Paul Schnackenburg22 August 2006, 2:23 AM
We benchmarked Vista's full-disk encryption with surprising results: the speed drop was very minimal even on a system with an old Pentium 4 2GHz CPU. This could actually be useful, even for personal laptops.
Physical theft of hard drives is a rising problem, both in servers sitting in less-fortified branch offices and in the growing number of corporate laptops that may be lost or stolen.
Microsoft's answer is full-disk encryption in Vista and Longhorn Server, dubbed "BitLocker". The software giant believes IT managers will be prepared to pay good money for this protection.
It's certainly a substantial improvement over the Encrypting File System in Windows Server 2000 and 2003, which only encrypts data files and not the whole drive. BitLocker's full disk encryption makes it impossible to access any data on a drive even if it is taken out and installed in another PC.
But will BitLocker run fast enough to justify the added security, or will it be such a CPU drain that IT managers will think twice before deploying it onto busy servers?
That's what we set out to establish. But first, why you might consider using BitLocker, and how tricky is it to set up?
Configuring BitLocker
There are two ways to configure BitLocker, either using a Trusted Platform Module (TPM) chip on your motherboard (rare today but expected to be commonplace in the next few years) or storing the key on a USB flash drive.
You also need two partitions on your hard drive; the second (smaller, about 1.5 GB) must be set as “active”. At the moment (beta 2 Vista and Longhorn server) BitLocker is a beast to configure, you have to setup the partitions when you install the OS; you can’t do it afterwards. And you have to use the command line tool Diskpart to do it.
This messy configuration will hopefully be remedied in newer releases.
Configuring BitLocker it is done in the Control Panel. If you haven’t followed the steps for configuring the partitions during installation all you’ll see is your second partition listed with an “off” next to it. With the right configuration however “Turn on bitlocker” appears and you can proceed through the wizard.
If you don’t have a TPM chip have your USB key ready.
The wizard creates a recovery password for you; and a startup key (stored on the USB key).
The actual encryption took about 40 minutes on our test PC which had 6.3 GB on C:.
If the PC is part of a domain Group Policy can be used to allow or disallow BitLocker. Your BIOS needs to be fairly new if you’re using the USB Key option as Longhorn needs to be able to access it as a drive before the OS starts. If this isn’t the case BitLocker will enter into recovery mode and you’ll have to type the recovery key in manually.
The benchmark results
Our test machine was an ageing “server” with a Pentium 4 2GHz with 512 MB memory and a 20 GB PATA 5400 RPM hard drive, running Windows Longhorn Server beta 2. Before enabling BitLocker the hard drive clocked in at 33 MB/s with a 10 ms random access time in the filesystem benchmark in Sisoftware Sandra Lite 2007 SP1.
After BitLocker had encrypted the entire drive the result was 29 MB/s with a 5 ms random access time.
So, although setup today was a real pain, the 12% penalty in disk speed could well be worth it for laptops and sensitive servers.
Of course, performance could actually improve from these figures -- this is still beta software.
LINKS
RELATED ARTICLES