@IlmariKaronen Note that mods can reverse a bounty (giving back the rep to a user) so if you feel that a bounty is used to avoid being closed then please flag the question. In this case I don't see any previous close votes and I guess the technique could be used to attack IV reuse on a stream cipher, so I don't think I would have reversed the bounty, but OK, the option is there.

Posted it here in chat as this might be useful to anybody... seems a bit too little to make it a Meta topic.

@bdegnan Fascinating! Can you estimate the accuracy of the recovery? Assuming one were to store n bits of data and hash that data to derive a key, about how large would n need to be before it would be computationally infeasible to recover the key?

@bdegnan (I assume this technique is limited to flash and could not be generalized to HDDs?)

This is a very interesting result I have to say, since many, many current designs rely on the ability to erase solid state memory to destroy keys (ATA SED, TPM secrets, TEE for mobile devices, etc)