I review all sorts of tech every day here at the Creative Bloq Testing Centre (my remote home office). And with that comes a lot of research into technical terminology that may feel dense for people who don't live and breathe it. What I didn't expect to stump me was a tiny little USB drive from Kingston.
The Kingston IronKey Locker+ 50 G2 was launched just this spring, and it's being pitched on the strength of its several layers of security. I'll just give you the quote I got directly here:
“With the LP50 G2, the Kingston IronKey lineup is all XTS-AES 256-bit hardware-encrypted with a baseline FIPS 197 certification by a NIST-authorised lab,” said Oscar Escayola Kaloudis, EMEA Flash Business Manager and Sales Manager DACH, Middle East and Africa, Greece and Israel for Kingston, EMEA. “In addition, IronKey leads the industry with three best-in-class FIPS 140-3 Level 3 validated drives. This portfolio offers superior data protection solutions designed to meet the specific requirements of consumer, enterprise, and government customers."
Now, please don't panic if you don't know what any of this means, because neither did I.
Which is why I requested their most handsome Italian to get on a call and explain it all to me as if I were the idiot I clearly am.
They responded promptly by getting me in touch with Matteo Occhi, Field Application Engineer for Kingston, based in London. So here's what I asked him, and what he told me.
Be honest. Is this thing basically like a drive or a stick with a tiny bouncer living inside it, or what? What does "XTS-AES 256-bit" actually do for my files? What does it MEAN?
Matteo Occhi: Okay, honestly that’s not a bad way to think about it. It is a USB stick with a very serious little security guard built inside it. So when we say "XTS-AES 256-bit hardware encryption", what we really mean is the files on the drive are automatically scrambled in a way that makes them unreadable unless you unlock the drive with the correct password.
If we break the acronyms down, AES 256-bit is a strong lock. And it’s an insanely strong one because it has 2 to the power of 256 combinations. That is a lot of combinations. XTS is the anti-copy, anti-pattern mode of encryption, which is designed specifically for storage devices - so the way that lock is applied to your data. Hardware encryption means that the protection is built inside the Kingston IronKey drive itself.
All this means that if you lose a normal USB stick, someone else can plug it into their PC and immediately start looking at what’s inside it. With a hardware-encrypted drive like this one, they might physically still have the drive, but the data is still locked away. It’s like you steal a filing cabinet, but you don’t have the key. And on top of that, the papers inside it are still written in code, so they’re still unreadable unless you have the correct password.
The hardware encryption part here is essential because it means that the encryption is handled internally by the drive itself, not by an app running on your computer. So this makes it more self-contained and easier for everyday users. You plug it in, you enter the password at the prompt, it unlocks, and then it behaves just like a regular USB on your PC. It turns your files into an unreadable scramble of data until you unlock them with your password.
Q: Cool. But if I forget my password, does the drive explode or wipe itself? Does it just sit there judging me? What actually happens when it says "brute-force protection"?
Matteo: The drive does not explode, thankfully, depending on how dramatic you want to be with your USB drive. Brute-force protection is there to stop someone or something like malware from just guessing passwords over and over again. This type of attack means you’re basically trying, for example, "password123", then "password124", "password125", then thousands or millions of other combinations until they get lucky and eventually manage to unlock the drive.
Drives with brute-force protection are designed to stop this kind of attack by limiting the number of failed attempts. This is usually 10 attempts as a standard setting. So instead of letting someone or something guess forever, the drive is programmed to say, “No, okay, after 10 failed attempts I can either wipe myself, but anyway stop you from continuing to guess the password.”
So if you forget your password, the drive will not judge you, but it’s designed to make it impossible for anyone else to get in either. And it’s a trade-off with proper security because if a secure drive had some sort of magic backdoor for forgotten passwords, then any attacker would want to use that same backdoor too. Even we as a manufacturer of this drive do not have that backdoor access because there is no such thing, there is no backdoor. That’s what happens: no judgment, just stopping anyone else from getting in. A hard lock, basically.
