Content deleted Content added
Rescuing 1 sources and tagging 0 as dead.) #IABot (v2.0.9.5) (Pancho507 - 22019 |
Rescuing 1 sources and tagging 1 as dead.) #IABot (v2.0.9.5 |
||
| (9 intermediate revisions by 3 users not shown) | |||
Line 1:
{{short description|Cryptographic hardware}}
{{NPOV language|date=April 2013}}
'''Hardware-based full disk encryption''' ('''FDE''') is available from many [[hard disk drive]] (HDD/[[Solid-state drive|SSD]]) vendors, including: [[Hitachi]], Integral Memory, iStorage Limited, [[Micron Technology|Micron]], [[Seagate Technology]], [[Samsung]], [[Toshiba]], [[ViaSat|Viasat UK]], and [[Western Digital]]. The [[symmetric-key algorithm|symmetric encryption key]] is maintained independently from the computer's [[Central processing unit|CPU]], thus allowing the complete data store to be encrypted and removing computer memory as a potential attack vector.
Hardware-FDE has two major components: the hardware encryptor and the data store.
Line 15:
=== Hard disk drive FDE ===
Usually referred to as '''self-encrypting drive''' ('''SED''').
HDD FDE is made by HDD vendors using the [[Opal Storage Specification|OPAL]] and Enterprise standards developed by the [[Trusted Computing Group]].<ref>{{cite web |url=http://www.trustedcomputinggroup.org/solutions/data_protection |title=Trusted Computing Group Data Protection page |publisher=Trustedcomputinggroup.org |date= |access-date=2013-08-06 |url-status=dead |archive-url=https://archive.today/20120915073808/http://www.trustedcomputinggroup.org/solutions/data_protection |archive-date=2012-09-15 }}</ref> [[Key management]] takes place within the hard disk controller and encryption keys are 128 or 256 [[bit]] [[Advanced Encryption Standard]] (AES) keys. [[Authentication]] on power up of the drive must still take place within the [[Central processing unit|CPU]] via either a [[software]] [[pre-boot authentication]] environment (i.e., with a [[Disk encryption software|software-based full disk encryption]] component - hybrid full disk encryption) or with a [[BIOS]] password. In additions, some SEDs
[[Hitachi]], [[Micron Technology|Micron]], [[Seagate Technology|Seagate]], [[Samsung]], and [[Toshiba]] are the disk drive manufacturers offering [[Trusted Computing Group]] [[Opal Storage Specification]] [[Serial ATA]] drives. HDDs have become a commodity so SED allow drive manufacturers to maintain revenue.<ref>{{cite web |last1=Skamarock |first1=Anne |title=Is Storage a commodity |url=https://www.itworld.com/article/2799690/is-storage-a-commodity-.html |website=ITWorld.com |publisher=Network World |accessdate=2020-05-22 |date=2020-02-21 }}{{Dead link|date=August 2025 |bot=InternetArchiveBot |fix-attempted=yes }}</ref> Older technologies include the proprietary Seagate DriveTrust, and the older, and less secure, [[Parallel ATA|PATA]] Security command standard shipped by all drive makers including [[Western Digital]]. Enterprise SAS versions of the TCG standard are called "TCG Enterprise" drives.
=== Enclosed hard disk drive FDE ===
Line 27:
*Tampering is not an issue for SEDs as they cannot be read without the decryption key, regardless of access to the internal electronics {{Clarify|reason=see Talk page, decryption keys can be recovered from the internal electornics in several cases|date=July 2016}}.
=== Removable hard drive FDE ===
Line 43:
Hardware-based encryption when built into the drive or within the drive enclosure is notably transparent to the user. The drive, except for bootup authentication, operates just like any drive, with no degradation in performance. There is no complication or performance overhead, unlike [[disk encryption software]], since all the encryption is invisible to the [[operating system]] and the host [[Central processing unit|computer's processor]].
The two main use cases are [[Data at
For Data at
==={{anchor|Crypto erase}}Disk sanitisation===
Line 54:
===Protection from alternative boot methods===
Recent hardware models circumvents [[booting]] from other devices and allowing access by using a dual [[Master Boot Record]] (MBR) system whereby the MBR for the operating system and data files is all encrypted along with a special MBR which is required to boot the [[operating system]]. In SEDs, all data requests are intercepted by their [[firmware]], that does not allow decryption to take place unless the system has been [[Booting|booted]] from the special SED [[operating system]] which then loads the [[Master boot record|MBR]] of the encrypted part of the drive. This works by having a separate [[Disk partitioning|partition]], hidden from view, which contains the proprietary [[operating system]] for the encryption management system. This means no other boot methods will allow access to the drive.{{citation needed|date=December 2024}}
=== Vulnerabilities ===
Line 64:
=== Criticism ===
Hardware solutions have
In addition, implementing system wide hardware-based full disk encryption is prohibitive for many companies due to the high cost of replacing existing hardware. This makes migrating to hardware encryption technologies more difficult and would generally require a clear migration and central management solution for both hardware- and software-based [[Disk encryption#Full disk encryption|full disk encryption]] solutions.<ref>{{cite web|url=http://www.secude.com/html/?id=1375|archive-url=https://archive.today/20120909075410/http://www.secude.com/html/?id=1375|url-status=dead|archive-date=September 9, 2012|title=Closing the Legacy Gap|publisher=Secude|date=February 21, 2008|accessdate=2008-02-22}}</ref> however Enclosed hard disk drive FDE and Removable Hard Drive FDE are often installed on a single drive basis.
==See also==
* [[Disk encryption software]]
* [[Crypto-shredding]]
| |||