{
  "id": 20118200,
  "title": "Disk encryption on NetBSD achieving secrecy",
  "url": "https://urgent.news/2026/11/15/disk-encryption-on-netbsd-achieving-secrecy",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-15T05:30:28.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://netbsd.org/~nia/disk-encrypt/"
  },
  "original_language": "en",
  "account": "Disk encryption on NetBSD provides a method to ensure data confidentiality in two scenarios: when a device is lost or stolen, or when it is tampered with. The focus here is on preventing unauthorized access to data, rather than preventing tampering.\n\nTo determine what data warrants protection, NetBSD's data can be categorized into two groups: the system files in /bin/sh, which are unlikely to contain sensitive information due to the separation of base system and packages, and other user data. It's reasonable to assume that these system files are identical across all NetBSD users and can be made read-only.\n\nFull disk encryption is challenging to achieve without specialized hardware, as it requires a way for users to input a password or encryption key during boot-up. NetBSD uses shared libraries for system functionality, and if these are unavailable, system usability may be compromised. Modern CPUs often have hardware implementations of cryptographic algorithms such as AES, which can improve performance.\n\nUsers can opt for encrypting specific directories like /home, but this might not be sufficient to protect all sensitive data. Crash dumps, system logs, configuration files, and mail might contain sensitive information. An alternative approach is the cgdroot setup, which uses a small unencrypted ramdisk to access an encrypted file system, but this modifies the system startup routines.\n\nA middle-ground approach involves using standard NetBSD installation and boot process. NetBSD supports separate file system partitions for /usr and /var, with /etc containing critical boot files. Most files in /etc remain unchanged, and passwords are typically stored in hashed form. Configuration files can be replaced with symbolic links to files on another file system.\n\nDuring installation, NetBSD can be installed to a small unencrypted root file system, with a larger encrypted partition for /var and /usr, which can be shared. This configuration provides a balance between security and usability, consuming only a few gigabytes of storage.",
  "summary": null,
  "key_points": [
    "Disk encryption on NetBSD protects data confidentiality in lost/stolen or tampered situations.",
    "System files in /bin/sh considered low-risk, can be made read-only.",
    "Middle-ground approach uses separate partitions for /usr, /var with encrypted /var and /usr."
  ],
  "editors_take": "Balancing security and usability through partitioned encryption allows NetBSD users to protect sensitive data and system files without requiring specialized hardware or compromising the standard boot process.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}