a problem I need to worry about? (should I expect the SSD to die within 4 years, say?). I expect not.


Security:

No data is ever truly erased from an SSD (Unless the Flash Transition Layer (FTL) firmware includes an extension developed in a 2-year-old research paper. Can we know for sure? Would an SSD manufacturer ever say "the SSD now actually securely deletes data", thereby admitting that it didn't prior?).

http://www.tomshardware.com/news/solid-state-flash-translation-layer-NAND-FAST-11-Sanitization,12252.html

Thus, the attack on full-disk-encrypted drives detailed in the TrueCrypt documentation exists regardless of whether the drive utilizes wear-leveling or not:

http://www.truecrypt.org/docs/wear-leveling

So, what's the point of encrypting my drive in the first place?

My drive is empty before I create a full-disk-encrypted volume on it. Thus the risk of an attacker obtaining files existing on the drive prior to encryption is nonexistent. Also, I don't expect my key to be compromised, and thus, I won't have to replace it. This makes "decrypting the drive using an old, compromised key" difficult.

Further, I am protecting my data from an opportunist thief who steals my laptop, snoops around in my files, and might see an opportunity of stealing my identity / getting access to financial information. I am assuming that the above attack is beyond the ability of such a thief, or at least is not worth the effort when the thief has no idea what he is looking for.

If you think I am missing something, or if you think I am being naive, then feel free to point this out and explain what/why.