0

If I encrypt a whole partition with AES, is it secure to just overwrite the first few bytes of the partition in order to make it completly unreadable even if an attacker knows the passphrase to access it?

  • You don't need to overwrite it if you simply forget/drop the key. If the key might be known it does not help,to overwrite a few bytes (because disk encryption is random access so you do not have food error propagation). It does however help to overwrite metadata headers (like Truecrypt) to prohibit password->masterkey derivation. – eckes Aug 18 '17 at 22:34
1

Some FDE schemes, such as BitLocker, store their metadata (plain-text information about how to decrypt the volume, plus things like the encrypted master key and how it is protected) in multiple places, scattered across the volume. This is done for redundancy against minor disk corruption causing 100% data loss. You would need to wipe all of the metadata to prevent somebody who would otherwise be able to decrypt the master key from decrypting the volume.

Even aside from that, though, wiping the first few bytes won't do anything at all unless you did something like use openssl to encrypt the whole volume directly, instead of using an actual full-volume encryption tool. The reason is that the first few (hundreds of) bytes of the volume is metadata about stuff like what file system is on the volume (or what full-volume encryption scheme was used and where to find its metadata). The first few bytes of this is almost always either irrelevant, predictable, or both. Wiping it won't save you anything.

Finally, even if you did something like the "openssl the whole block device" idea, nulling "the first few bytes" doesn't add nearly enough entropy to prevent somebody from just brute-forcing the encryption, assuming they know the key. Let's say you wiped three bytes. Three bytes is 24 bits, or roughly 16 million possible values. Assuming the attacker has a way to test any given possible value for those three bytes (to see if it's what they were before being wiped) in less than 1000 AES decryption operations (realistically it'd probably be much less). Given modern hardware-accelerated AES speeds, your typical desktop CPU could find the original value of those 3 wiped bytes in under a minute.

0

It depends on the FDE scheme.

In the case where you've just encrypted the disk directly (e.g. using a command such as openssl aes-256-cbc with dd), perhaps with a backup disk, this will not prevent data from being recovered. Deleting or corrupting parts of the disk will not prevent other parts of the disk from being read if the attacker knows the key. This is because the decryption process for most block cipher modes relies only on the adjacent block of ciphertext being correct.

In the case where you're using a competent FDE scheme, you can most probably destroy all data on the disk by wiping the first few hundred (or thousand) sectors. This is because FDE tends to use a randomly generated master key to encrypt the data, which is then in turn encrypted with your password. This encrypted master key record is placed somewhere on the disk, usually at the very start or very end of the partition or volume. By wiping this record all data is then lost, assuming that the attacker has not imaged the disk ahead of time. If they have a copy of the encrypted header and then later learn your password, they can still recover your files from the remaining encrypted data.

  • Assuming that the key is only found at the start of the drive might be an issue; wipe the end too. I know GUID partition tables store a backup there; I can imagine an encryption scheme doing the same thing. – Someone Somewhere Aug 19 '17 at 6:59
  • 2
    @CBHacking That is not the case. The decryption process for each CBC block requires only the correct ciphertext block to be available, not the correct plaintext block. See the diagram here. As such a corrupt or destroyed block only prevents recovery of itself and the adjacent block. This also results in CBC having the property of being random-access for read. – Polynomial Aug 19 '17 at 10:59
  • @Polynomial My bad, you're quite correct, I was confusing the operations for encryption and decryption. As you say, the relevant block(s) and the following block would be modified, but the rest would be fine. – CBHacking Aug 20 '17 at 7:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.