DragonFlyBSD Revolutionizes Disk Security with Cutting-Edge Encryption Upgrade

At a glance:

• DragonFlyBSD has added a next-generation disk encryption module.
• dm-crypt-ng replaces the old asynchronous crypto path with a simpler synchronous design.
• The rewrite targets better responsiveness without giving up security.
• Other BSD and open-source systems may take note.
• Details come from the DragonFlyBSD commit log and Phoronix coverage.

Next-generation dm-crypt lands

DragonFlyBSD, the BSD fork known for its own take on operating system design, has landed a new disk encryption implementation called dm-crypt-ng. It reworks how the system’s dm-crypt target talks to the crypto code. The goal is smoother performance under load with the same strong protection. Disk encryption is basic hygiene now. DragonFlyBSD’s rewrite brings its implementation up to date.

Inside dm-crypt-ng

What is dm-crypt-ng?

dm-crypt-ng is DragonFlyBSD’s new dm_target_crypt implementation. The “ng” stands for “next generation.” Instead of the older asynchronous opencrypto/cryptodev path, it uses a synchronous crypto API with separate pools of CPU-bound worker threads for reads and writes, which improves responsiveness while keeping data protected.

Main features

Advanced Encryption Standards: At launch the new module supports AES-CBC and AES-XTS, the common choices for disk encryption.

Optimized Performance: Splitting the work into read and write worker pools cuts down on the bottlenecks that heavy cryptographic work usually causes. Early benchmarks showed performance comparable to the old code, with better responsiveness.

Cleaner Security Design: A simpler code path means less to go wrong, and data on the disk stays encrypted at rest.

Why encryption code matters

The update comes as data breaches keep making the news, and disk encryption is one of the last lines of defense when a laptop or server is lost or stolen. A cleaner, faster implementation makes it easier for DragonFlyBSD users to keep encryption turned on.

Systems engineers often point out that encryption only protects people if they actually use it, which means it has to be fast enough that nobody is tempted to switch it off. That is the trade-off this rewrite targets.

What changes for users and other projects

For users

For users, the change should be mostly invisible: encrypted volumes keep working, with less slowdown under heavy disk activity.

Across the ecosystem

Other open-source operating systems maintain their own encryption layers, and DragonFlyBSD’s rewrite is a reminder that legacy security code needs regular attention.

From option to default

The new module started as an optional “ng” target in April 2025. In late July 2025 it became the default: the legacy module was removed and dm_target_crypt_ng was renamed dm_target_crypt, so systems that set dm_target_crypt_ng_load=YES in loader.conf should switch to dm_target_crypt_load=YES.

For DragonFlyBSD’s small developer community, this kind of steady modernization is how the system keeps up with bigger rivals.

A solid upgrade

dm-crypt-ng is a solid upgrade, not a revolution. It modernizes one of DragonFlyBSD’s most important security components, keeps strong encryption in place and makes it cheaper to run. For anyone who relies on encrypted disks on DragonFlyBSD, that is good news.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.