Hardware-based full disk encryption: Difference between revisions

Revision as of 14:37, 20 December 2019

Revision as of 20:27, 14 April 2020

Line 12:

#Enclosed hard disk drive FDE

#Bridge and [[Chipset]] (BC) FDE

Hardware designed for a particular purpose can often achieve better performance than [[disk encryption software]], and disk encryption hardware can be made more transparent to software than encryption done in software. As soon as the key has been initialized, the hardware should in principle be completely transparent to the OS and thus work with any OS. If the disk encryption hardware is integrated with the media itself the media may be designed for better integration. One example of such design would be through the use of physical sectors slightly larger than the logical sectors.

==Hard disk drive FDE==

Line 52 ⟶ 54:

The firmware of the drive may be compromised<ref>{{cite web | url = https://www.wired.com/2015/02/nsa-firmware-hacking/ | title = How the NSA’s Firmware Hacking Works and Why It’s So Unsettling | first = Kim | last = Zetter | date = 2015-02-22 | work = Wired }}</ref><ref>{{cite web | url = https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/ | title = Your hard drives were RIDDLED with NSA SPYWARE for YEARS | first = Darren | last = Pauli | date = 2015-02-17 | work = The Register }}</ref> and so any data that is sent to it may be at risk. Even if the data is encrypted on the physical medium of the drive, the fact that the firmware is controlled by a malicious third-party means that it can be decrypted by that third-party. If data is encrypted by the operating system, and it is sent in a scrambled form to the drive, then it would not matter if the firmware is malicious or not.

==Criticism==

Hardware solutions have also been criticised for being poorly documented{{fact|date=April 2014}}. Many aspects of how the encryption is done are not published by the vendor. This leaves the user with little possibility to judge the security of the product and potential attack methods. It also increases the risk of a [[vendor lock-in]].

In addition, implementing hardware-based full disk encryption is prohibitive for many companies due to the high cost of replacing existing hardware. This makes migrating to hardware encryption technologies more difficult and would generally require a clear migration and central management solution for both hardware- and software-based [[Disk encryption#Full disk encryption|full disk encryption]] solutions.<ref>{{cite document|url=http://www.secude.com/html/?id=1375|title=Closing the Legacy Gap|publisher=Secude|date=February 21, 2008|accessdate=2008-02-22}}{{dead link|date=September 2017 |bot=InternetArchiveBot |fix-attempted=yes }}</ref>

==See also==

Line 59 ⟶ 66:

* [[Opal Storage Specification]]

* [[Yubikey]]

* [[Full disk encryption]]

* [[IBM Secure Blue]]

==References==