Re:Why Amazon S3 server side encryption (SSE-S3) is misleading
by throwaway320498 on Monday January 16, 2023 @02:35PM
(#34404587)
Not this. A customer's bytes are likely spread across millions of hard drives. At the filesystem layer, the region of the disk those bytes occupied still need to be reclaimed.
What you're describing makes sense for a service like EBS where a single customer's bytes are limited to small number of disks in well-defined locations.
Re:Why Amazon S3 server side encryption (SSE-S3) is misleading
by hdjjhhvvhga on Monday January 16, 2023 @03:22PM
(#34405049)
One problem with utilizing unencrypted drives is that if there's a hardware failure, it's more expensive to dispose of them. Normally Amazon overwrites the data, degausses the drive and then destroys it, but if, say, the electronics is faulty, the first step becomes more difficult.
Re:Why Amazon S3 server side encryption (SSE-S3) is misleading
by gregw2 on Monday January 16, 2023 @03:38PM
(#34405193)
My speculation is that they now have nitro encryption on all or enough of the servers supporting s3 so it’s now no marginal cost for them anymore since it’s inline ASIC encryption and not taking incremental CPU cycles anymore.
Re:Why Amazon S3 server side encryption (SSE-S3) is misleading
by severino on Monday January 16, 2023 @04:00PM
(#34405409)
This also implies that if the encryption key is that easy to dispose of, then it's also easy to somehow lose or screw it turning your valuable client data into a random stream of bytes, doesn't it?
Re:Why Amazon S3 server side encryption (SSE-S3) is misleading
by advisedwang on Monday January 16, 2023 @04:23PM
(#34405671)
They can dispose of it in the same way that they dispose of the actual core data (ie write over it X times, and ensure when disk is EOL that it's shredded). With cryptographic erasure you can do exactly the same erasure process on fewer bytes and get the same effective results.
[1] https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...