0

According to Veracrypt's documentation,TRIM operations can reveal unencrypted zeroes or other undefined data (unencrypted).

Additionally it notes that;

In those cases, the adversary will be able to tell which sectors contain free space (and may be able to use this information for further analysis and attacks)

The solution/recommendation is to avoid using system encryption on drives that support trim and/or under Linux, either configure VeraCrypt not to use the Linux native kernel cryptographic services.

  1. What are unencrypted zeros and what information can they reveal?
  2. What constitutes undefined data and what information can it reveal?
  3. What are Linux native kernel cryptographic services? According to a post on Quora, it suggests AES-NI.If yes,is the configuration disabling the hardware acceleration? What impact can this have from a security perspective?

enter image description here

  • 1
    Here's an interesting blog post from 2011. It's going to be high level stuff that's leaked, like the type of file system, amount of disk used, etc. – AndrolGenhald Jan 10 '19 at 20:47
  • @AndrolGenhald - Thanks. The Veracrypt guide recommends disabling Linux native kernel cryptographic services. What are these? How should these be disabled and what are the security implications? – Motivated Jan 13 '19 at 16:43
2

Answers to the comments:

first of all some real life example that helps to clarify how both works
Think the hard disk (not ssd) as something like this:
https://www.zerorelativo.it/item_files/5/9/2/4/3/item_434295.jpg
https://i.pinimg.com/736x/19/0c/a1/190ca1d14a5eb7c52a762326042996dd.jpg
where the pieces of wood (bits) can be rotated front(1) or back(0).
there is no third state that we can call "deleted/empty".
you can edit that data in place, just by rotating the pieces of wood

ssd are differnet:
think them like a school blackboard, or a piece of paper, you can write it only once, you can't overwrite in place a piece of paper. to do that you have to use a rubber to delete the old data and only after this operation you can write on paper again.
On a pice of paper (or ssd) there can be 0,1 (data) or can be empty (three different states).
an empty/deleted block/sector can be written, once the operation is done you can't edit that data anymore.

empty state? Is it specific to a block of storage

Why would some parts be explicitly marked empty?

i was referring to sectors, not the whole drive.
let's take a real example (https://nesos-ita.github.io/hacks/fixing-bricked-pc/), i have programmed a spi flash memory (bios chip):
-the smallest programmable(=writable) data is "page" where a page size is 256 bytes
-smallest eresable part is a sector, where sector size is 4kb (larger than a page, 16 pages exactly)

if i want to edit one byte of that chip i have to:
1- read 4kb of data=16 pages (1 sector) (16 read page operations)
2- delete that sector (4kb) (1 erease sector operation)
3- reprogram 16 pages where 15 will contain the old data and one differs from one byte (the edited one) (16 page program operations)
total operations count: 16+1+16 not the best...
but what if that chip part was empty?
i could skip step one and two saving 17 operations and i could be faster!
note that even if there was 4kb of useless data i could skip read part but i must delete 4kb of data to wrtite a byte (actually a page of 256 bytes)
there is no "edit operation".
if when you delete a file the actual data is deleted in that moment is better, because when i will need to write on that disk part the disk will be in "deleted/empty" state and i will only write my data on it. it's faster!
this is what trim does, it deletes data when you delete a file, the scope of this is speed
this doesn't happens on hdd because hdd are faster if you don't delete data as explained if you keep reading:

Can you please clarify how would one determine if the drive has been securely wiped?

as we saw, hdd works like the photo above, since data can be only one or zero you can't wipe them, it's not like a piece of paper that if you watch it you can say is written or it's empty.
the approximation of a delete operation can be writing all 0.
1010101111100010110101010 <-- this is probably data
0000000000000000000000000 <-- this is probably empty (but this is still data, it's only a logic concept of empty, the disk is full of zero)

as always people want pc (and hdd) to be fast so in both hdd and ssd we want them as fast as possible. the goal is reached in two different ways with the two different technologies:
before continuing we need some concepts:
How a filesystem works (logic level, not hdd level)? how files are stored?
there is an index of files where there is a name, and a location
exactly like in a text book
how a file was deleted in past (hdd)?
it was removed from the index by overwriting it's index with 0
there was no point in deleting the actual content of the file, after deleting the index the physical file location is automagically free (since is no more in the index of used data)
it would be a big waste of time overwriting the whole file data with 0000000
and in fact it doesn't happens. in this way the hdd is faster:
- cut & paste operations are fast (you edit only the index)
- delete is fast (you edit only the index)
- copy & paste is slow (you have to actually copy data)
the "problem" is that you can restore deleted data if hasn't been overwritten by some new file, but this historically wasn't a problem, the hdd was faster in this way and everyone was happy.

