News for hackers. Stuff that matters.
Re:When Full-Disk Encryption Goes Wrong by grillvogel on Friday May 20, 2016 @01:05PM (#11739521)
this is why you use actual FDE drives if you want FDE and not a software middleman. also what happened to the recovery key?
Re:When Full-Disk Encryption Goes Wrong by codys on Friday May 20, 2016 @01:21PM (#11739665)
Or just design the FDE to store more than one copy of the encryption key.

Drives that claim to do encryption themselves have their own issues (like not actually using the user provided key for encryption and other crypto failures from developers & companies not familiar with how crypto is supposed to work).

Re:When Full-Disk Encryption Goes Wrong by april1stislame on Friday May 20, 2016 @01:47PM (#11739917)
Good times, hot swapping a laptop HDD to clear the password...
Re:When Full-Disk Encryption Goes Wrong by chadgeidel on Friday May 20, 2016 @01:21PM (#11739666)
Honest question. What is this you are referring to? I've never heard of a "Full Disk Encryption Drive" and google isn't forthcoming.
Re:When Full-Disk Encryption Goes Wrong by jmiserez on Friday May 20, 2016 @01:43PM (#11739875)
There are HDDs and SSDs that do the encryption themself, rather than just being a dumb storage medium. You need to unlock it with the password or key when using it, and the disk will transparently encrypt and decrypt the contents on reads/writes.

One problem is that you have to trust the disk (manufacturer/firmware) to do this right. This is not so easy to verify yourself, and not all drives claiming FDE are equally secure. https://en.wikipedia.org/wiki/Hardware-based_full_disk_encry...

https://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hard...

Re:When Full-Disk Encryption Goes Wrong by cmurf on Friday May 20, 2016 @02:41PM (#11740383)
Trusted Computing Group (TCG) provides a TPM and OPAL spec. The more common term is SED (self encrypting drive) where FDE tends to be software (typically OS). FDE (full drive encryption) is probably better considered "volume encryption" since it applies to file system volumes. It's possible for other volumes and partitions on a drive to not be encrypted.

Many consumer drives are SEDs now. Check out the Samsung 840 EVO which is such a thing. It's always encrypting, it's just that out of the box it's always unlocked (i.e. it provides itself with the DEK at power on).

Re:When Full-Disk Encryption Goes Wrong by Aqua_Geek on Friday May 20, 2016 @01:25PM (#11739703)
If the encrypted plist containing the volume master key is lost or corrupted the recovery key is as useless as your password.

More details here: https://eprint.iacr.org/2012/374.pdf