Hardware-based full disk encryption: Difference between revisions

Revision as of 23:34, 18 June 2021

Revision as of 05:24, 30 January 2022

Line 1:

{{NPOV language|date=April 2013}}

{{short description|Cryptographic hardware}}

{{NPOV language|date=April 2013}}

'''Hardware-based full disk encryption''' ('''FDE''') is available from many [[hard disk drive]] (HDD/[[Solid-state drive|SSD]]) vendors, including: ClevX, [[Hitachi]], Integral Memory, iStorage Limited, [[Micron Technology|Micron]], [[Seagate Technology]], [[Samsung]], [[Toshiba]], [[ViaSat|Viasat UK]], [[Western Digital]]. The [[symmetric-key algorithm|symmetric encryption key]] is maintained independently from the computer's [[Central processing unit|CPU]], thus allowing the complete data store to be encrypted and removing computer memory as a potential attack vector.

Hardware-FDE has two major components: the hardware encryptor and the data store.

Line 15:

=== Hard disk drive FDE ===

Usually referred to as '''self-encrypting drive''' ('''SED''').

HDD FDE is made by HDD vendors using the [[Opal Storage Specification|OPAL]] and Enterprise standards developed by the [[Trusted Computing Group]].<ref>{{cite web |url=http://www.trustedcomputinggroup.org/solutions/data_protection |title=Trusted Computing Group Data Protection page |publisher=Trustedcomputinggroup.org |date= |access-date=2013-08-06 |url-status=dead |archive-url=https://www.webcitation.org/65fUDqdql?url=http://www.trustedcomputinggroup.org/solutions/data_protection |archive-date=2012-02-23 |df= }}</ref> [[Key management]] takes place within the hard disk controller and encryption keys are 128 or 256 [[bit]] [[Advanced Encryption Standard]] (AES) keys. [[Authentication]] on power up of the drive must still take place within the [[Central processing unit|CPU]] via either a [[software]] [[pre-boot authentication]] environment (i.e., with a [[Disk encryption software|software-based full disk encryption]] component - hybrid full disk encryption) or with a [[BIOS]] password.

[[Hitachi]], [[Micron Technology|Micron]], [[Seagate Technology|Seagate]], [[Samsung]], and [[Toshiba]] are the disk drive manufacturers offering [[Trusted Computing Group|TCG]] [[Opal Storage Specification|OPAL]] [[Serial ATA|SATA]] drives. HDDs have become a commodity so SED allow drive manufacturers to maintain revenue.<ref>{{cite web |last1=Skamarock |first1=Anne |title=Is Storage a commodity |url=https://www.itworld.com/article/2799690/is-storage-a-commodity-.html |website=ITWorld.com |publisher=Network World |accessdate=2020-05-22 |date=2020-02-21}}</ref> Older technologies include the proprietary Seagate DriveTrust, and the older, and less secure, [[Parallel ATA|PATA]] Security command standard shipped by all drive makers including [[Western Digital]]. Enterprise SAS versions of the TCG standard are called "TCG Enterprise" drives.

Line 49:

==={{anchor|Crypto erase}}Disk sanitisation===

[[Crypto-shredding]] is the practice of 'deleting' data by (only) deleting or overwriting the encryption keys.

When a cryptographic disk erasure (or crypto erase) command is given (with proper authentication credentials), the drive self-generates a new media encryption key and goes into a 'new drive' state.<ref>{{cite web |title=10 Reasons to Buy Self-Encrypting Drives |author=Trusted Computing Group |url=https://www.trustedcomputinggroup.org/wp-content/uploads/10-Reasons-to-Buy-SEDs_Sept.2010.pdf |year=2010 |publisher=Trusted Computing Group |accessdate=2018-06-06}}</ref> Without the old key, the old data becomes irretrievable and therefore an efficient means of providing [[Data erasure|disk sanitisation]] which can be a lengthy (and costly) process. For example, an unencrypted and unclassified computer hard drive that requires sanitising to conform with [[United States Department of Defense|Department of Defense]] Standards must be overwritten 3+ times;<ref>http://www-03.ibm.com/systems/resources/IBM_Certified_Secure_Data_Overwrite_Service_SB.pdf</ref> a one Terabyte Enterprise SATA3 disk would take many hours to complete this process. Although the use of faster [[solid-state drive]]s (SSD) technologies improves this situation, the take up by enterprise has so far been slow.<ref>{{cite web |title=Slow on the Uptake |url=https://docplayer.net/30164112-Ssd-story-slow-on-the-uptake.html |access-date=18 February 2021}}</ref> The problem will worsen as disk sizes increase every year. With encrypted drives a complete and secure data erasure action takes just a few milliseconds with a simple key change, so a drive can be safely repurposed very quickly. This sanitisation activity is protected in SEDs by the drive's own key management system built into the firmware in order to prevent accidental data erasure with confirmation passwords and secure authentications related to the original key required.

When [[Cryptographic key|keys]] are self-generated randomly, generally there is no method to store a copy to allow [[data recovery]]. In this case protecting this data from accidental loss or theft is achieved through a consistent and comprehensive data backup policy. The other method is for user-defined keys, for some Enclosed hard disk drive FDE,<ref>{{cite web |title=Eclypt Core Encrypted Internal Hard Drive |url=https://www.viasat.com/products/cybersecurity/data-at-rest-encryption/ |website=Viasat.com |publisher=Viasat |accessdate=2021-02-17 |date=2020}}</ref> to be generated externally and then loaded into the FDE.

Line 64:

=== Criticism ===

Hardware solutions have also been criticised for being poorly documented{{factcitation needed|date=April 2014}}. Many aspects of how the encryption is done are not published by the vendor. This leaves the user with little possibility to judge the security of the product and potential attack methods. It also increases the risk of a [[vendor lock-in]].

In addition, implementing system wide hardware-based full disk encryption is prohibitive for many companies due to the high cost of replacing existing hardware. This makes migrating to hardware encryption technologies more difficult and would generally require a clear migration and central management solution for both hardware- and software-based [[Disk encryption#Full disk encryption|full disk encryption]] solutions.<ref>{{cite document|url=http://www.secude.com/html/?id=1375|archive-url=https://archive.today/20120909075410/http://www.secude.com/html/?id=1375|url-status=dead|archive-date=September 9, 2012|title=Closing the Legacy Gap|publisher=Secude|date=February 21, 2008|accessdate=2008-02-22}}</ref> however Enclosed hard disk drive FDE and Removable Hard Drive FDE are often installed on a single drive basis.

Line 79:

==References==

{{Reflist}}

[[Category:Disk encryption]]