Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any known flaws in the full disk encryption on Intel 520 series SSD drives?

Specifically, it seems these drives generate an internal AES key automatically, even when no password is set. But is the ATA password (also known as "BIOS HDD password") really used to encrypt the internal AES key, or is that internal key stored in plaintext?

share|improve this question
9  
According to a forum posting by Intel, the BIOS HDD password is indeed used to secure the internal key: "Yes, ATA password is used to encrypt the encryption keys stores on the SSD." (communities.intel.com/message/120689#120689) The question remains whether there are any other known weaknesses. –  LTR Sep 17 '12 at 13:48
add comment

2 Answers

up vote 10 down vote accepted

I will try to answer your question as specifically as possible.

I contacted Intel tech support to ask them exactly this question: Is the AES key on the Intel 520 encrypted with the ATA password. After weeks of back and forth, I finally received an explicit confirmation from them. I quote:

Yes, ATA password is used to encrypt the encryption keys stores on the SSD. In other words: The Encryption Keys depends on the ATA password to decrypt them. The ATA password is not used in combination with the Encryption Keys to encrypt the data.

I also found this Intel white paper http://communities.intel.com/docs/DOC-19512 that claims the following:

How Self-encrypting drives (SEDs) Work: SEDs, such as the Intel® SSD 320 Series and Intel® SSD 520 Series, have a drive ... Because the disk encryption key is encrypted with the ATA (Advanced Technology Attachment) passwords

I summarised most of my findings about SED SSDs in this blog post: http://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hardware-based-full-disk-encryption/

share|improve this answer
add comment

I read two questions:

  1. How secure is the Intel SSD encryption ?
  2. Are there any known flaws to the full-disk encryption of [specific models]?

To address the first question about "how secure" it is... As with any security the answer is always relative. Sector-based (hardware) encryption on-disk is orders of magnitude more secure than software based data security. Why? Access.

I worked at a data security software company for several years that had some of the best root-kit and Windows NTFS hackers in the world. After many attempts, they established and conceded that hardware/disk/sector based encryption was much more secure (and less complicated) than software. Software can be circumvented and fooled, especially the lower in the stack you get (all the way down to the BIOS). Hardware based encryption by Intel and others is device-based and as such I am not even aware of a BIOS hack that can get under it.

The military and secret data organizations regularly require disk based encryption to remedy the "stolen laptop" problem. Short of removing the disk drives and putting them in a fire-proof safe (which some organizations actually do), device based encryption from Intel and others is probably the best way to safeguard data [completely] at rest.

I have not read of any flaws in the design of such implementations and I suspect if they were found in the wild it would be a big headline. NIST and other groups strongly endorse and encourage use of this technology for securing data at rest.

share|improve this answer
    
hardware keylogger may still be used to "crack" hardware HDD password-based encryption, isn't it? –  Sarge Borsch Apr 20 at 10:40
    
The key-logger would have to be deeper in the stack than the very low (BIOS I believe) input for the full-disk PW. This is lower than the normal (Windows for example) operating system device input path where most key-loggers target to get underneath. In any case, one could argue this is a hack to the interface versus the stolen disk (at rest) scenario. Still, there are no known key-loggers (virus/root kit) that get beneath the BIOS level password input. –  Darrell Teague yesterday
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.