Re:Restic – Backups Done Right
by tyri_kai_psomi on Thursday October 31, 2019 @01:55PM
(#21411689)
If you wish to "securely" wipe an encrypted drive, it's best to write over the old data a few times using randomly generated keys, tossing the keys each time you do a write over.
[ Parent
| on HN ]
That sounds pointless. If you have real crypto, tossing the key (in a way that it cannot be recovered) is absolutely enough.
It's not pointless - it's pretty standard practice.
For example, although drives in Google Cloud are encrypted at rest, once they are decommissioned the drives are physically destroyed: https://cloud.google.com/security/deletion/#ensuring_safe_an...
> When a hard drive is retired, authorized individuals verify that the disk is erased by overwriting the drive with zeros and performing a multi-step verification process to ensure the drive contains no data.
Thanks. I guess the reason is to avoid future decryption due to either a new crypto attack or to avoid being vulnerable to potential errors in key generation.
Re:Restic – Backups Done Right
by LeoPanthera on Thursday October 31, 2019 @02:27PM
(#21412024)
This is massive overkill. Once is enough. If the drive is already encrypted, just wipe the key.