5 ms·

Even last generation tape drives have hardware encryption built in. And it doesn't make sense to me that they would encrypt, then compress. That would completel

Even last generation tape drives have hardware encryption built in. And it doesn't make sense to me that they would encrypt, then compress. That would completely invalidate the compression for absolutely no benefit.

count 3y ago
The benefit being they can sell more tapes...
londons_explore 3y ago
Nobody trusts encryption built into tape drives for the same reason nobody trusts encryption built into hard drives. Even things like Windows Bitlocker and LUKS/dmcrypt on Linux totally ignore the drives ability to do any encryption, and do all encryption using the CPU before the drive sees the data. Bitlocker/LUKS could easily just calculate the encryption keys and send them to the drive and trust it to encrypt/decrypt data for them... but they don't.
- MichaelZuo 3y ago
  > Nobody trusts encryption built into tape drives for the same reason nobody trusts encryption built into hard drives. Source? Last I heard many companies rely on the encryption supplied by tape drive systems.
  - adrian_b 3y ago
    It would be more accurately to say that all those who understand how encryption works (which excludes most people in managerial positions, even if they have the power to decide what kind of encryption is used in their companies) cannot trust any kind of encryption embedded in a hardware device whenever it has to be used for protecting really important data. The reason is that all encryption is based on the separation of place between the encrypted data and the encryption key. Whoever can access the encrypted data must not have any way to access the encryption key. Whenever you give your encryption key to a hardware device, or worse, when the hardware device also generates itself the encryption key, it becomes impossible to ensure that the attacker will not be able to access the encryption key. It is impossible to know how the encryption keys are stored inside a hardware device and how and when they are erased and how easy or how difficult it will be in the future for an attacker to retrieve them. It is impossible to believe any marketing claim of the vendor of a hardware encryption device about how tamper-resistant the device is, because such claims have very frequently been proven to be lies (even when the claims come from the largest companies, e.g. Microsoft and many others like it) and it is too difficult to distinguish truth from lies in such cases. The only reliable means of encryption are in software, under complete end user control (or equivalently, in a custom FPGA).
    - MichaelZuo 3y ago
      So can you link to a source?
      - throwanma 3y ago
        At some point, knowledge comes from experience, ^ he is my source.
        MichaelZuo 3y ago
        It appears adrian_b is a pseudonym, not even linked to a real identity, how can that be a source?
    - wizofaus 3y ago
      Surely if the device automatically decrypts data as you read from it without having to supply a key or passcode of some sort then you're not protecting it against anything! It may automatically manage/store the actual keys used to encrypt the data, but there must be some mechanism to ensure decryption is not permitted until you supply some external form of credential (which ideally is cryptographically required to access the keys - if not then obviously there's a risk the device's controller code could be reverse engineered to bypass the credential check).
- Karunamon 3y ago
  Considering that industry standard software like backup exec has built-in support for hardware encryption (which is actually part of the LTO standard), I would need to see a source for "nobody trusts encryption built into tape drives"
jandrese 3y ago
Using the encryption provided by the drive seems like a terrible idea. What happens in 10 years when you want to retrieve the data and that company has gone out of business?
- throw0101c 3y ago
  As I understand it (AIUI) the encryption is in the standard: * https://www.lto.org/encryption/ https://www.lto.org/encryption/
- Karunamon 3y ago
  It's functionality exposed by the drive as part of the tape standard, not something unique to vendor of the drive. Any LTO-aware software given the same key would be able to decrypt the data using any drive that can read that generation of tape. That's probably one of the items on the list of reasons there are so few vendors in the space, LTO drives are essentially fungible and don't do anything interesting across vendors.

count 3y ago

The benefit being they can sell more tapes...

londons_explore 3y ago

Nobody trusts encryption built into tape drives for the same reason nobody trusts encryption built into hard drives. Even things like Windows Bitlocker and LUKS/dmcrypt on Linux totally ignore the drives ability to do any encryption, and do all encryption using the CPU before the drive sees the data. Bitlocker/LUKS could easily just calculate the encryption keys and send them to the drive and trust it to encrypt/decrypt data for them... but they don't.

MichaelZuo 3y ago
> Nobody trusts encryption built into tape drives for the same reason nobody trusts encryption built into hard drives. Source? Last I heard many companies rely on the encryption supplied by tape drive systems.
- adrian_b 3y ago
  It would be more accurately to say that all those who understand how encryption works (which excludes most people in managerial positions, even if they have the power to decide what kind of encryption is used in their companies) cannot trust any kind of encryption embedded in a hardware device whenever it has to be used for protecting really important data. The reason is that all encryption is based on the separation of place between the encrypted data and the encryption key. Whoever can access the encrypted data must not have any way to access the encryption key. Whenever you give your encryption key to a hardware device, or worse, when the hardware device also generates itself the encryption key, it becomes impossible to ensure that the attacker will not be able to access the encryption key. It is impossible to know how the encryption keys are stored inside a hardware device and how and when they are erased and how easy or how difficult it will be in the future for an attacker to retrieve them. It is impossible to believe any marketing claim of the vendor of a hardware encryption device about how tamper-resistant the device is, because such claims have very frequently been proven to be lies (even when the claims come from the largest companies, e.g. Microsoft and many others like it) and it is too difficult to distinguish truth from lies in such cases. The only reliable means of encryption are in software, under complete end user control (or equivalently, in a custom FPGA).
  - MichaelZuo 3y ago
    So can you link to a source?
    - throwanma 3y ago
      At some point, knowledge comes from experience, ^ he is my source.
      - MichaelZuo 3y ago
        It appears adrian_b is a pseudonym, not even linked to a real identity, how can that be a source?
  - wizofaus 3y ago
    Surely if the device automatically decrypts data as you read from it without having to supply a key or passcode of some sort then you're not protecting it against anything! It may automatically manage/store the actual keys used to encrypt the data, but there must be some mechanism to ensure decryption is not permitted until you supply some external form of credential (which ideally is cryptographically required to access the keys - if not then obviously there's a risk the device's controller code could be reverse engineered to bypass the credential check).
Karunamon 3y ago
Considering that industry standard software like backup exec has built-in support for hardware encryption (which is actually part of the LTO standard), I would need to see a source for "nobody trusts encryption built into tape drives"

jandrese 3y ago

Using the encryption provided by the drive seems like a terrible idea. What happens in 10 years when you want to retrieve the data and that company has gone out of business?

throw0101c 3y ago
As I understand it (AIUI) the encryption is in the standard: * https://www.lto.org/encryption/ https://www.lto.org/encryption/
Karunamon 3y ago
It's functionality exposed by the drive as part of the tape standard, not something unique to vendor of the drive. Any LTO-aware software given the same key would be able to decrypt the data using any drive that can read that generation of tape. That's probably one of the items on the list of reasons there are so few vendors in the space, LTO drives are essentially fungible and don't do anything interesting across vendors.