← Back
Home › Systems › Security and identity

full-disk-encryption

Security and identity | full-disk-encryption — encrypt every block or file on a device so a lost device leaks nothing: XTS or per-file keys, keys sealed to the TPM or Secure Enclave and bound to measured boot, passcode stretching with hardware rate limits, recovery-key escrow to the enterprise or cloud, crypto-erase on wipe

BitLocker, FileVault, Apple Data Protection, Android file-based and metadata encryption (incl. Adiantum), LUKS/dm-crypt, VeraCrypt

SystemTechniques · 18Primitives · 59 full-disk-encryption Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Block io multiqueuehardware-os · medium: Per-CPU submission queues mapped to hardware queues, tags and I/O schedulers (blk-mq)Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Envelope encryptionsecurity · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.›Hardware root of trustsecurity · medium: Secure elements/TPM/TEE holding device keys, attestation and monotonic countersKey rotationsecurity · medium: Rotating keys without downtime: key ids, overlap windows, re-wrapping, JWKS publication, revocationAEAD (AES-GCM, ChaCha20-Poly1305)security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.›Aes key wrapsecurity · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key materialHardware backed keystoresecurity · low: Non-exportable keys in Secure Enclave, StrongBox, TPM: generation, use policies, biometric gatingKey sealingsecurity · low: Encrypting data so only a specific measured enclave/boot state can decrypt it (TPM/SGX sealing)Secure boot chainsecurity · low: Each boot stage verifies the signature of the next before running it, anchored in an immutable ROM key hash, with version counters against downgrade and a TPM log of what ran.›Trusted execution environmentssecurity · low: Enclaves/confidential VMs with remote attestation for computing on sealed dataHdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Aes xts disk encryptionsecurity · low: AES-XTS tweakable sector encryption for block devices; why no integrity and how sector tweaks workInline crypto enginesecurity · low: Storage/DMA-path hardware encryption with per-request keyslots and key programming from softwareHKDF key derivation (extract-and-ex…security · low: HMAC-based two-step key derivation: extract a uniform pseudorandom key from any secret, then expand it into as many context-bound keys as you need.›Media sanitizationsecurity · low: Irrecoverable data destruction on storage media: overwrite, crypto-erase, secure-erase commands and verificationMutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Password hashing (Argon2id)security · low: Memory-hard, salted, deliberately slow hashing so stolen password databases can't be cracked cheaply on GPUs.›Recovery key escrowsecurity · low: Escrow of recovery keys with split custody and audited release for account or disk recoverySecure memory zeroizationsecurity · low: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.›+ 11 more techniques+ 43 more primitives

Similar systems

Share the most building blocks with this one.

drm 41 %secrets-kms 37 %password-manager 37 %e2e-cloud-backup 32 %agent-credentials 28 %