1

I usually use Veracrypt (and in the past Truecrypt) to secure my external hard drive. I've always been taught to stick to such open-source software for my disk encryption needs, since it can be verified to be doing what it claims and the open-source community can check for possible backdoors.

I recently bought a new external hard drive, the SanDisk Extreme Pro, which seems to come with a built-in hardware AES engine. I assume this would give me much faster read/write speeds than if I used Veracrypt, but it is also of course a closed source system and I would have to trust that it works as advertised. Generally, closed source enterprise level encryption tools I've seen come with certification (I think called FIPS 140-2 or something along those lines?) that those tools work as advertised, but as this is a consumer grade product I don't believe it is advertised with any certifications beyond listing that it is 256-bit AES on its datasheet https://documents.westerndigital.com/content/dam/doc-library/en_us/assets/public/sandisk/product/portable-drives/extreme-pro-usb-3-2-ssd/data-sheet-sandisk-extreme-pro-usb-3-2-ssd.pdf.

I am wondering what the best practice in this case is, and what the pros and cons of each option are. The security of my data for me is #1 and I am happy to stick to Veracrypt if in fact the built-in encryption is considered less secure. Should I disregard the built-in encryption and stick to Veracrypt or is the built-in hardware encryption considered safe to use and I'm throwing away IO speed for no reason by not using it?

I assume Veracrypt itself is probably using hardware AES acceleration techniques, is the performance from this going to be comparable?

Improve this question
2
  • 2
    I'd not trust hardware encryption at all. Those researchers attacked a couple of different vendors implementation, and all had glaring problems.
    – vidarlo
    Commented Jan 17, 2022 at 13:16
  • 1
    These hardware encryption solutions usually are poorly vetted, because they apply only to a small subset of available hardware - whereas software solutions are universal. Furthermore, some vendors still believe in security by obscurity, so they don't want to have their solutions tested.
    – user163495
    Commented Jan 17, 2022 at 13:28

1 Answer 1

Reset to default
1

Am afraid that there is no definitive answer here. As far as am I concerned, I would only say: it depends.

I know Sandisk for being a serious company when it comes to manufacturing memory cards and SSD disks. I have no clue whether they can be trusted to implement up to date security tools. Furthermore, if a flaw is discovered in the implementation used by VeraCrypt, you will just have to upgrade to a version fixing it. If a flaw exists in a hardware disk implementation you can either pray of change the disk. And chances are that the disk manufacturer does not make it public.

So you are left with a choice:

  • is the VeraCrypt solution more secure than Sandisk one? Yes it is because we all know that is has been reviewed and because flaws can be expected to be quickly fixed
  • is the Sandisk solution better on a performance point of view? Yes it is. Because even if the main processor can do the encryption faster that the disk can write (or read), it will indeed take processor time while all operations executed on a peripheral cost nothing to the main processor.

So if depends on the acceptable risk level and the required overal performance of the system. Because you are just changing security for performance.

If your system is much more powerful that what you need, you should go with VeraCrypt. If you only want to be protected from a casual attacker, but want to be able to do heavy processing on the machine, hardware encryption is probably a better option.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .