Disk encryption on NetBSD achieving secrecy

Disk encryption on NetBSD provides a method to ensure data confidentiality in two scenarios: when a device is lost or stolen, or when it is tampered with. The focus here is on preventing unauthorized access to data, rather than preventing tampering.

To determine what data warrants protection, NetBSD's data can be categorized into two groups: the system files in /bin/sh, which are unlikely to contain sensitive information due to the separation of base system and packages, and other user data. It's reasonable to assume that these system files are identical across all NetBSD users and can be made read-only.

Full disk encryption is challenging to achieve without specialized hardware, as it requires a way for users to input a password or encryption key during boot-up. NetBSD uses shared libraries for system functionality, and if these are unavailable, system usability may be compromised. Modern CPUs often have hardware implementations of cryptographic algorithms such as AES, which can improve performance.

Users can opt for encrypting specific directories like /home, but this might not be sufficient to protect all sensitive data. Crash dumps, system logs, configuration files, and mail might contain sensitive information. An alternative approach is the cgdroot setup, which uses a small unencrypted ramdisk to access an encrypted file system, but this modifies the system startup routines.

A middle-ground approach involves using standard NetBSD installation and boot process. NetBSD supports separate file system partitions for /usr and /var, with /etc containing critical boot files. Most files in /etc remain unchanged, and passwords are typically stored in hashed form. Configuration files can be replaced with symbolic links to files on another file system.

During installation, NetBSD can be installed to a small unencrypted root file system, with a larger encrypted partition for /var and /usr, which can be shared. This configuration provides a balance between security and usability, consuming only a few gigabytes of storage.