Re:Restic – Backups Done Right
by pfranz on Thursday October 31, 2019 @01:49PM
(#21411610)
I'm no encryption expert, but depending on how the data is partitioned it can be easier to securely prune encrypted data than unencrypted data. For example, securely wiping an encrypted drive is as easy as tossing the key.
[ Parent
| on HN ]
Re:Restic – Backups Done Right
by tyri_kai_psomi on Thursday October 31, 2019 @01:55PM
(#21411689)
If you wish to "securely" wipe an encrypted drive, it's best to write over the old data a few times using randomly generated keys, tossing the keys each time you do a write over.
That sounds pointless. If you have real crypto, tossing the key (in a way that it cannot be recovered) is absolutely enough.
It's not pointless - it's pretty standard practice.
For example, although drives in Google Cloud are encrypted at rest, once they are decommissioned the drives are physically destroyed: https://cloud.google.com/security/deletion/#ensuring_safe_an...
> When a hard drive is retired, authorized individuals verify that the disk is erased by overwriting the drive with zeros and performing a multi-step verification process to ensure the drive contains no data.
Thanks. I guess the reason is to avoid future decryption due to either a new crypto attack or to avoid being vulnerable to potential errors in key generation.
Re:Restic – Backups Done Right
by LeoPanthera on Thursday October 31, 2019 @02:27PM
(#21412024)
This is massive overkill. Once is enough. If the drive is already encrypted, just wipe the key.