Crypto accelerator

[Qed]

Background
I have two HP N54L and FreeNAS works fantastically on these. They are able to saturate 1Gbps connection, low power and the form factor is very convenient.

Recently, I had a drive failure and I was going to RMA it. Then I realized that the information was not encrypted: there is a good chance that my date is still readable (even if partially) and the support center might be able to access it. I don't have anything highly confidential, but I ended up not RMAing the drive for that reason.

Question
Pool encryption seems to be the solution of my problem, but the CPU on these boxes does not support AES-NI and it only outputs about 50MB/sec when geli is enabled. Of course buying two completely new machines with an AES-NI capable CPU would fix it. However, it would not be cost effective.
I noticed that FreeBDS supports Crypto Accelerators, I was wondering if that is the case and if anybody tried these with geli. I could not find much information.

 

[Ericloewe]

there is a good chance that my date is still readable (even if partially) and the support center might be able to access it.

Not really. At most random bits of files, possibly entire tiny files. We're talking "intelligence agency piecing together a shredded document" levels of commitment here, and you're probably not that interesting (no offense).

However, it would not be cost effective.
I noticed that FreeBDS supports Crypto Accelerators, I was wondering if that is the case and if anybody tried these with geli. I could not find much information.

I'm afraid new CPUs are the way forward here. The alternatives are more expensive, if you can even get them to work.

 

[Qed]

Thanks for the quick reply Ericloewe! Considering that I use lz4 and the data is scattered across 4 drives, I guess I am worrying too much.

I will look into a new build.

 

[Constantin]

I find that even when a drive starts throwing SMART errors that I can usually still zero it out once I remove it from my FreeNAS or RAID enclosure and stick it in a plug-in dock. Key being to remove the drive and request an RMA at the first hint that the drive is preparing itself for failure. That won't always work but you can set up weekly emails and other triggers that can alert you to issues before they destroy a drive,

However, SMART Is not an end-all solution, plenty of folk have experienced complete out-of-the-blue drive failures. But your situation is precisely why I opted for pool encryption. As @Ericloewe pointed out, even if the pool is not encrypted, when stuff gets written across multiple drives, there will be little to retrieve in general from an individual drive. I just prefer the little bit of added security of the pool being encrypted.