I was in the process of backing up part of my data to an external drive when came the question of encryption (again). The following two posts caught my attention:

 

http://www.tuxera.com/community/ntfs-3g-faq/

Why is writing slow using ‘dd’, ‘amarok’ or ‘encfs’?

By default they use the possible smallest, 512 or 1024 bytes, write block size which results eight or four times more work to do for FUSE, kernel and NTFS-3G. Since they are not optimized yet, the performance will suffer almost one fold in the worst case. Use at least 4 kB block size and the write speed will improve dramatically.Encfs is hit by a Linux kernel deficiency. Since it uses a non-page size internal header thus writes are not page aligned and the kernel will split them which halves encfs write performance.

 

 

http://en.wikipedia.org/wiki/Blowfish_%28cipher%29

In current implementations of cryptographic libraries (specifically OpenSSL), AES-128 is somewhat (< 50%) faster than Blowfish on most hardware.[5] It is likely that advances in CPU architecture (out of order execution becoming mainstream) speed up AES more than Blowfish. For example, Intel's in-order Atom CPU runs Blowfish twice as fast as AES-128.[6] There may be room for more optimization of Blowfish, but the Rijndael has received more attention since it was chosen for AES.

 

My initial tests were done on AES-256 with 1024-bit block size (default). As my unRaid server is based upon an Atom motherboard, I decided to give encFS another spin.

I didn't use the network on that one. I just moved 3 files of 723851264 bytes each from/to one drive to another drive (encrypted directory) of the array.

The results speak for themselves, Blowfish blows away AES on an Atom based platform.  Reading from an encrypted folder only decreases performance by 20%.

However increasing block size to 4096-bit significantly boosts performance for large files. Additionally, 256- or 128-bit key sizes on Blowfish don't make much difference.

So for now on, my external/off-site backups will be based upon Blowfish-256 with 4096-bit block sizes (I'm rsync'ing 400GB right now).

As a side note it took me a forum search to discover that I couldn't mount my external backup drive that was formatted with ext3 

I formatted it with ReiserFS and everything was fine.

 

-------------------------------------------------------------------
| Algorithm   | Key size | Block size | D2->D1(efs) | D1(efs)->D2 |
------------------------------------------------------------------|
| No encrypt. |    -     |      -     |     1:02    |     1:02    |            
|-----------------------------------------------------------------|
| Blowfish    |  128-bit |  4096-bit  |     1:53    |     1:12    |            
|-----------------------------------------------------------------|
| Blowfish    |  256-bit |  4096-bit  |     1:54    |     1:14    |            
|-----------------------------------------------------------------|
| Blowfish    |  128-bit |  1024-bit  |     2:27    |     1:19    |            
|-----------------------------------------------------------------|
| Blowfish    |  256-bit |  1024-bit  |     2:27    |     1:19    |            
|-----------------------------------------------------------------|
| AES         |  128-bit |  4096-bit  |     2:38    |     1:54    |            
|-----------------------------------------------------------------|
| AES         |  256-bit |  4096-bit  |     3:09    |     2:31    |            
|-----------------------------------------------------------------|
| AES         |  128-bit |  1024-bit  |     3:11    |     2:06    |            
|-----------------------------------------------------------------|
| AES         |  128-bit |  1024-bit  |     3:43    |     2:46    |            
|-----------------------------------------------------------------|

 

* D1(efs) = Disk 1, encFS

* D2 = Disk 2

 

 

 

Bumpety bump bump.

 

Has anyone been using encfs in 'anger' ?

 

How has it gone? Any problems?

 

There's been no movement on the problem I had according to google code but it's a fairly edge scenario and probably wouldn't trigger day to day.

 

Continuing on from alphazo's good work :

 

http://lime-technology.com/forum/index.php?topic=7759.0

 

In case anyone interested in EncFS misses it.

 

alphazo - I'd appreciate your thoughts or comments on the new version and any feedback if you've been using encfs regularly on unraid..