Hardware-based full disk encryption: Difference between revisions

Revision as of 08:05, 12 February 2025

Latest revision as of 10:05, 10 August 2025

(3 intermediate revisions by 2 users not shown)

Line 17:

HDD FDE is made by HDD vendors using the [[Opal Storage Specification|OPAL]] and Enterprise standards developed by the [[Trusted Computing Group]].<ref>{{cite web |url=http://www.trustedcomputinggroup.org/solutions/data_protection |title=Trusted Computing Group Data Protection page |publisher=Trustedcomputinggroup.org |date= |access-date=2013-08-06 |url-status=dead |archive-url=https://archive.today/20120915073808/http://www.trustedcomputinggroup.org/solutions/data_protection |archive-date=2012-09-15 }}</ref> [[Key management]] takes place within the hard disk controller and encryption keys are 128 or 256 [[bit]] [[Advanced Encryption Standard]] (AES) keys. [[Authentication]] on power up of the drive must still take place within the [[Central processing unit|CPU]] via either a [[software]] [[pre-boot authentication]] environment (i.e., with a [[Disk encryption software|software-based full disk encryption]] component - hybrid full disk encryption) or with a [[BIOS]] password. In additions, some SEDs support [[IEEE 1667]] standard.<ref>{{Cite web |title=The Value of Crucial Hardware Encryption |url=https://eu.crucial.com/support/hardware-encryption |access-date=2024-11-16 |website=Crucial |language=en}}</ref>

[[Hitachi]], [[Micron Technology|Micron]], [[Seagate Technology|Seagate]], [[Samsung]], and [[Toshiba]] are the disk drive manufacturers offering [[Trusted Computing Group]] [[Opal Storage Specification]] [[Serial ATA]] drives. HDDs have become a commodity so SED allow drive manufacturers to maintain revenue.<ref>{{cite web |last1=Skamarock |first1=Anne |title=Is Storage a commodity |url=https://www.itworld.com/article/2799690/is-storage-a-commodity-.html |website=ITWorld.com |publisher=Network World |accessdate=2020-05-22 |date=2020-02-21 }}{{Dead link|date=August 2025 |bot=InternetArchiveBot |fix-attempted=yes }}</ref> Older technologies include the proprietary Seagate DriveTrust, and the older, and less secure, [[Parallel ATA|PATA]] Security command standard shipped by all drive makers including [[Western Digital]]. Enterprise SAS versions of the TCG standard are called "TCG Enterprise" drives.

=== Enclosed hard disk drive FDE ===

Line 27:

*Tampering is not an issue for SEDs as they cannot be read without the decryption key, regardless of access to the internal electronics {{Clarify|reason=see Talk page, decryption keys can be recovered from the internal electornics in several cases|date=July 2016}}.

Examples include [[ViaSat|Viasat UK (formerly Stonewood Electronics)]] with their FlagStone, Eclypt<ref name="softpedia">{{cite web|url=http://news.softpedia.com/news/Stonewood-039-s-Eclypt-Drive-the-AES-256-Data-Fortress-84632.shtml |title=Softpedia on Eclypt Drive AES-256 |publisher=News.softpedia.com |date=2008-04-30 |accessdate=2013-08-06}}</ref> and DARC-ssd<ref>{{cite web |title=Data At Rest (DAR) encryption solutions |url=https://www.viasat.com/products/cybersecurity/data-at-rest-encryption/ |website=www.Viasat.com |publisher=Viasat, Inc. ©2023 |access-date=2 February 2023}}</ref> drives or GuardDisk <ref>{{cite web |title=Hardware Disk Encryption for the Masses, Finally! |url=https://www.turbotas.co.uk/2003/07/30/hardware-disk-encryption-for-the-masses-finally/ |website=turbotas.co.uk |publisher=Turbotas |accessdate=2020-05-22 |date=2003-05-30 |archive-date=2020-09-25 |archive-url=https://web.archive.org/web/20200925191820/https://www.turbotas.co.uk/2003/07/30/hardware-disk-encryption-for-the-masses-finally/ |url-status=dead }}</ref> with an [[Radio-frequency identification|RFID]] token.

=== Removable hard drive FDE ===

Line 45:

The two main use cases are [[Data at rest]] protection, and Cryptographic Disk Erasure.

For Data at rest protection a computer or laptop is simply powered off. The disk now self-protects all the data on it. The data is safe because all of it, even the OS, is now encrypted, with a secure mode of [[Advanced Encryption Standard|AES]], and locked from reading and writing. The drive requires an authentication code which can be as strong as 32 {{nbs}}bytes (2^256{{nbs}}bits) to unlock.

==={{anchor|Crypto erase}}Disk sanitisation===

Line 64:

=== Criticism ===

Hardware solutions have alsogained been criticisedcriticism for being poorly documented{{by whom|date=April 2014}}. Many aspects of how the encryption is done are not published by the vendor. This leaves the user with little possibility to judge the security of the product and potential attack methods. It also increases the risk of a [[vendor lock-in]].

In addition, implementing system wide hardware-based full disk encryption is prohibitive for many companies due to the high cost of replacing existing hardware. This makes migrating to hardware encryption technologies more difficult and would generally require a clear migration and central management solution for both hardware- and software-based [[Disk encryption#Full disk encryption|full disk encryption]] solutions.<ref>{{cite web|url=http://www.secude.com/html/?id=1375|archive-url=https://archive.today/20120909075410/http://www.secude.com/html/?id=1375|url-status=dead|archive-date=September 9, 2012|title=Closing the Legacy Gap|publisher=Secude|date=February 21, 2008|accessdate=2008-02-22}}</ref> however Enclosed hard disk drive FDE and Removable Hard Drive FDE are often installed on a single drive basis.

==See also==

* [[Disk encryption hardware]] <!-- The page linked contains unbalanced criticism should to be merged into this page -->

* [[Disk encryption software]]

* [[Crypto-shredding]]