I've contributed to the development of a crypto-related device that was certified to FIPS standards. It's an extensive, expensive certification process that's really only relevant to specific use cases. FIPS isn't about having the best encryption, it's about having a crypto engine that was independently tested and verified against a known list of security requirements. There were actually instances where we had to bypass security features in order to meet the FIPS testability criteria. For customers that need it, though, that testability is more important than a little bit of additional security. A lot of times, end-users can perform many of the FIPS tests themselves should they ever want to double-check that it's working as expected.
The NIST website has a listing of every device that has achieved FIPS certification. Here's a listing for a similar Kingston product. You can see third-party validation certificates for every crypto algorithm used by the device. Plus, there's a "security policy" document that goes into detail about how the encryption system is designed and implemented. You don't have to blindly trust the device or take the manufacturer's word that it's designed well. You can see so for yourself. Multiple third parties have also verified that the documentation matches the implementation, that the implementation was done according to established standards, and that the implementation is free from a very long list of common problems/deficiencies. Customers in security-critical applications need that sort of verifiability and are willing to pay a lot more for it.
Most crypto devices are certified at level 1, which is enough to meet most industry and regulatory requirements that include crypto (PCI DSS, HIPAA, etc). If you're in an industry subject to those requirements, buying something FIPS-certified is an easy way to know that you've met your encryption-related obligations.
Each level is an order of magnitude harder to achieve than the one before it. A level 3 certification is downright impressive. For a USB drive, this probably means that all keys and encryption-related values are stored in a dedicated volatile memory chip with battery backup. The case is constructed so that any attempts to open the case would disconnect the battery, wiping the chip's contents and zeroing out the keys. Some will similarly self-destruct if the temperature or pressure gets too high or low. The manufacturer's page says the drive is "epoxy filled", which usually implies that the epoxy cannot be melted, scraped away, or otherwise removed without either destroying the chips or disconnecting volatile memory from power in the process. By the time you get to level 3, you're protecting against some serious (and uncommon) attack vectors. If you're buying a level 3 device, it's because there's a real chance that someone is trying to freeze the device with liquid nitrogen to pull bits from memory after disconnecting power, to re-wire the hardware without your knowledge to add a clandestine transmitter, or to disassemble the device, dump the flash contents, and try to decrypt it using a supercomputer cluster.
For the normal consumer, you don't need any of that and a device like that is way beyond overkill. You don't have any data valuable enough that someone is going to go to such expensive lengths to try and get at it.
The other big benefit to FIPS certified devices is that they generally support some sort of centralized key management. The FIPS specs have a concept of different users with different privilege levels. A "crypto officer" can do anything crypto-related, and other users may (for instance) be allowed to read and write data but not rekey the data or convert the drive to plaintext. That Kingston drive in particular supports their centralized key management systems, which enables system administrators to securely store and back up keys, manage access permissions, etc. It can even prevent the device from being unlocked unless it's connected to a computer attached to the internal network. Again, these are all features that might be useful if you're running an embassy, but not so much if you're a normal consumer.
If you ignore the FIPS aspect for a moment, there are some real reasons why you might want a device that does hardware-based encryption rather than a software solution:
- Hardware-based encryption can be transparent. You don't need any special hardware or software on the computer it's connected to, everything is self-contained. This is important if you want to use the device somewhere that you can't install software.
- Many times, hardware-based encryption can be accomplished with a negligible or zero performance penalty, where software-based encryption requires extra work from the host's CPU.
- Hardware encryption devices can support additional features, like a "panic button" that wipes the device without requiring it to be attached to a computer.
- Restrictions in software-based encryption are easier to bypass. For example, that encrypted flash drive wipes itself after ten invalid password attempts. With Veracrypt, I could connect your drive to my hacked version of the software that doesn't have that limitation and brute-force my way in. That's not a feasible attack vector if the security is baked into the silicon.
That certainly doesn't mean you need that FIPS level 3 monster, though.
