_wmd explains pretty well why FDE with authentication is technically challenging. To be clear, the reason unauthenticated encryption is considered reasonable h

_wmd explains pretty well why FDE with authentication is technically challenging. To be clear, the reason unauthenticated encryption is considered reasonable here is because the threat model is: Someone steals your laptop, you don't expect you'll ever get it back, but you don't want them to be able to extract any data. On the other hand, if your threat model were "Someone secretly grabs your laptop when you're not looking, pulls out the hard drive, flips some bits, then puts it back, without you ever noticing.", then FDE can't protect you. For a laptop or phone, the latter case seems reasonably implausible and so FDE is worthwhile. OTOH, for cloud storage use cases where you don't necessarily trust the storage machines, FDE as-is is basically worthless.