2 ms·

So, how do you check if your data is encrypted? Open the hard drive and look at the platters? I'm sorry, I am not convinced. I would much rather run software t

by jwr 18y ago

So, how do you check if your data is encrypted? Open the hard drive and look at the platters? I'm sorry, I am not convinced. I would much rather run software than I can a) audit and b) check the output of.

tptacek 18y ago
(1) I think all your questions are answered at the Opal spec site: http://tinyurl.com/aulrpj http://tinyurl.com/aulrpj (2) If you think that hardware-level analysis is out of scope for assessing a corporate full disk encryption system, you're out of step with the security industry; hobbyists do hardware analysis in their spare time. There are obviously likely to be much simpler way to verify encrypted storage than "looking at the platters". (3) Like I said originally, if you're religious about open source, more power to you. It's obvious that there's little I can say to make you happy with the TCG. But, and I mean no offense, from what little I know of you it seems like they know much more about this topic than you do.
- jwr 18y ago
  As to (2), my point was that I have no way of doing it. As to (3), I am not "religious about open source". My point was that at the very least I would like to be able to verify what the output is, which I can't. Your arguments about companies' reputations being on the line are something I don't buy. This is hacker news, I buy technical arguments. And if you believe "reputable companies" don't do strange things with your keys or our data, may I kindly remind you of http://en.wikipedia.org/wiki/NSAKEY http://en.wikipedia.org/wiki/NSAKEY Regarding (1), thanks for the reference, I will certainly learn more about the technology involved.
  - tptacek 18y ago
    I don't think it's really reasonable to rule out hardware security simply because jwr from Hacker News isn't capable of assessing it, but I don't blame you for not using it.
    - jwr 18y ago
      It isn't just me, Bruce Schneier doesn't trust the vendors either, and for good reasons: http://www.schneier.com/blog/archives/2009/02/the_doghouse_ra.html http://www.schneier.com/blog/archives/2009/02/the_doghouse_r... (yes, I know this is about a hardware enclosure, not about a drive, that's actually lucky because someone could _check_ if the bytes are actually encrypted) Now let's hear you mock Bruce :-)

by jwr 18y ago

tptacek 18y ago

(1) I think all your questions are answered at the Opal spec site: http://tinyurl.com/aulrpj http://tinyurl.com/aulrpj (2) If you think that hardware-level analysis is out of scope for assessing a corporate full disk encryption system, you're out of step with the security industry; hobbyists do hardware analysis in their spare time. There are obviously likely to be much simpler way to verify encrypted storage than "looking at the platters". (3) Like I said originally, if you're religious about open source, more power to you. It's obvious that there's little I can say to make you happy with the TCG. But, and I mean no offense, from what little I know of you it seems like they know much more about this topic than you do.

jwr 18y ago
As to (2), my point was that I have no way of doing it. As to (3), I am not "religious about open source". My point was that at the very least I would like to be able to verify what the output is, which I can't. Your arguments about companies' reputations being on the line are something I don't buy. This is hacker news, I buy technical arguments. And if you believe "reputable companies" don't do strange things with your keys or our data, may I kindly remind you of http://en.wikipedia.org/wiki/NSAKEY http://en.wikipedia.org/wiki/NSAKEY Regarding (1), thanks for the reference, I will certainly learn more about the technology involved.
- tptacek 18y ago
  I don't think it's really reasonable to rule out hardware security simply because jwr from Hacker News isn't capable of assessing it, but I don't blame you for not using it.
  - jwr 18y ago
    It isn't just me, Bruce Schneier doesn't trust the vendors either, and for good reasons: http://www.schneier.com/blog/archives/2009/02/the_doghouse_ra.html http://www.schneier.com/blog/archives/2009/02/the_doghouse_r... (yes, I know this is about a hardware enclosure, not about a drive, that's actually lucky because someone could _check_ if the bytes are actually encrypted) Now let's hear you mock Bruce :-)