7 ms·

Correct, unless you're using a self-encrypting drive the FVEK sits in RAM once it's been released by the TPM during boot. The TPM is only a root of trust; for f

Correct, unless you're using a self-encrypting drive the FVEK sits in RAM once it's been released by the TPM during boot. The TPM is only a root of trust; for fast crypto operations without keeping the key in kernel memory you would need something like Intel SGX or ARM TrustZone.

p_ing 2y ago
BitLocker no longer leverages SED by default due to vulnerabilities in drive manufactures firmware as of Sept 2019. > Changes the default setting for BitLocker when encrypting a self-encrypting hard drive. Now, the default is to use software encryption for newly encrypted drives. For existing drives, the type of encryption will not change. https://support.microsoft.com/en-us/topic/september-24-2019-kb4516071-os-build-16299-1420-5648029d-8d1c-ed9e-b72c-63c6fee30bff https://support.microsoft.com/en-us/topic/september-24-2019-... https://nvd.nist.gov/vuln/detail/CVE-2018-12037 https://nvd.nist.gov/vuln/detail/CVE-2018-12037
- MoreMoore 2y ago
  Holy crap. https://threadreaderapp.com/thread/1059435094421712896.html https://threadreaderapp.com/thread/1059435094421712896.html This is amazing. > The encrypted SSD has a master password that’s set to “” HN discussion here: https://news.ycombinator.com/item?id=18382975 https://news.ycombinator.com/item?id=18382975 Original paper here: https://cs.ru.nl/~cmeijer/publications/Self_Encrypting_Deception_Weaknesses_in_the_Encryption_of_Solid_State_Drives.pdf https://cs.ru.nl/~cmeijer/publications/Self_Encrypting_Decep...
  - baybal2 2y ago
    [dead]