Some newer hard drives and solid state drives are SED (Self-Encrypting Drives), which create a DEK (Data Encryption Key) and store it either unencrypted, or encrypted with a user-supplied AK (Authentication Key) if FDE is wanted. The DEK is used to encrypt all content on the drive. In the case the drive needs to be securely wiped, the DEK can simply be erased, regardless of whether or not the AK is set.
According to the TCG, the DEK is generated on the drive itself, rather than being generated on the computer and transferred over through some vendor-specific ATA command:
A: The encryption key is generated on board the drive and NEVER LEAVES THE DRIVE. The manufacturer does NOT retain or even have access to the key.
My question is how the DEK is generated. Obviously, the AK, if used, is transferred from the computer, but the DEK is apparently generated on the drive. If each drive's own firmware generates the DEK in its own way, with the firmware developers trying to reinvent the wheel and think up their own way to generate randomness, it would in all likelihood result in a predictable DEK.
For at least one model of the HGST Ultrastar, it uses what it calls the NDRNG, the "Non-deterministic Random Number Generator that is the source of entropy for the DRBG". Is this a requirement in for all SED drives, or might some of them try to generate entropy from more deterministic sources like timing drive head movement?