Great summary. Ill also note FDE also lets you quickly erase a drive by zeroing out a key. That can either eliminate the need during disposal for HD overwriting

Great summary. Ill also note FDE also lets you quickly erase a drive by zeroing out a key. That can either eliminate the need during disposal for HD overwriting and/or destruction. It can also help in situations where an attack is incoming and they want to avoid durress. That's why so-called Inline, Media Encryptors and Enclosures with Zeroize buttons were used in Defense sector a lot. Example I modeled some designs on was ViaSat's that NSA recommended: https://www.viasat.com/products/encryption-kg-200r https://www.viasat.com/products/encryption-kg-200r Also has 2FA, a trusted path for PIN's, and emanation shielding. Being Type 1 means they focused hard on the RNG, algorithm implementations, firmware/protocol code, and error-handling code. Typical for high-assurance crypto. Just one of a few internal and external enclosures that do the job right due to security regulation for certain products. We can't buy them of course since they actually work and NSA uses them. Then, unregulated vendors in private market are doing least they can for actual quality/security, doing most they can on marketing it, and making a killing with no or limited liability for preventable defects. Typical. I still maintain pretty much all of them are insecure and/or negligent until proven otherwise. The high-assurance community selling to defense shows they couldve built better designs 10-20 years ago if they just followed standards, had a specialist for crypto, and hired some experienced breakers to check it. Peanuts for these big, companies' profits. Useful in protecting the IP that generates those profits, too. They still do this shit... Always will without better incentives and/or regulation...