Re: Practical minimum for USB FDE key?

--000000000000c43f4406575c215f
Content-Type: text/plain; charset="UTF-8"

Thanks for the insight!

On Thursday, July 23, 2026, Crystal Kolipe <[email protected]>
wrote:

> On Thu, Jul 23, 2026 at 08:27:52PM -0700, Bryan Stenson wrote:
> > The FAQ covering FDE suggests a 1 MB RAID partition...wondering where
> that
> > size recommendation came from.
> >
> > I'm interested in backing up this key to a private bitwarden instance
> > (base64 encoded), and was curious if the 1 MB size was a crypto
> > recommendation, or based on a partition size minimum?
>
> The actual data stored on the keydisk is only a few hundred bytes.
>
> Most of that is metadata about the volume.
>
> The 1 Mb size recommendation is fairly arbitrary.  There is certainly not
> 1 Mb
> of key data there.  Using a smaller parition for the keydisk does not
> directly
> affect the encryption in any way.
>
> (Although if you try to create a keydisk on a ridiculously small volume,
> such
>  as 2 Kb, it will likely appear to work at the time of creation but then
> fail
>  to re-attach after being detached.)
>
> Also note:
>
> * The metadata might change and grow in the future, so hard-coding a backup
>   script to copy the exact current size might lead to problems if it does,
> and
>   you don't regularly test that your script is actually backing up all of
> the
>   data.
>

--000000000000c43f4406575c215f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks for the insight!<br><br>On Thursday, July 23, 2026, Crystal Kolipe &=
lt;<a href=3D"mailto:[email protected]">[email protected]=
</a>&gt; wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex">On Thu, Jul 23, 2026 at 0=
8:27:52PM -0700, Bryan Stenson wrote:<br>
&gt; The FAQ covering FDE suggests a 1 MB RAID partition...wondering where =
that<br>
&gt; size recommendation came from.<br>
&gt; <br>
&gt; I&#39;m interested in backing up this key to a private bitwarden insta=
nce<br>
&gt; (base64 encoded), and was curious if the 1 MB size was a crypto<br>
&gt; recommendation, or based on a partition size minimum?<br>
<br>
The actual data stored on the keydisk is only a few hundred bytes.<br>
<br>
Most of that is metadata about the volume.<br>
<br>
The 1 Mb size recommendation is fairly arbitrary.=C2=A0 There is certainly =
not 1 Mb<br>
of key data there.=C2=A0 Using a smaller parition for the keydisk does not =
directly<br>
affect the encryption in any way.<br>
<br>
(Although if you try to create a keydisk on a ridiculously small volume, su=
ch<br>
=C2=A0as 2 Kb, it will likely appear to work at the time of creation but th=
en fail<br>
=C2=A0to re-attach after being detached.)<br>
<br>
Also note:<br>
<br>
* The metadata might change and grow in the future, so hard-coding a backup=
<br>
=C2=A0 script to copy the exact current size might lead to problems if it d=
oes, and<br>
=C2=A0 you don&#39;t regularly test that your script is actually backing up=
 all of the<br>
=C2=A0 data.<br>
</blockquote>

--000000000000c43f4406575c215f--