4 ms·
With whole disk encryption, the disk is always encrypted. While running, the decryption key is stored in memory and used to decrypt/encrypt blocks. When communi
by ianburrell 14y ago
With whole disk encryption, the disk is always encrypted. While running, the decryption key is stored in memory and used to decrypt/encrypt blocks. When communication is cut, they are presumably purging the key from memory. The password would need to be entered to produce the key.
This means that while the system is running, the key can be read by the host. It doesn't matter is the key is later purged. Changing the key requires re-encrypting the entire disk which is a slow operation.
- chii 14y agoI guess there isn't enough detail to raelly work out what would happen - its not clear that they meant whole disk encryption in the way you described. I thought they encrypt the disk _only_ after loss of communications. The private key is not on the VM anywhere. Thus, the vm once encrypted, is useless (without the passphrase, which presumably only exist in the head of the operator of tpb).