Vryjdfkk

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of storage is to support effective distribution of data via wear leveling.

Assuming my understanding is correct, how does full disk encryption cater for over-provisioned of storage if the additional block of storage isn't advertised or accessible by the operating system?

If the distribution of data is limited to the drive's controller, is there a risk of data flowing from encrypted blocks to unencrypted blocks e.g. over-provisioned storage?

If you encrypt the disk from the start, when you first start using it, then this isn't a problem. All data you write is encrypted and remapped sectors just lead to encrypted data being remanent on the over-provisioned area. Since the data is encrypted, you can't do anything with it even if you recover it using direct flash reads on a disassembled SSD.

Furthermore, identifying where that data came from in the encrypted stream is particularly difficult, and since most FDE block cipher modes (e.g. XTS) include the sector number (or some other position value) as part of the initialisation vector it becomes exceedingly difficult to recover plaintext from those remanent sectors even if you are in possession of the FDE master key.

On top of that, most SSDs implement the ATA Secure Erase feature. This feature allows you to send a single command to safely erase the disk without needing to write over every sector. Overwriting sectors is costly as flash cells have limited write cycles. This feature works by transparently encrypting all sectors using a randomly generated key which is stored in the disk controller's nonvolatile memory. When you run the ATA Secure Erase command, the disk controller discards the old key and generates a new one. This instantly makes all data on the disk unreadable. As a side-effect, all over-provisioned areas are also encrypted this way, meaning that even without using your own FDE on the SSD the over-provisioned areas are still encrypted and difficult to recover even if you extract the Secure Erase master key from the controller's nonvolatile memory. If you later do a Secure Erase command, the overprovisioned areas become unreadable too.

FDE does not need to know anything about overprovisioning. If the partition is encrypted, no plain-text will ever be written anywhere. Blocks reserved for wear leveling will either have un-initialized random data, or encrypted blocks.

If you are using the encryption provided by the controller, encryption/decryption occurs inside the controller, so no plain text data is written on the blocks. If the encryption is done by the OS, the controller already receives encrypted data.