Hardware-based full disk encryption
Encyclopedia
Hardware-based full disk encryption
(FDE) is available from many hard disk drive (HDD) vendors, including: Seagate Technology
, Hitachi
, Western Digital
, Samsung
, Toshiba
and also solid-state drive
vendors such as Samsung
. The symmetric encryption key
is maintained independently from the CPU
, thus removing computer memory as a potential attack vector.
Hardware-FDE has 2 major components: the hardware encryptor and the data store.
There are currently three varieties of hardware-FDE:
.. Key management
takes place within the hard disk controller and encryption keys are 128 or 256 bit
Advanced Encryption Standard
(AES) keys. Authentication
on power up of the drive must still take place within the CPU
via either a software pre-boot authentication
environment (i.e., with a software-based full disk encryption
component - hybrid full disk encryption) or with a BIOS
password.
Hitachi
, Seagate
, Samsung
, and Toshiba
are the disk drive manufacturers offering TCG
OPAL SATA
drives. Older technologies include the proprietary Seagate DriveTrust, and the older, and less secure, PATA Security command standard shipped by all drive makers including Western Digital
. Enterprise SAS versions of the TCG standard are called "TCG Enterprise" drives. All drive makers have suggested the appropriate term for this new class of device and new type of functionality be "self-encrypting drives."
For example ViaSat
(formally Stonewood Electronics) with their FlagStone and Eclypt drives.
Intel announced the release of the Danbury chipset but has since abandoned this approach.
, since all the encryption is invisible to the operating system
and the host computers processor
.
The two main use cases are Data At Rest protection, and Cryptographic Disk Erasure.
In Data At Rest protection a laptop is simply closed which powers down the disk. The disk now self-protects all the data on it. Because all the data, even the OS, is now encrypted, with a secure mode of AES
, and locked from reading and writing the data is safe. The drive requires an authentication code which can be as strong as 32 bytes (2^256) to unlock.
When a Cryptographic Disk Erasure command is given (with proper authentication credentials), the drive self-generates a new media encryption key and goes into a 'new drive' state. The old data has become irretrievable. Unlike other forms of sanitization, this action takes a few milliseconds at most. So a drive can be safely repurposed very quickly.
FDE is only safe when the computer is off or hibernated. If the computer is stolen while turned on or only suspended, a restart which boots from a USB stick or CD may reveal the data without need for the password because it may not be prompted to be entered.
Some specific hardware configurations may have additional protection mechanisms to limit this exposure.
Full disk encryption
Disk encryption uses disk encryption software or hardware to encrypt every bit of data that goes on a disk or disk volume. Disk encryption prevents unauthorized access to data storage. The term "full disk encryption" is often used to signify that everything on a disk is encrypted, including the...
(FDE) is available from many hard disk drive (HDD) vendors, including: Seagate Technology
Seagate Technology
Seagate Technology is one of the world's largest manufacturers of hard disk drives. Incorporated in 1978 as Shugart Technology, Seagate is currently incorporated in Dublin, Ireland and has its principal executive offices in Scotts Valley, California, United States.-1970s:On November 1, 1979...
, Hitachi
Hitachi
Hitachi is a multinational corporation specializing in high-technology.Hitachi may also refer to:*Hitachi, Ibaraki, Japan*Hitachi province, former province of Japan*Prince Hitachi and Princess Hitachi, members of the Japanese imperial family...
, Western Digital
Western Digital
Western Digital Corporation is one of the largest computer hard disk drive manufacturers in the world. It has a long history in the electronics industry as an integrated circuit maker and a storage products company. Western Digital was founded on April 23, 1970 by Alvin B...
, Samsung
Samsung
The Samsung Group is a South Korean multinational conglomerate corporation headquartered in Samsung Town, Seoul, South Korea...
, Toshiba
Toshiba
is a multinational electronics and electrical equipment corporation headquartered in Tokyo, Japan. It is a diversified manufacturer and marketer of electrical products, spanning information & communications equipment and systems, Internet-based solutions and services, electronic components and...
and also solid-state drive
Solid-state drive
A solid-state drive , sometimes called a solid-state disk or electronic disk, is a data storage device that uses solid-state memory to store persistent data with the intention of providing access in the same manner of a traditional block i/o hard disk drive...
vendors such as Samsung
Samsung
The Samsung Group is a South Korean multinational conglomerate corporation headquartered in Samsung Town, Seoul, South Korea...
. The symmetric encryption key
Symmetric-key algorithm
Symmetric-key algorithms are a class of algorithms for cryptography that use trivially related, often identical, cryptographic keys for both encryption of plaintext and decryption of ciphertext. The encryption key is trivially related to the decryption key, in that they may be identical or there is...
is maintained independently from the CPU
Central processing unit
The central processing unit is the portion of a computer system that carries out the instructions of a computer program, to perform the basic arithmetical, logical, and input/output operations of the system. The CPU plays a role somewhat analogous to the brain in the computer. The term has been in...
, thus removing computer memory as a potential attack vector.
Hardware-FDE has 2 major components: the hardware encryptor and the data store.
There are currently three varieties of hardware-FDE:
- Hard Disk Drive (HDD) FDE
- Enclosed Hard Disk Drive
- Bridge and Chipset (BC) FDE
Hard disk drive FDE
HDD FDE is made by HDD vendors using the OPAL and Enterprise standards - Trusted Computing GroupTrusted Computing Group
The Trusted Computing Group , successor to the Trusted Computing Platform Alliance , is an initiative started by AMD, Hewlett-Packard, IBM, Intel, and Microsoft to implement Trusted Computing...
.. Key management
Key management
Key management is the provisions made in a cryptography system design that are related to generation, exchange, storage, safeguarding, use, vetting, and replacement of keys. It includes cryptographic protocol design, key servers, user procedures, and other relevant protocols.Key management concerns...
takes place within the hard disk controller and encryption keys are 128 or 256 bit
Bit
A bit is the basic unit of information in computing and telecommunications; it is the amount of information stored by a digital device or other physical system that exists in one of two possible distinct states...
Advanced Encryption Standard
Advanced Encryption Standard
Advanced Encryption Standard is a specification for the encryption of electronic data. It has been adopted by the U.S. government and is now used worldwide. It supersedes DES...
(AES) keys. Authentication
Authentication
Authentication is the act of confirming the truth of an attribute of a datum or entity...
on power up of the drive must still take place within the CPU
Central processing unit
The central processing unit is the portion of a computer system that carries out the instructions of a computer program, to perform the basic arithmetical, logical, and input/output operations of the system. The CPU plays a role somewhat analogous to the brain in the computer. The term has been in...
via either a software pre-boot authentication
Pre-boot authentication
Pre-Boot Authentication or Power-On Authentication serves as an extension of the BIOS or boot firmware and guarantees a secure, tamper-proof environment external to the operating system as a trusted authentication layer...
environment (i.e., with a software-based full disk encryption
Disk encryption software
To protect confidentiality of the data stored on a computer disk a computer security technique called disk encryption is used. This article discusses software that is used to implement the technique...
component - hybrid full disk encryption) or with a BIOS
BIOS
In IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
password.
Hitachi
Hitachi
Hitachi is a multinational corporation specializing in high-technology.Hitachi may also refer to:*Hitachi, Ibaraki, Japan*Hitachi province, former province of Japan*Prince Hitachi and Princess Hitachi, members of the Japanese imperial family...
, Seagate
Seagate Technology
Seagate Technology is one of the world's largest manufacturers of hard disk drives. Incorporated in 1978 as Shugart Technology, Seagate is currently incorporated in Dublin, Ireland and has its principal executive offices in Scotts Valley, California, United States.-1970s:On November 1, 1979...
, Samsung
Samsung
The Samsung Group is a South Korean multinational conglomerate corporation headquartered in Samsung Town, Seoul, South Korea...
, and Toshiba
Toshiba
is a multinational electronics and electrical equipment corporation headquartered in Tokyo, Japan. It is a diversified manufacturer and marketer of electrical products, spanning information & communications equipment and systems, Internet-based solutions and services, electronic components and...
are the disk drive manufacturers offering TCG
Trusted Computing Group
The Trusted Computing Group , successor to the Trusted Computing Platform Alliance , is an initiative started by AMD, Hewlett-Packard, IBM, Intel, and Microsoft to implement Trusted Computing...
