Due to the ridiculous hellban that occured I'm posting my intended but disallowed response using this temporary user, because I feel that getting the explanation out about how solid state memory devices operate is important to the discussion and to clear misunderstandings that people may have regarding safe erasion of data on flash memory:
There's a problem with your theory here, in how you (and others responding to DanBlake's question) have misunderstood how a flash memory device works. How can the user or operating system, on software level, select a definite block of data for "zeroing out" when the storage medium is an SSD where wear-levelling is always present and ultimately what controls, on lowest possible level, what memory cell data is going to be written to? To my knowledge - and do correct me if I'm wrong - this is not doable on an SSD, and you thusly have to overwrite the entire SSD to be certain that the memory cell holding the key is erased. This is how flash memory controllers work - they always write data to the next free block, remap the old block and then marks it as unoccupied in the BAM.
If the case is a mobile unit that may have a small portion of separate PRAM or similar where you can store crypto keys, the principle is the same there as that's also a flash type memory, even if a much smaller one that is faster to erase. However, that solution isn't usually available in a "normal computer", nor available to a "normal OS", which are the two targets of SSD drives.
There's a problem with your theory here, in how you (and others responding to DanBlake's question) have misunderstood how a flash memory device works. How can the user or operating system, on software level, select a definite block of data for "zeroing out" when the storage medium is an SSD where wear-levelling is always present and ultimately what controls, on lowest possible level, what memory cell data is going to be written to? To my knowledge - and do correct me if I'm wrong - this is not doable on an SSD, and you thusly have to overwrite the entire SSD to be certain that the memory cell holding the key is erased. This is how flash memory controllers work - they always write data to the next free block, remap the old block and then marks it as unoccupied in the BAM.
If the case is a mobile unit that may have a small portion of separate PRAM or similar where you can store crypto keys, the principle is the same there as that's also a flash type memory, even if a much smaller one that is faster to erase. However, that solution isn't usually available in a "normal computer", nor available to a "normal OS", which are the two targets of SSD drives.
/ hackermom