logoalt Hacker News

steelframe • today at 4:03 PM • 2 replies • view on HN

If you own an Android device, your disk encryption is most likely provided via a UFS/eMMC hardware component known as the "Inline Cryptographic Engine" (ICE). Reputable device manufacturers validate the ciphertext that these devices write out to storage in a test environment by running the plaintext through a software encryption process using the same encryption keys as the OS provides to the ICE. If the ciphertexts match, then it would be unlikely that the hardware encryption engine isn't doing its job right.


Replies

my123 • today at 5:57 PM

The inline crypto engine is in the SoC for the phone case. Inline crypto engines for OPAL on the storage device side have a far worse security record.

close04 • today at 4:51 PM

That’s not validating an implementation. You’re just comparing the output for a few known inputs to known results.

The hardware is still a black box and you’ll never know how it behaves in conditions you didn't test against.

➕ show 1 reply