Now the actual answer is near :)
Now that we have the concepts and we know why securely erease data might be necessary we can asnwer how to do it:
An appoximation of "deleting data" can be:
-writing all zero (or all one)
-writing random data
in both way the old data is gone but with all 0 or all 1 and reading the hdd as analog vlaues and not digital you might still recover data (more a theoric attack, needs lab, can't be done with sw), for example:
we know that the disk is magnetic, let's say that logic 1 is "magnetized" and 0 is "not magnetized" if we have a magnetic vlaue sensor that read from 0% to 100% magnetic value; we can say that 60-100% means logic one and 0-40% means logic zero.
supposing that you write from 1 to 0 the magnetic value will go from 97% to 15% supposing that you write from 0 to 0 the magnetic value will go from 13% to 2% thus if you read the hdd as analog values you might find out if a 0 was a 0 or if it was a 1 (more or less like reading rubber-ereased piece of paper, old data might be still visible).
a better way to delete data is writing garbage/random data (maybe more than one time) on the whole hdd, in this way the above trick doesn't work anymore.

and here is the actual answer!!
given that writing random data is the best way to wipe a disk if you find a disk that is full of random data you can say "this has been securely ereased!"
but given that a good cipher will look as random data you might also say "this is an encrypted drive"
you can't tell if it's encrypted or if it's securely ereased, but you can be sure that one of these two operations have been applied on that hdd/ssd.

If some are marked empty, how would someone determine the disk is encrypted and not secure erased?

Isn't the statement "with trim enabled attackers can know for sure:-that your disk is encrypted (but not read the content)" true for external hard drives as well regardless of trim?

i think i implicitly answered the question above but let's clarify it:
encrypted disk=full disk looks like random data, because good cipher without having password, looks like random data
securely ereased=fill with random data the whole disk!
now, if you use the encrypted ssd disk, and delete a file, the sector is marked as deleted/free/empty (by trim operation, on ssd only, for future write speed reasons). If i see a deleted sector it means that it's encrypted, the fact that a sector is empty it's a proof that you have deleted a file and you are using that disk, you can't use a disk full of random data/ereased, but you can use an encrypted disk!
this would not happen on hdd, as they don't have trim operation and they don't delete data, it's just left there
also note that even if the file index is "deleted" by writing all 0 on the index veracrypt will intercept that write operation end encrypt that all zero so on the disk you wll see something different (random data again).

What do you mean by it is in fact 0 or 1? How does changing state constitute undefined data? What is undefined data?

Let's take again real life example, the spi flash bios chip that i have written:
as you know computers works with binary data that can be 1 or 0
as i explained above flash memory must be deleted before writing, well i have tried to read a deleted sector and it returned:0xFF, 0xFF, 0xFF, ... that converted in binary means that it was full of 111111111111...
as you can see the deleted state is not a magic third state but practically it's all one.
but note that this particular model of memory has the deleted state=all one, another model might be electrically wired differently and have the deleted state=all 0. thus we can say that after a delete operation the data is "undefined".
but it's not a magic different state, it's just a way to say that there is meaningless data inside it.

My understanding is the TRIM command is subject to the SSD drive controller's internal routines e.g. garbage collection and it may never delete data since data can be stored across multiple blocks

The fact that data might never be deleted or might be stored in multiple locations it's a different thing, it's called wear leveling and the scope is different: increase life
suppose that you store a photo, that photo will never change so that flash cell will be written only once and never again.
now take a log, for example windows update log: it will be written every time you boot the pc with things like "today no updates", "updated to xyz", "failed to update"
so that cell will be written over and over...
since the number of write operations is limited you will have a broken cell and a new one, not the best...
the idea? move the data! swap every x days the windows update log flash memory cell and photo cell and you automagically doubled the life of your ssd.
combine this with multiple cell and you will have an ssd that degradate slower and in a more uniform way.
this is helped by the trim operation, swapping as i said above is expensive as you have to read the photo and the log, keep both in memory, delete both form disk and write both in inverse locations. if you have a free/deleted part you can just write a copy there and delete or ignore the original one.
there is another used trick: i have a 1gb usb flash memory that has inside a 2gb flash chip.

With "they could undelete data if they have an old copy where the data was there", is this only possible if the drive was not encrypted before?

No, also if encrypted, suppose that:
1 i get a copy of your encrypted disk
2 you delete a file
3 i get another copy where i see that a sector is deleted (i can notice this because it's an ssd and trim phisically delete data with a delete opreation)
4 having the old data from old copy (point 1) i can write it exactly where it was before and maybe your file will be undeleted when you boot the pc.
maybe it's important because filesystem it's a complex structure, what's is sure is that if i replace your disk with my old copy you will bot old copy, i can also edit any sector i want, but when decrypted will be garbage and probably crash something.
a more important thing to remember is that changing password doesn't change master key, so if:
1- i get a copy of the disk (encrypted)
2- you find that i got a copy and change the password
3- you tell me: ahah i found out you got my disk, i changed my password to a more complex one, the old one was "secret password123"
4- you write some other data on disk
5- i get an encrypted copy of your disk, i can decrypt EVERY copy of the disk, even after you changed the password!!

| improve this answer | |
  • @veracryptuser - Thanks for the detailed answer. It's very helpful. I have more clarifications. Is it okay if i reached out to you via email? – Motivated Jan 13 '19 at 16:57
  • @veracryptuser2 - Thanks for the detailed answer. It's very helpful. I have more clarifications. Is it okay if i reached out to you via email? – Motivated Jan 13 '19 at 17:46
1

First of all some theory:

How an hdd works?

  • it has memory cells that can be in only two states: 0 or 1
  • their values can be easilly changed form 0 to 1 and vice versa
  • since there is no "empty" state, files are never deleted for real; the only edited part is the file list index where the os say "this file is no more important, write over it whenever some space is needed" (that's why deleting 100GB takes less than 1 second and in data recovery software exists)

How does an ssd (flash memory in general) works?

  • it has memory cells that can be in three different states: 0,1,empty
  • they can be written (but not edited/overwritten!)
  • they can be deleted (empty state) and must be deleted before writing to them again (it's a different, slow, operation)
  • cells must be edited in big blocks, you can't just edit a bit you have to delete a big block and rewrite back it's original content with a bit changed

What is trim?

A "trick" to speed up the ssd. In fact, when the ssd is new=empty it can be written fast, when it's full of data you can't just write it, you have to delete old contents before writing the new one: 2 operations, double time needed. With trim, when you delete a file, a delete command is sent to the ssd (trim operation). In this way, the ssd is empty and ready to write new files fast.
Hdd doesn't have this problem, 0 and 1 can be changed with the same time, since there is no "empty" state.

Where is the problem with cryptography?

Normally if you try to read an encrypted disk without password you read only garbage: a bunch of 0 and 1 that are meaningless, the only conclusion that you can have is "this disk is encrypted (or securely erased).
You can't know how much disk is free and how much used.

1-What are unencrypted zeros and what information can they reveal?

With trim, some parts are explicitly marked as "empty"

  • so you know that the disk is encrypted and not securely erased by writing random data
  • you know how much is free and how much is used (but you don't know what's inside it)

2-What constitutes undefined data and what information can it reveal?

same as above, i said that flash memory have three states: 0,1,empty but it's not technically correct because empty is in fact 0 or 1 (depends on how it is built). the point is: you can change state from 1 to 0 (write) but you can't go back without a delete operation (that takes "much" time).

3-What are Linux native kernel cryptographic services?

I'm not expert but it has nothing to do with AES-NI (hw acceleration) the idea is that to encrypt data you have to intercept read/write operations to disk from programs and encrypt data before sending it to the disk.
veracrypt does this in it's own way, linux has it's own way to do this intercept operation

TL;DR:

with trim enabled attackers can know for sure:

  • that your disk is encrypted (but not read the content)
  • how much data is on the disk and how much is free (u can't read the data without password)
  • possible attacks knowing this? they could undelete data if they have an old copy where the data was there, they know by comparing difference that one block contained 2398u2389yhu3 and after was marked as empty, so they restore back that meaningless value and next time you boot your deleted file is back, the deleted file might be a virus, but this is more a theoric attack because attacker can't be sure of what has been deleted and what he is restoring.
| improve this answer | |
  • @veracrytuser - Thanks for the detailed response. A few clarifications. The first is: What do you mean by an empty state? Is it specific to a block of storage or to the entire storage? My understanding is the TRIM command is subject to the SSD drive controller's internal routines e.g. garbage collection and it may never delete data since data can be stored across multiple blocks. – Motivated Jan 11 '19 at 3:30
  • The second is you mention that "only conclusion that you can have is "this disk is encrypted (or securely ereased)'. Can you please clarify how would one determine if the drive has been securely wiped? – Motivated Jan 11 '19 at 3:31
  • Can you please clarify "With trim, some parts are explicitly marked as "empty" -so you know that the disk is encrypted and not securely ereased by writing random data -you know how much is free and how much is used (but you don't know what's inside it) " further as it isn't clear to me? Why would some parts be explicitly marked empty? If some are marked empty, how would someone determine the disk is encrypted and not secure erased? – Motivated Jan 11 '19 at 3:32
  • Can you also clarify "same as above, i said that flash memory have three states: 0,1,empty but it's not tecnically correct because empty is in fact 0 or 1 (depends on how it is built). the point is: you can change state from 1 to 0 (write) but you can't go back without a delete operation (that takes "much" time). " as it isn't clear me as well? What do you mean by it is in fact 0 or 1? How does changing state constitute undefined data? What is undefined data? – Motivated Jan 11 '19 at 3:36
  • Isn't the statement "with trim enabled attackers can know for sure:-that your disk is encrypted (but not read the content)" true for external hard drives as well regardless of trim? – Motivated Jan 11 '19 at 3:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.