What is the benefit of having FIPS hardware-level encryption on a USB stick?
I&#x27;m going to offer a different opinion:<p>The difference is that if you encrypt a file with a strong, industry standard algorithm, with proper key derivation, enough entropy on your passphrase, and stick it on a $27 USB key, you can be personally certain (by most reasonable standards) that your data is secure at rest.<p>However, if you put a file on a $1657 IronKey, you have to trust the certification (the Infineon ROCA snafu has proven beyond a shadow of a doubt that FIPS certification is no guarantee when it comes to the crypto algorithms - and look at stuff like that CVE that affected <i>only</i> the FIPS version of the YubiKey due to extra complexity the certification stuff required!), and have no guarantee that your data is indeed encrypted with your passphrase. Indeed, it&#x27;s quite common for these &quot;secure&quot; devices to merely encrypt your data with a fixed or variable but not passphrase-derived encryption key, and then merely check the passphrase against a hash (with attempt limits). They are hardened against attacks to bypass this, but they do <i>not</i> offer pure cryptographic protection for your data, unlike the $27 + software solution.<p>Put another way: use a long enough passphrase, and the $27 solution is superior. Use a short passphrase or PIN, and the $1657 solution is hopefully superior (though you have no true guarantee or way to know for sure).<p>You are paying &gt;$1k for the convenience of using a short passphrase, and in exchange you have to trust the manufacturer.<p>Give me a megabuck or two and I bet I have a good chance of getting your files out of an IronKey. Give me a megabuck or two and I can do nothing against software encryption with a 32-character passphrase.<p>If I&#x27;m lucky I might even find an IronKey exploit that can be performed for much cheaper. Finding physical exploits (e.g. power, EMI, or even optical glitching attacks, nevermind stuff like pure firmware exploits) is <i>much</i> easier than breaking proper crypto.<p>By the way, the same trade-off exists with Android (in old school FDE mode) vs iPhone secure enclave stuff. The iPhone solution has many advantages for many use cases, but if we&#x27;re talking strictly about security of data at rest (i.e. from 
a powered off state) I trust my rooted Android with a long FDE passphrase over any iPhone. The latter only entangles a subset of user data with the lockscreen code, and does not allow you to set a separate longer boot-time passphrase from the normal unlock code (nor does regular Android, but you can do it with root).<p>(disclaimer: it&#x27;s been years since I looked at IronKeys and had this thought experiment; at the time they definitely made no claims of deriving the encryption key from your passphrase and I seem to recall reading somewhere that they don&#x27;t, but I haven&#x27;t checked their marketing these days)