3 ms·
Years ago we settled on using block device encryption for all flash storage and then destroying the headers or revoking all keys. This satisfies the infeasibil
by washadjeffmad 7y ago
Years ago we settled on using block device encryption for all flash storage and then destroying the headers or revoking all keys.
This satisfies the infeasibility requirement of NIST SP 800-88 without relying on flash vendors to have appropriately implemented ATA command standards like secure erase, which almost none fully do.
- zmix 7y agoThis destroys the filesystem, but not the physical disk, right? I mean, will the SSD be usable after that, albeit, by installing a new filesystem and reformatting?
- washadjeffmad 7y agoCorrect. It's not like when degaussing wipes the track information from a HDD. This is also as opposed to relying on the self-encrypting feature on most modern flash. Whether you're dealing with high enough asset value to warrant this level of interest or are just beholden to the same standards, you should reach out to your flash vendor for clarification.