HAST + GELI?

[Karl Pielorz]

--On 31 December 2013 17:03:33 -0500 "Chad J. Milios" <milios at ccsys.com> 
wrote:

> Either way works great. Both ways have their benefits, pains and
> pitfalls.

I guess HAST on top of GELI means both systems share the crypto load, 
whereas GELI ontop of HAST means one box ends up doing the crypto work for 
both 'sides' of the HAST devices... [if I've got that the right way round] 
- so HAST on GELI is probably the better way to go.

> It depends on your use case, configuration, hardware,
> adversaries, etc. Like most security solutions, the devil, and
> weaknesses, lay in the details, like network engineering and key
> management. Care to elaborate for us?

There's not a lot to elaborate - I want more redundancy for a home system 
with the added benefit if someone happens to steal either box - I don't 
want them getting 'easy access' to family photos, emails info etc.

> In other cases software based full disk encryption is really only going
> to thwart or inconvenience the weakest of adversaries,

Hehe - if that means the person who breaks in and steals it just scraps it 
rather than gets to go through all the data - that's fine by me :) But 
point kinda taken :-)

-Karl