Hardware-based full disk encryption: Difference between revisions

Revision as of 22:19, 28 December 2023

Revision as of 17:38, 29 December 2023

Line 1:

{{short description|Cryptographic hardware}}

{{NPOV language|date=April 2013}}

'''Hardware-based full disk encryption''' ('''FDE''') is available from many [[hard disk drive]] (HDD/[[Solid-state drive|SSD]]) vendors, including: ClevX, [[Hitachi]], Integral Memory, iStorage Limited, [[Micron Technology|Micron]], [[Seagate Technology]], [[Samsung]], [[Toshiba]], [[ViaSat|Viasat UK]], [[Western Digital]]. The [[symmetric-key algorithm|symmetric encryption key]] is maintained independently from the computer's [[Central processing unit|CPU]], thus allowing the complete data store to be encrypted and removing computer memory as a potential attack vector.

Hardware-FDE has two major components: the hardware encryptor and the data store.

Line 18:

[[Hitachi]], [[Micron Technology|Micron]], [[Seagate Technology|Seagate]], [[Samsung]], and [[Toshiba]] are the disk drive manufacturers offering [[Trusted Computing Group]] [[Opal Storage Specification]] [[Serial ATA]] drives. HDDs have become a commodity so SED allow drive manufacturers to maintain revenue.<ref>{{cite web |last1=Skamarock |first1=Anne |title=Is Storage a commodity |url=https://www.itworld.com/article/2799690/is-storage-a-commodity-.html |website=ITWorld.com |publisher=Network World |accessdate=2020-05-22 |date=2020-02-21}}</ref> Older technologies include the proprietary Seagate DriveTrust, and the older, and less secure, [[Parallel ATA|PATA]] Security command standard shipped by all drive makers including [[Western Digital]]. Enterprise SAS versions of the TCG standard are called "TCG Enterprise" drives.

There are other (non-TCG/OPAL based) self-encrypted drives (SED) that don’t have the known vulnerabilities of the TCG/OPAL based drives. For example, ClevX SEDs (2.5” SATA and M.2 NVMe form-factors) with smartphone user-authentication and remote management ready<ref>{{Cite web |title=ClevX's DataLock Secures M.2 SSDs With a Smartphone |url=https://www.tomshardware.com/news/clevx-datalock-secures-m2-ssds-with-smartphone |access-date=2023-12-28 |website=Tom's Hardware |language=en}}</ref>. They are Host/OS and BIOS independent and don’t rely on the TPM module or the motherboard BIOS, and their Encryption Key never leaves the crypto-boundary of the drive.

=== Enclosed hard disk drive FDE ===