3 ms·

Throwing away the keys is surprisingly hard to do. Say you have one root key and you derive per-file or per-block keys using various metadata (inode numbers, g

Throwing away the keys is surprisingly hard to do. Say you have one root key and you derive per-file or per-block keys using various metadata (inode numbers, generation numbers, block addresses, whatever). You can't throw away derived keys though! Or say you generate random keys per-file and you store those somewhere (it's annoying to have to store them). Now to throw those keys away you need to re-write the blocks containing them. If there's any behind-the-scenes copy-on-write going on then re-writing a block doesn't necessarily lose its old contents. The only thing that's easy to throw away -maybe- is the top-level / root keys. But that means deleting the entire filesystem.

generalizations 4y ago
> The only thing that's easy to throw away -maybe- is the top-level / root keys. But that means deleting the entire filesystem. Well, yeah, that's why I said you encrypt the entire drive. If you do things that make it hard to throw your keys away, then it's gonna be hard to throw your keys away.
Nursie 4y ago
> You can't throw away derived keys though! You can, AES-XTS does just this. Per-block keys can be derived on the fly from the root key and the block address. When the root key is gone, everything is gone.
- cryptonector 4y ago
  Right, but clearly I meant that you can't arrange to delete individual files and lose their derived keys. The reason is that the bits you need to derive the keys may still be somewhere on disk, and one could -having access to the root keys- find them and "undelete" and re-derive the keys and recover the file contents. Having to wipe an entire filesystem to securely delete a file is not useful.