The ATA Security feature set is very limited. It has only a few different capabilities:
- Erasing - Wipes the drive with manufacturer-specific data.
- Locking - Blocks access until a 32 byte ASCII password is provided.
- