Cryptographic Erasure: Moving Beyond Hard Drive Destruction

Discussion in 'privacy technology' started by ronjor, Dec 19, 2018.

  1. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,057
    Location:
    Texas
    Kaan Onarlioglu 12/18/2018
     
  2. mirimir

    mirimir Registered Member

    Joined:
    Oct 1, 2011
    Posts:
    9,252
    Well, that's what they say. Physical destruction is still the only way to be certain.
     
  3. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    If you could ASSURE a user that the actual keys were changed and cannot be recovered then it would be safe. Still, there is always some risk that any algo used to encrypt could be broken at some point in the future. If that was the case the header/keys would be expendable in a way. I use a similar method now. Before taking LUKS externals off premises I wipe the header and place a "fake" LUKS header on the volume. I have created scripts that can wipe and replace LUKS headers perfectly in a second or two tops. Seems like this is the same as the topic of this thread.
     
  4. deBoetie

    deBoetie Registered Member

    Joined:
    Aug 7, 2013
    Posts:
    1,832
    Location:
    UK
    My take is:
    • Encrypt from outset.
    • Don't use on-drive encryption.
    • If you can't encrypt up-front, use physical destruction (including making it very expensive to reconstruct)
    The reason for this is that my experience of hard disk failure these days is that it is often catastrophic with no warning, so it's pointless looking at after-the-fact encryption (against a determined adversary).

    I'd also caution people to apply this to their phones and other smart devices.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.