2

A lot of SSDs now implement OPAL-compliant AES hardware encryption, which seems to be the only option to get full-disk encryption on modern PCs without buying the (very expensive) Windows 10 Pro edition.

I enabled this encryption with a HDD password in the UEFI, but from what I've read, BIOS- or UEFI-based HDD password can be unreliable (and you have no way to know whether your model implements it correctly until you get hacked).

I searched on how to enable OPAL encryption, but this information seems to be inexistent. Every webpage talking about OPAL says that it's activated by a software, but no one seems to know which software.

I tried the vendor's SSD managing software (Samsung Magician), but it only says that I need "specialized software". It seems that Microsoft BitLocker can use this, but as I said, this is only in Windows Pro and the price is incredibly high.

Is there any Windows software capable of activating OPAL hardware encryption ?

3

You ought to be able to find something useful here (binaries and source included by r0m30 on github also).

Up until recently, configuring these TCG Opal drives was only possible under Windows, or under Linux with a commercial solution that was not available to mere end-users. Fortunately, a programmer named r0m30 stepped up to the challenge and has developed an open source utility called msed and an accompanying pre-boot authorization (PBA) image with which the super fast encryption function on these drives can be fully configured and used also in pure Linux systems.

The "pure Linux" system shouldn't be a problem - the PBA is OS agnostic, it should simply boot whatever is in the active partition once it is unlocked. The OS and the drive will "see" an unencrypted drive without even be aware that the hardware is actually doing decryption on the fly, unless they issue the appropriate API status calls.

Keep in mind that very likely you'll need to reformat the SSD altogether, since this solution is for booting off an encrypted device and requiring it to boot from a small non-encrypted shadow "partition" for password acquisition purposes.

So you probably will need to:

  • backup your data
  • disable OPAL in the UEFI
  • format disk and install the shadow MBR with OPAL encryption
  • enable OPAL from shadow MBR and insert a new password
  • restore your data (the disk might be slightly smaller).

I'm not sure on the "slightly smaller" thing but it seems safest to use some backup strategy that does not rely on the disk exact geometry (i.e., no dd-imaging), just in case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.