And then it says "FIPS 197 certified". Is that a security thing, a government thing, or like, a Bulgarian licence plate? What is that?
Matteo: It does sound like an acronym from a government file cabinet. I absolutely get that. Not a Bulgarian plate. FIPS 197 is a recognised standard for the encryption algorithm called AES, which stands for Advanced Encryption Standard. In English, this means that the encryption method used by the drive has been tested against a recognised standard, rather than being some homemade security recipe that we’ve come up with.
For businesses and especially public-sector organisations, this matters because they often need products that meet defined security requirements for auditing, for example. And for everyday users, it can simply mean that this is a serious encryption standard protecting your data. We’re not playing with security. So when we say FIPS 197-certified, we’re basically saying that this drive uses encryption that meets a formal, well-known standard.
The baseline FIPS 197 certification is issued by NIST. NIST is an authority based in the United States. They have authorised labs where they carry out a series of tests and then eventually issue the certification for this drive. So it’s not just “trust us; we tell you it is secure.” It is secure because it follows a recognised encryption standard, and it was tested against that.
And then it says "virtual keyboard to stop keyloggers". Does that mean I’m literally clicking letters on the screen like it’s 2004? Or is it a smarter thing than that?
Matteo: A little bit, it looks a little bit like that, yes. But there’s a smart reason, a security reason for it. Basically, a keylogger is malicious software that records what you type on your keyboard. So if you type your passwords, the attacker might capture what you’re typing on your keyboard. A virtual keyboard gives you another way to enter the password by clicking the characters on the screen or with your mouse instead of typing them normally. It is there to help shield password entry from keyloggers or screen loggers.
Is this something you will use every single time? Maybe, maybe not. Hopefully not. But it’s a useful extra layer, especially when you’re using a computer that is not yours, that you don’t fully control; for example, a shared workstation or a hotel business centre or simply somebody else’s machine. It gives you a safer way to put in the password when you’re worried that the computer itself might be logging or watching what you type.
Just one more question. The press release talks about anti-fingerprint coating. Is that for security, or is it just so it doesn’t look like I’ve been eating crisps every time I pick it up?
Matteo: It’s a bit of both, actually, though I reckon crisp dust is absolutely a real-world threat nowadays. Joke apart, the obvious benefit is that this sort of oil- and fingerprint-proof coating keeps the drive looking cleaner. USB drives get handled a lot, thrown in bags, passed between people, generally treated like car keys, just thrown in a bag.
But there is also a subtle security angle here. Fingerprints and smudges can sometimes reveal handling patterns on devices. To give you a better example that suits more the security requirements: on devices with physical keypads, like our Keypad 200s and other models of IronKey, worn or smudged buttons can theoretically give clues about which keys were used to enter the PIN. Now, this Locker Plus 50 does not have a physical keypad, but keeping the surface fingerprint-proof is still useful from a privacy point of view.
We’ve got laptops and PCs that can be unlocked with fingerprints. Say you’ve been handling your drive with your thumb, exactly the one that you use to unlock your PC. Someone could use a special type of tape to extract your fingerprint from the surface of the drive and then use it to unlock your PC. I know that this sounds like a Mission Impossible kind of thing, but this can happen. So the anti-fingerprint coating is partly about keeping it tidy, partially about reducing visible handling marks, and also to make the whole ecosystem more secure and more durable, essentially.
Thank you. That explains everything I needed to know.
So, the more you know, kids.
Now, the Kingston IronKey Locker+ 50 G2 itself works flawlessly so far. I haven't used the on-screen keyboard much, other than to test it works, which it does, and I haven't dared see how many failed login attempts it takes for the drive to brick itself in the name of security, but the threat of it happening has certainly embedded the password firmly in my brain (and an undisclosed backup location where I've written it down).
It's light, well built and the 256GB of the most secure storage in my house has fast transfer speeds and easy booting and access (once you've logged into it) on any computer I've used.
And it still hasn't smudged much, so there.
Now, where did I put it?
