3 ms·
As the other users said if you're using one the drives listed at https://www.kingston.com/en/usb/encrypted_security https://www.kingston.com/en/usb/encrypted_se
by g-b-r 9y ago
As the other users said if you're using one the drives listed at https://www.kingston.com/en/usb/encrypted_security https://www.kingston.com/en/usb/encrypted_security they seem to be just "encrypted drives", without any support for internal signing operations.
If that's so you're doing all the key operations on the computers at which they're connected, and you've come up with an extremely cumbersome process that gives you very little protection.
Adding to the insult, there actually exist many cheap USB proper cryptographic tokens, that really do all the operations internally and have even FIPS 140 level 3 certifications. They are just slower and have less physical protection, features and storage than "proper" thousands-dollars HSMs.
Note that the FIPS certification of those Kingston drives means just that the key with which the data is encrypted cannot (easily) be extracted.
- g-b-r 9y agoI stumbled again at this post; "the key cannot be extracted"??? Why on earth would a portable drive need to store the decryption key for its data, however protected?? Actually I've never looked before into "encrypted drives" and I don't know what do they do or what purpose exactly do they serve, I must have written that thinking about HSMs and other signing devices. It does seem indeed that at least those Kingston drives do not store the encryption key (actually, they store it but encrypted with the password). I'm not sure what purpose do the FIPS certification and all those physical protections serve, then.