alt Hacker NewsThat's a cool thought experiment, but it doesn't work in practice.
> When it sees a certain string in any write to the disk
dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.
Replies
sandworm101 • today at 10:33 AM
>> will encrypt the data before it's written to disk
The people buying much of these "hardware encryption" products do so because they believe it removes the need for software encryption to/from the device.
The general point related to the topic of the article is that the many controllers running on your device (not limited to Lenovo BTW) are black boxes almost impossible to inspect. The encryption engine on a hardware encrypted USB stick is making everything even harder. It can implement something like this but it's probably made to be extremely difficult to dump the firmware or inspect the features implemented in silicon.
If I'm doing software encryption like dm-crypt or zfs encryption then I don't need to bother with hardware encryption too. It's easier to trust software encryption. We have many interoperable and even open source implementations of the same encryption methods, the output is readable in open formats, so they can be validated against each other if needed.