NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

MGBear's avatar
MGBear
Aspirant
Feb 19, 2014

RN104: 50 % performance hit for encrypting?

In trying to decide whether to encrypt my drives on my new RN104 I came across this Facebook entry, purportedly from someone with Netgear:

<<< ReadyNAS Niklas, there is a read/write performance overhead for enabling volume encryption. The encryption overhead is minimized on the ReadyNAS 104 as we take advantage of the HW accelerators available in the CPU, but you still might see 50% performance hit. We only use AES-256 encryption. There is no option for lesser encryption levels. The performance hit will depend on RAID type and file type/size. For more detailed discussion, I suggest you post this question in the readynas.com forums for some additional input. 1 · December 30, 2013 at 4:51pm >>>>

Does this sound right? If so, it makes my decision for me.
Thanks

7 Replies

Replies have been turned off for this discussion
  • I wouldn't encrypt with the RN104.
    It's CPU is already too weak to provide full disk speed, it doesn't even keep up with a single Gbit card. Activating encryption will sure slow it down, I don't know by how much though (but will definitely be a two digit number, 50% seems a little too much if you ask me but 30% to 40% would seem plausible to me, although I've never tested so can't know for sure). Even anti-virus is slowing it down easily, so if you wanna go Encryption + anti-virus expect really poor performance.
    What you can do is use truecrypt (or equivalent) on top of the NAS. The computer will do the heavy lifting and the NAS will operate at normal speed for non-encrypted files. It could affect Snapshots and virus scan though since you would have only a big encrypted file but if you have sensitive data that are not updated frequently or that don't take to much space you can give it a try.

    So I can't tell you what impact it will have on the speed but I can tell you it won't help to speed things up anyhow, I would secure the NAS without encryption and use a computer to cypher anything needed. Drive encryption is useful mostly when drives are stolen which is the case with laptops, phones or that kind of devices. If you do a good job securing physical access to the NAS there should be no need for this.
    More over using true crypt will ensure 2 authentication (one for the NAS, and one for the file) whereas drive encryption will not help if someone bypasses samba/AFP authentication.
  • That was I that asked the fb-question and I chose to encrypt. I'm more concerned about security then by speed. Using WiFi anyway so no gigabit speeds. Getting 3-5mb writes/reads over WiFi. And my Sony bravia w905 streams HD movies over WiFi dlna without hiccups.

    Sent from my RM-821_eu_sweden_235 using Tapatalk
  • Security is structured with four key points, confidentiality, integrity, availability and proof.
    If you are concerned about security, wifi is off limit by design (availability is affected by signal strength, integrity by signal loss/interferences and confidentiality by weak wireless security) unless you use 802.1x with radius/SSL which is considered almost as secure as wired network but you are still transmitting outside the walls. The chances are your wifi will be hacked way before someone steals your NAS. So telling encryption will actually enhance security is a myth except for mobile or already highly secured devices of course. I'm not even speaking about sniffing / spoofing problems that would say samba / AFP / NFS are not secured at all.
    If you are going to encrypt, you are also going to store data on at least two places with at least 100km between them, enabling MD5 checksum and centralizing logs to see what's going on, enabling virus scan and snapshots...
    By default ReadyNAS is not protected against brute force attacks nor DDos Attacks, it doesn't even have a firewall.
    If you are sharing files over internet using a standard FTP, then all the security you can get will not be enough since FTP sends login / password in clear text.
    You'll also want to change admin account name, change login/pass of each app you download to the NAS...

    What I mean is that if you are going to be paranoid about security, drive encryption is not the first thing to think of (unless it's on mobile devices). It's a good feature but it's one of the last in the security chain since the attacker will need physical access to the device. So unless you are moving your NAS to LAN or something like that (which is not recommended), buy a good lock, this will be nearly as good as drive encryption IMO.
  • StephenB's avatar
    StephenB
    Guru - Experienced User
    A couple of years ago my daughter's apartment was broken into, and the thieves took the all the hard drives. The computers were left behind, so the goal was definitely identify theft. Encrypted drive technology would have helped in that scenario.

    I'm not disagreeing with your comments generally, just pointing out that drive encryption has value beyond just mobile devices.

    In the case of the NAS, something like truecrypt has some advantages over the built-in encryption, as physical access to the NAS is not enough to get data off the device.
  • Thanks for the replies.
    I should have indicated in my original post that my only reason for considering drive encryption was in the event of a drive failure under warranty, I wanted to be able to send the drive back to the manufacturer without any concern about personal data (finances, PIM files, etc) recoverable on the drive. I think the best approach might be as suggested to use an encrypted container (TruCrypt, Steganos Safe, etc) for the sensitive data and leave the disk itself unencrypted.
    Thanks for the fish...
  • MGBear wrote:
    I should have indicated in my original post that my only reason for considering drive encryption was in the event of a drive failure under warranty, I wanted to be able to send the drive back to the manufacturer without any concern about personal data (finances, PIM files, etc) recoverable on the drive.

    Seagate's "Media Sanitization Practices During Product Return Process" document:
    https://www.seagate.com/files/www-content/support-content/warranty/_shared/masters/SeagateMediaSanitizationPractices%2005-Oct-2011%20FINAL.pdf

    The other manufacturers have similar policies.

    Plus, all modern drives support Secure Erase. Unless the drive fails catastrophically, Secure Erase will wipe it well enough to protect the sort of data you're concerned about.
  • Do not use volume encryption with the ReadyNAS 100 series if you still want a reasonable transfer speed!

    The transfer speed on my RN104 and RN102 drops from 58MB/s to 11MB/s with encrypted volumes, on a 1GB/s LAN. These units simply don't have the processor capacity for encryption. In my opinion, the encryption should not be offered on the 100 series, but NetGear told me that they want to develop firmaware that can be used on all ReadyNAS series. NetGear support spent about 10 hours on support to find that the main cause for my speed issues is because of the encryption. Support was friendly and professional, but my problem is not solved. The supplier doesn't want to take back the systems, because they are not 'broken'. So I'm stucked now with 2 NAS units with an terrible barred transfer speed. Encryption is mandatory for me. NetGear should have warned me for this, as I called them before I purchased the systems with these specific questions: is realtime encryption possible with the RN104 and RN102, and can I do a complete remote replication between the units? They told me clearly: no problem at all with the latest firmware.

    I am really disappointed in NetGear.

NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology! 

Join Us!

ProSupport for Business

Comprehensive support plans for maximum network uptime and business peace of mind.

 

Learn More