35 lines
1.2 KiB
TOML
Executable File
35 lines
1.2 KiB
TOML
Executable File
# Paranoid profile — multi-pass, multi-algorithm, full verification.
|
|
|
|
[meta]
|
|
name = "Paranoid"
|
|
version = 1
|
|
description = "Multi-pass, multi-algorithm, full verification. For media that must not be recoverable under any plausible adversary. Uses Gutmann 35-pass for HDDs, DoD 7-pass + every-pass verify for SSDs/NVMe."
|
|
nist_class = "purge"
|
|
audience = "Classified, high-value, adversary-rich environments"
|
|
|
|
[defaults]
|
|
prng_pool = ["BLAKE3-XOF (CSPRNG)", "XChaCha20 (CSPRNG)", "Salsa20 (CSPRNG)"]
|
|
hash = "BLAKE3-256"
|
|
verify = "every"
|
|
certificate = "both"
|
|
report = ["summary", "detailed", "compliance"]
|
|
|
|
[policy_map]
|
|
hdd_cmr = "hdd_overwrite"
|
|
hdd_smr = "hdd_overwrite"
|
|
ssd_sata = "ssd_purge_then_overwrite"
|
|
ssd_sas = "ssd_purge_then_overwrite"
|
|
ssd_usb = "ssd_purge_then_overwrite"
|
|
ssd_nvme = "nvme_sanitize_then_overwrite"
|
|
pmem = "pmem_crypto_erase"
|
|
mmc = "embedded_overwrite"
|
|
sd = "embedded_overwrite"
|
|
ufs = "embedded_overwrite"
|
|
virtual = "virtual_overwrite"
|
|
|
|
[constraints]
|
|
require_secure_erase_capable = false
|
|
abort_on_verify_failure = true
|
|
require_signed_certificate = true
|
|
minimum_passes = 3
|