3 ms·
Encryption at rest is nice for when a device has to get retired. Without the key, the drive is indistinguishable from random noise. No longer do you need to run
by teeray 2y ago
Encryption at rest is nice for when a device has to get retired. Without the key, the drive is indistinguishable from random noise. No longer do you need to run DBAN for hours, put the drive through a degausser, or drill holes in it. No worrying about plaintext data hiding due to relocated sectors or wear-leveling. Just purge the keys and you’re done. Then the drive even has a chance at getting responsibly reused.
- aftbit 2y agoYeah though SSDs make that even easier, with the aptly named SECURE ERASE command. Modern SSDs encrypt the contents of the drive at rest _anyway_ (transparently, using a key that's baked into the hardware) as encryption algorithms are very good at removing repeated patterns that might degrade the flash over time.