I understand TCG OPAL is the spiritual successor of ATA Security for hard drive encryption with SEDs. They claim there is support for biometrics etc, but how is it for the predecessor, ATA Security?

Is it just a 32 bytes ASCII password, or do some motherboards offer 2FA, e.g. in the form of a USB stick or OTP?


The ATA Security feature set is very limited. It has only a few different capabilities:

  • Erasing - Wipes the drive with manufacturer-specific data.
  • Locking - Blocks access until a 32 byte ASCII password is provided.
  • Freezing - Prevents modifying security settings until the next restart.

This is all it can do. Locking ATA drives can be done using either the master password, which is a manufacturer-defined skeleton key, or the user password, which is set by the user (or NULL by default). When the drive is set to high security, the master password can be used in lieu of the user password. When the drive is set to maximum security, the master password can only be used to erase the drive. Setting a security password involves sending a SECURITY_SET_PASS command along with the password type and the password itself, in the form of 32 ASCII bytes padded with NULLs if shorter or truncated if longer. Unlocking the drive is similar, except it uses the SECURITY_UNLOCK command.

A drive can be in one of several security states, from SEC0 to SEC6. From the ATA 8 standard:

Table 7 — Summary of Security States and Characteristics

A state transition table is available at figure 12 in section 4.20.11 of the same document. A nice and less technical overview of the ATA security feature set can additionally be found here.

So no, 2FA is not supported, only locking and unlocking with a 32 byte ASCII key is.

  • Is there no way to automate the unlocking, e.g. if the 32 byte password is on a special USB stick? I guess I'm more interested in if there is a non-human/non-typing 1FA, rather than 2FA. I phrased my question like that because normally 2FA implies the former and is more common. – jiggunjer Feb 20 '18 at 2:09
  • @jiggunjer In order to automate unlocking, you would need to have some bootable code that is not kept on the drive. Usually, it's the BIOS which does this, letting you enter a password (distinct from the BIOS password) to unlock the drive. You could automate it if you had another drive or bootable device that contained code that could unlock it. – forest Feb 20 '18 at 2:30
  • 1
    So I can use a USB for authentication, if I have some mini-OS on the USB drive and it boots from that first, similar to how TCG Opal/Pyrite works? The difference being it wouldn't be an official part of the (ATA Security) standard. – jiggunjer Feb 21 '18 at 1:59
  • 1
    @jiggunjer Booting from an OS on a USB drive and then unlocking the hard drive would work, yes. – forest Feb 21 '18 at 5:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.