4 ms·

this is why you use actual FDE drives if you want FDE and not a software middleman. also what happened to the recovery key?

codys 10y ago
Or just design the FDE to store more than one copy of the encryption key. Drives that claim to do encryption themselves have their own issues (like not actually using the user provided key for encryption and other crypto failures from developers & companies not familiar with how crypto is supposed to work).
- april1stislame 10y ago
  Good times, hot swapping a laptop HDD to clear the password...
chadgeidel 10y ago
Honest question. What is this you are referring to? I've never heard of a "Full Disk Encryption Drive" and google isn't forthcoming.
- jmiserez 10y ago
  There are HDDs and SSDs that do the encryption themself, rather than just being a dumb storage medium. You need to unlock it with the password or key when using it, and the disk will transparently encrypt and decrypt the contents on reads/writes. One problem is that you have to trust the disk (manufacturer/firmware) to do this right. This is not so easy to verify yourself, and not all drives claiming FDE are equally secure. https://en.wikipedia.org/wiki/Hardware-based_full_disk_encryption https://en.wikipedia.org/wiki/Hardware-based_full_disk_encry... https://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hardware-based-full-disk-encryption/ https://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hard...
- cmurf 10y ago
  Trusted Computing Group (TCG) provides a TPM and OPAL spec. The more common term is SED (self encrypting drive) where FDE tends to be software (typically OS). FDE (full drive encryption) is probably better considered "volume encryption" since it applies to file system volumes. It's possible for other volumes and partitions on a drive to not be encrypted. Many consumer drives are SEDs now. Check out the Samsung 840 EVO which is such a thing. It's always encrypting, it's just that out of the box it's always unlocked (i.e. it provides itself with the DEK at power on).
Aqua_Geek 10y ago
If the encrypted plist containing the volume master key is lost or corrupted the recovery key is as useless as your password. More details here: https://eprint.iacr.org/2012/374.pdf https://eprint.iacr.org/2012/374.pdf

codys 10y ago

Or just design the FDE to store more than one copy of the encryption key. Drives that claim to do encryption themselves have their own issues (like not actually using the user provided key for encryption and other crypto failures from developers & companies not familiar with how crypto is supposed to work).

april1stislame 10y ago
Good times, hot swapping a laptop HDD to clear the password...

chadgeidel 10y ago

Honest question. What is this you are referring to? I've never heard of a "Full Disk Encryption Drive" and google isn't forthcoming.

jmiserez 10y ago
There are HDDs and SSDs that do the encryption themself, rather than just being a dumb storage medium. You need to unlock it with the password or key when using it, and the disk will transparently encrypt and decrypt the contents on reads/writes. One problem is that you have to trust the disk (manufacturer/firmware) to do this right. This is not so easy to verify yourself, and not all drives claiming FDE are equally secure. https://en.wikipedia.org/wiki/Hardware-based_full_disk_encryption https://en.wikipedia.org/wiki/Hardware-based_full_disk_encry... https://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hardware-based-full-disk-encryption/ https://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hard...
cmurf 10y ago
Trusted Computing Group (TCG) provides a TPM and OPAL spec. The more common term is SED (self encrypting drive) where FDE tends to be software (typically OS). FDE (full drive encryption) is probably better considered "volume encryption" since it applies to file system volumes. It's possible for other volumes and partitions on a drive to not be encrypted. Many consumer drives are SEDs now. Check out the Samsung 840 EVO which is such a thing. It's always encrypting, it's just that out of the box it's always unlocked (i.e. it provides itself with the DEK at power on).

Aqua_Geek 10y ago

If the encrypted plist containing the volume master key is lost or corrupted the recovery key is as useless as your password. More details here: https://eprint.iacr.org/2012/374.pdf https://eprint.iacr.org/2012/374.pdf