OPAL SATA
Serial ATA
Serial ATA is a computer bus interface for connecting host bus adapters to mass storage devices such as hard disk drives and optical drives...
drives. Older technologies include the proprietary Seagate DriveTrust, and the older, and less secure, PATA Security command standard shipped by all drive makers including Western Digital
Western Digital
Western Digital Corporation is one of the largest computer hard disk drive manufacturers in the world. It has a long history in the electronics industry as an integrated circuit maker and a storage products company. Western Digital was founded on April 23, 1970 by Alvin B...
. Enterprise SAS versions of the TCG standard are called "TCG Enterprise" drives. All drive makers have suggested the appropriate term for this new class of device and new type of functionality be "self-encrypting drives."
Enclosed hard disk drive FDE
Within a standard hard drive form factor case both the encryptor (BC) and a smaller form factor, commercially available, hard disk drive is enclosed.- The enclosed hard disk drive's case can be tamper-evidentTamper-evidentTamper-evident describes a device or process that makes unauthorized access to the protected object easily detected. Seals, markings or other techniques may be tamper indicating.-Tampering:...
, so when retrieved the user can be assured that the data has not been compromised. - The encryptors electronics and integral hard drive, if it is solid-stateSolid-state driveA solid-state drive , sometimes called a solid-state disk or electronic disk, is a data storage device that uses solid-state memory to store persistent data with the intention of providing access in the same manner of a traditional block i/o hard disk drive...
, can be protected by other tamper respondentTamper resistanceTamper resistance is resistance to tampering by either the normal users of a product, package, or system or others with physical access to it. There are many reasons for employing tamper resistance....
measures.
For example ViaSat
ViaSat
ViaSat is a communication company based in Carlsbad, California, that provides equipment and services for military and commercial communications, primarily in satellite related technologies...
(formally Stonewood Electronics) with their FlagStone and Eclypt drives.
Chipset FDE
The encryptor bridge and chipset (BC) is placed between the computer and the standard hard disk drive, encrypting every sector written to it.Intel announced the release of the Danbury chipset but has since abandoned this approach.
Advantages
Hardware-based encryption when built into the drive or within the drive enclosure is notably transparent to the user. The drive except for bootup authentication operates just like any drive with no degradation in performance. There is no complication or performance overhead, unlike disk encryption softwareDisk encryption software
To protect confidentiality of the data stored on a computer disk a computer security technique called disk encryption is used. This article discusses software that is used to implement the technique...
, since all the encryption is invisible to the operating system
Operating system
An operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
and the host computers processor
Central processing unit
The central processing unit is the portion of a computer system that carries out the instructions of a computer program, to perform the basic arithmetical, logical, and input/output operations of the system. The CPU plays a role somewhat analogous to the brain in the computer. The term has been in...
.
The two main use cases are Data At Rest protection, and Cryptographic Disk Erasure.
In Data At Rest protection a laptop is simply closed which powers down the disk. The disk now self-protects all the data on it. Because all the data, even the OS, is now encrypted, with a secure mode of AES
Advanced Encryption Standard
Advanced Encryption Standard is a specification for the encryption of electronic data. It has been adopted by the U.S. government and is now used worldwide. It supersedes DES...
, and locked from reading and writing the data is safe. The drive requires an authentication code which can be as strong as 32 bytes (2^256) to unlock.
When a Cryptographic Disk Erasure command is given (with proper authentication credentials), the drive self-generates a new media encryption key and goes into a 'new drive' state. The old data has become irretrievable. Unlike other forms of sanitization, this action takes a few milliseconds at most. So a drive can be safely repurposed very quickly.
Disadvantages
- Pure hardware-based FDE does not have any strong authentication component
- Lack of scalable management; no central management component
FDE is only safe when the computer is off or hibernated. If the computer is stolen while turned on or only suspended, a restart which boots from a USB stick or CD may reveal the data without need for the password because it may not be prompted to be entered.
Some specific hardware configurations may have additional protection mechanisms to limit this exposure.