4 ms·
Be aware that hardware encryption provided by SSDs should not be trusted. I doubt the situation has gotten any better since 2018. > In theory, the security gua
by jiripospisil 6y ago
Be aware that hardware encryption provided by SSDs should not be trusted. I doubt the situation has gotten any better since 2018.
> In theory, the security guarantees offered by hardware encryption are similar to or better than software implementations. In reality, we found that many models using hardware encryption have critical security weaknesses due to specification, design, and implementation issues. For many models, these security weaknesses allow for complete recovery of the data without knowledge of any secret (such as the password). BitLocker, the encryption software built into Microsoft Windows will rely exclusively on hardware full-disk encryption if the SSD advertises support for it. Thus, for these drives, data protected by BitLocker is also compromised.
Source: Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives (https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8835339 https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=883...)
- throwawaywindev 6y agoIt’s not really about trust for me, it’s an employer requirement to have Bitlocker turned on.
- jiripospisil 6y agoIt looks like Microsoft released an update on September 24, 2019 that defaults new drives to use software encryption instead (I'm guessing it uses AES-NI under the hood if available): > Changes the default setting for BitLocker when encrypting a self-encrypting hard drive. Now, the default is to use software encryption for newly encrypted drives. For existing drives, the type of encryption will not change. Source: https://support.microsoft.com/en-us/topic/september-24-2019-kb4516071-os-build-16299-1420-5648029d-8d1c-ed9e-b72c-63c6fee30bff https://support.microsoft.com/en-us/topic/september-24-2019-...
- patentatt 6y agoAnd last I looked into this, nvme doesn’t support edrive encryption. And it doesn’t really matter very much any more with all of the encryption accelerators in modern cpus. Someone please correct me on either account if I’m wrong!
- fassssst 6y agoDamn, wish I knew this before I returned the WD for a Samsung 980 Pro. I just checked and hardware encryption isn’t even turned on and I would have to wipe to enable it :(