News for hackers. Stuff that matters.

A comment on Self-encrypting deception: weaknesses in the encryption of solid state drives [pdf].

Re:Self-encrypting deception: weaknesses in the encryption o... by tenebrisalietum on Wednesday November 20, 2019 @11:15AM (#21585148)
Self-encrypting drives are great for liability-offload situations like fulfilling enterprise or statutory requirements as cheap as possible, but not great if you actually truly want to protect the data.

If you can't see the final data after encryption, you have no way of verifying if it was actually done or how well it was done.

Nothing short of a standard SSD platform with independently removable, externally readable/writeable, and installable firmware and flash modules would completely satisfy that requirement though. It'd be interesting to have but certainly cost prohibitive.

[ Parent | on HN ]
Re:Self-encrypting deception: weaknesses in the encryption o... by kjs3 on Thursday November 21, 2019 @03:25PM (#21599150)
Yup, and I've been telling my clients for years that it's just a checkbox exercise. No one really does key management well in the first place for self-encrypted drives, and when people started publishing things like [1], it was clear the game was up.

For circumstances where the data is genuinely sensitive, we've pushed for physical destruction of the drive. Bonus: throwing pallets of old drives into the incredibly loud shredder our destruction partners use is a lot of fun.

[1] https://www.malwaretech.com/2015/04/hard-disk-firmware-hacki...

[ Parent | on HN ]