Questions tagged [disk-encryption]
Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).
620 questions
0 votes
2 answers
144 views
How do embedded systems protect encryption keys when no user authentication is possible at startup?
Embedded and IoT systems power on autonomously, without user input (unlike PCs or phones requiring a PIN/password). If the manufacturer wants to encrypt the flash storage: Must the decryption key be ...
- 537
2 votes
1 answer
166 views
Why does BitLocker keep the Volume Master Key (VMK) in plaintext RAM instead of inside a TEE?
I have two related questions about BitLocker’s key handling: 1) After the system boots and BitLocker unlocks the drive, TPM releases the Volume Master Key (VMK) and from now on it is resident in ...
- 537
1 vote
2 answers
172 views
Does a signed TPM2 PCR policy verify the EFI code similarly to secure boot?
For context, my question relates to the use of the systemd-cryptenroll and the related TPM enrollment options where one set of options "configures a TPM2 signed PCR policy to bind encryption to.&...
- 109
4 votes
3 answers
565 views
Erasing then encrypting external HDD using Disk Utility on Mac
Does erasing and then encrypting a previously unencrypted HDD secure all data previously written to it?
- 41
0 votes
1 answer
219 views
How does flash encryption actually work
I have been reading about NVS flash partitions for use in embedded systems and that the NVS key-value data can be encrypted by using a symmetric key. This symmetric key is then stored in a separate ...
- 309
12 votes
3 answers
4k views
Why shred before LUKS disk encryption?
I read the following article and it says to "Stuff random data to the device" (using shred) before encrypting with LUKS. How to enable LUKS disk encryption with keyfile on Linux Why would ...
- 121
1 vote
0 answers
160 views
Is it necessary to encrypt an eMMC that's soldered to the board?
Say you have a machine where the disk (eMMC) is non-removable like the Surface Go. If the UEFI configuration is protected with a long password, USB + network boot is disabled, and your user has a long ...
- 131
2 votes
3 answers
1k views
Clarifying BitLocker Full Disk Encryption and the role of TPM
Question 1: Can you confirm that in a full disk encryption setup like BitLocker, when we normally boot the system, use the password, and log in, the key to decrypt the disk is loaded into RAM? If so, ...
- 537
10 votes
3 answers
3k views
Prepare Bitlocker protected PC for disposal
We want to dispose of an old notebook whose display frame is damaged. It's a Windows device with a BitLocker (TPM+PIN) encrypted SSD. I am trying to devise a strategy for protecting the data on the ...
- 3,950
9 votes
4 answers
5k views
Is BitLocker susceptible to any known attacks other than bruteforcing when used with a very strong passphrase and no TPM?
I have learned about attacks where the BitLocker master key can be sniffed on its way from the CPU to the TPM using a logic analyzer. However, in computer configurations without TPMs, this is ...
- 1,362
1 vote
1 answer
143 views
In Linux, what encryption implementation approach is optimal given specific use & threat models?
Given the following use & threat models, what is the optimal encryption implementation? Optimal is defined as the approach best matching the use model. Use Model Computer must be optimized for ...
- 3,204
2 votes
1 answer
249 views
Are there any motherboards / UEFI that support hardware encryption on SED?
I found that Thinkpads have hdd password support, which in terms uses some bizarre password hashing and ends up with 90 bits of entropy, which is again used as ATA security password to SED, which in ...
- 103
0 votes
1 answer
318 views
How does iOS / Android device encryption work?
As far as I'm aware, a locked iOS is considered very safe. No one, who does not know the PIN cannot unlock the phone. While the PIN seems weak on the first glance (4 digits?) it is actually strong, ...
- 6,851
0 votes
1 answer
159 views
SSH-Agent writing unencrypted keys to swap memory
I have recently set up a computer with full disk encryption, and I decided not to encrypt the swap partition for performance reasons. I have been using ssh-agent on another computer to load my private ...
- 1
0 votes
0 answers
464 views
How does a pattern or a PIN secure an Android device with encryption?
Modern Android devices have encryption for the storage. It is secured with a key which is derived from the lock screen and a hardware bound key. We know that the rate limiting mechanism prevents brute ...
- 147