4 ms·

> Unlike file system level encryption it encrypts all data on the disk including file metadata and even free space. Anyone have a source on how full disk aka b

> Unlike file system level encryption it encrypts all data on the disk including file metadata and even free space. Anyone have a source on how full disk aka block-level encryption encrypts free space? The only way I can imagine this could happen is by overwriting the entire disk initially with random data, so that you can't distinguish between encrypted and true "free space", i.e. on a brand new clean disk. Then, when a file (which, when written, would have been encrypted) is deleted (which by any conventional meaning of the word 'deleted' means the encrypted data is still present, but unallocated, thus indistinguishable from the random data in step 1), then gets overwritten again with random data? I would argue that overwriting an encrypted file with random data isn't really encrypting free space, but rather just overwriting the data, which already appeared random/encrypted. It is hardly any different to having a cleartext disk and overwriting deleted files with zeros, making them indistinguishable from actual free space.

dlgeek 7y ago
Debian does the first thing you discussed if you create an encrypted partition in the installer - it writes 0s through the crypto layer to fill the entire disk with encrypted data.
koala_man 7y ago
The point of encrypting free space is just so you can't say how full the drive is. This way, an attacker can't focus cracking on the fullest disk, match stolen backup disks to hosts based on non-sensitive health metrics, etc. >The only way I can imagine this could happen is by overwriting the entire disk initially with random data Traditionally, for speed, you'd write all zeroes to the encrypted volume (causing the physical volume to appear random), but yes >Then, when a file (which, when written, would have been encrypted) is deleted You'd just leave it. Crucially, you don't TRIM it. >I would argue that overwriting an encrypted file with random data isn't really encrypting free space Yup, that's why it's not done

dlgeek 7y ago

Debian does the first thing you discussed if you create an encrypted partition in the installer - it writes 0s through the crypto layer to fill the entire disk with encrypted data.

koala_man 7y ago

The point of encrypting free space is just so you can't say how full the drive is. This way, an attacker can't focus cracking on the fullest disk, match stolen backup disks to hosts based on non-sensitive health metrics, etc. >The only way I can imagine this could happen is by overwriting the entire disk initially with random data Traditionally, for speed, you'd write all zeroes to the encrypted volume (causing the physical volume to appear random), but yes >Then, when a file (which, when written, would have been encrypted) is deleted You'd just leave it. Crucially, you don't TRIM it. >I would argue that overwriting an encrypted file with random data isn't really encrypting free space Yup, that's why it's not done