upvote

points

by close0419 hours ago |
comments
upvoteby steelframe19 hours ago|
next
[-]
If you own an Android device, your disk encryption is most likely provided via a UFS/eMMC hardware component known as the "Inline Cryptographic Engine" (ICE). Reputable device manufacturers validate the ciphertext that these devices write out to storage in a test environment by running the plaintext through a software encryption process using the same encryption keys as the OS provides to the ICE. If the ciphertexts match, then it would be unlikely that the hardware encryption engine isn't doing its job right.
reply
upvoteby my12317 hours ago|
parent|
next
[-]
The inline crypto engine is in the SoC for the phone case. Inline crypto engines for OPAL on the storage device side have a far worse security record.
reply
upvoteby close0418 hours ago|
parent|
prev|
[-]
That’s not validating an implementation. You’re just comparing the output for a few known inputs to known results.

The hardware is still a black box and you’ll never know how it behaves in conditions you didn't test against.

reply
upvoteby steelframe16 hours ago|
parent|
[-]
Why do you trust the device you're posting this from? I presume you use it for private browsing, banking, email, and so forth.
reply
upvoteby buran7715 hours ago|
parent|
next
[-]
A general purpose computing device is unavoidable, it's exceedingly difficult to build anything close to it. Encrypted storage is trivial without dedicated hardware, using open, validated software solutions. Even better, if bugs or backdoors are found you don't need to throw out your encrypted stick, just update the software or reencrypt.

Because what I said above might sound like black magic to anyone who knows nothing about the topic I will expand.

The CPU on which the software runs gets far more scrutiny than the obscure encryption engine on the USB stick. And it's possible to validate the software encryption with minimal effort. Verify the output with various software implementations of the same algorithm, ran on different CPUs. They have to be compatible and can't all have the same bug or backdoor.

An encrypted stick is impossible to validate by the end user. They have no access to the CPU encryption engine or the raw storage so can't know the algorithm implementation, or the output to disk format which is probably proprietary.

reply
upvoteby magicalhippo16 hours ago|
parent|
prev|
[-]
You didn't build your computer from discrete transistors[1]?

[1]: https://www.megaprocessor.com/index.html

reply
upvoteby gruez19 hours ago|
prev|
[-]
>Anything safe from TLAs is what’s being sold only to them.

I think you're overestimating how much backdoors there are in products vs actual bugs. As we've seen with with recent vulnerability disclosures, there's plenty of bugs that were put there unintentionally.

reply
upvoteby traverseda18 hours ago|
parent|
next
[-]
We don't know how many of those bugs were intentional, or known, by the three letter agencies.
reply
upvoteby close0418 hours ago|
parent|
prev|
[-]
I didn’t make any mention of backdoors or bugs, intentional or accidental, or the prevalence of either. You aren’t wrong but you addressed a point I never made.

The point was that there are special products, implementations of already known algorithms, sold only to TLAs. They have the code validated to the Moon and back, unlike the commercial products.

reply