1

I basically cannot find any credible information online as to how secure OPAL 2.0 drives are, and so I don't really know how much, or in what cases, I can trust their encryption to keep my data safe if the drives get into the wrong hands.

Do they do proper encryption? Do they store the keys securely? Have they been cracked before? Do they have backdoors? Are these known to differ across vendors? etc.

2

The specs themselves are fine, but there is always the issue that the vendors will not implement it correctly, which is unfortunately not uncommon. There are also security issues that are not even addressed, for example the kind pointed out in Hardware-based Full Disk Encryption (In)Security. From the abstract:

We show that, depending on the specific hardware configuration of the system, (1) for most settings in which a known attack on software-based FDE exists, there exists a successful attack against SEDs. These scenarios include DMA-based attacks, cold boot attacks, and evil maid attacks. In this sense, hardware-based full disk encryption (FDE) is as insecure as software-based FDE. We also show that (2) there exists a new class of attacks that is specific to hardware-based FDE. Roughly speaking, the idea of these attacks is to move an SED from one machine to another without cutting power, i.e., by replugging the data cable only.

Do they have backdoors?

How can anyone even answer that? No, the specification does not require the insertion of backdoors. Whether or not a given vendor inserts one requires careful analysis of the individual firmware. More likely, they are just full of bugs, and no backdoor is needed to exploit a weakness.

  • Oh, what I meant by backdoors was like if people had found that vendors could recover lost passwords or something, then the answer would be yes. I didn't mean to imply an NSA-style backdoor that nobody else would know about. – Mehrdad Nov 29 '17 at 8:25
  • The specification does not require recovery passwords for disk encryption. – forest Nov 29 '17 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.