1

I just erased a newly purchased external USB disk using the Disk Utility program and set it to use the file system APFS Encrypted. I entered a strong password and the whole process took about a minute, then the device was supposedly encrypted and ready for use.

I noted that APFS encryption uses AES-128 which seems good, but the fact that the formatting only took a minute seems weird. Using encryption software like TrueCrypt, to safely prepare a new device takes hours, even days, just to fill the disk with random data before any valuable data is saved onto the device. For this reason, I am concerned that my APFS encrypted device is not secure enough.

Are my concerns legitimate or have I misunderstood something here?

Improve this question
3

Did you click click Security Options, and use the slider to set how any times the data should be erased?

Writing over the disk is to stop old files from being accessible.

The time to encrypt a disk depends mostly on how many files need to be encrypted and it they old files should be overwritten. As it is a new drive there won't be a lot of files to convert.

Improve this answer
4
  • Thanks, I must have missed that part. Overwriting the disk should do the trick. – Gruber Nov 28 '18 at 11:40
  • 1
    If it is a new disk without any sensitive files, then overwriting the disk is probably not needed. – Benjamin Scherer Nov 28 '18 at 11:54
  • The thing I find peculiar is that the slider says that ultimately the overwrite algorithm will write zeroes on the disk. That means encrypted data will be possible to distinguish from empty disk. Cryptographically that means an attack is simpler, and is why tools like TrueCrypt writes random data from a certain distribution (not zeroes) on the disk when formatting it. – Gruber Nov 28 '18 at 15:19
  • I cannot find any source that says free disk space being unencrypted is an issue for security. The files are not secure because they can't be found. They are secure because they are encrypted. The only reasons i have found for full disk is to make sure old deleted files are indeed gone. – Benjamin Scherer Nov 28 '18 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .