Hacker News new | past | comments | ask | show | jobs | submit login

Not mentioned in the article are the consequences of using a SSD with trim. Trim would destroy the data in the hidden encrypted volume.



Trim is not really recommended for any encrypted volume to begin with, since it clearly reveals how much space is being used as well as some other filesystem metadata.


Does this apply to full disk encryption with Windows and VeraCrypt?

If so, do I need to disable TRIM? If yes, in Windows or the BIOS?


It does not apply to most mainstream encryption methods. Most methods will allocate the sectors containing encrypted data, but you need to use the decryption APIs to access the data.


Are you saying you should never use TRIM on an SSD that is encrypted?


Using TRIM means you can't plausibly deny using encryption on the disk. Any data trimmed will read as zeros. It also opens you up to a few more attack vectors since the attacker knows exactly where the ciphertext is located (start, end, size, etc.). This means that if your filesystem has data structures in fixed locations, they know exactly where in the ciphertext those would be located and can focus attacks on those since there is a significantly smaller set of possibilities for what the plaintext could be.

In practice, it depends on the level of paranoia that's needed for your situation. Trying to prevent your average thief from getting your bank info off your laptop? Probably not an issue. Hiding data from the NSA? Possibly a problem. I run TRIM on my SSDs, but I also live in a country where theoretically I don't have to give up the key. Admittedly, I'm not doing anything illegal, the only thing they'll find are a bunch of git repos, game installs, 2000's alternative rock, Scandinavian folk metal, and bad vacation pictures.


I am saying that if you use a disk encryption technology that puts the encrypted data in unallocated sectors (which is a plausibly deniable method), if you run (or your OS automatically runs) trim on the media, all of the data in the unallocated space will be lost.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: