--On 31 December 2013 17:03:33 -0500 "Chad J. Milios" <[email protected]> wrote:
Either way works great. Both ways have their benefits, pains and pitfalls.
I guess HAST on top of GELI means both systems share the crypto load, whereas GELI ontop of HAST means one box ends up doing the crypto work for both 'sides' of the HAST devices... [if I've got that the right way round] - so HAST on GELI is probably the better way to go.
It depends on your use case, configuration, hardware, adversaries, etc. Like most security solutions, the devil, and weaknesses, lay in the details, like network engineering and key management. Care to elaborate for us?
There's not a lot to elaborate - I want more redundancy for a home system with the added benefit if someone happens to steal either box - I don't want them getting 'easy access' to family photos, emails info etc.
In other cases software based full disk encryption is really only going to thwart or inconvenience the weakest of adversaries,
Hehe - if that means the person who breaks in and steals it just scraps it rather than gets to go through all the data - that's fine by me :) But point kinda taken :-)
-Karl _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-geom To unsubscribe, send any mail to "[email protected]"
