Hacker News Reader

Comment by 867-5309 | Hacker News Reader

modern high class SSDs have a hardware encryption chip, sort of like Intel's AES-NI for CPUs, which greatly reduces the burden on the CPU. you only really notice a difference when accessing larger files and the SSD's internal buffer fills up and offloads

View on HN

OpenBSD doesn't use any on drive encryption features.

And for good reason considering some of them lie about actually encrypting the data, or are very bad about keeping it safe.

https://www.tomshardware.com/news/bitlocker-encrypts-self-en...

These rely on the vendors secret sauce and an analysis years back found these frequently horribly broken like my password is password levels of broken.

Bitlocker by default on windows will happily depend on these broken implications in favor of actually secure options that are now and for years specifically accelerated by your cpu.

They are also potentially worthless at protecting data in suspended laptops which for some is a machines condition 99% of the time when it is apt to be lost or stolen.

Any citations about broken AES-NI?

To be clear the parent post and mine were discussing self encrypting drives. Drives which handle the encryption and decryption on drive instead of relying on your CPU. This is what is insecure.

https://www.tomshardware.com/news/crucial-samsung-ssd-encryp...

https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self...

https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks...

Self encrypting drives are have been insecure for years.

Thanks, I misunderstood.

>Bitlocker by default on windows will happily depend on these broken implications...

This was changed September 2019, when Microsoft pushed an update that defaults Bitlocker to software encryption.

Most of those are black boxes. If you have a compliance requirement for encryption, your hardware crypto probably doesn’t meet it.

For modern devices, there is no performance impact from software FDE. To be meaningful, you need to have specific configurations in place as well as appropriate handling. If you’re not doing that, don’t bother.

> For modern devices, there is no performance impact from software FDE

Ha! https://blog.cloudflare.com/speeding-up-linux-disk-encryptio...

At least since october last year the story around dm-crypt seems to have changed with their patches. I dropped FDE last year in spring after a tormented year of often caused ui freezes. With an SSD mind you.

I just think that in this particular case dm-crypt devs don't actually encrypt their drives and haven't experienced the degraded performance.

Otherwise, I'd agree with you. Had no problem with FDE and my smartphone.

Reply on news.ycombinator.com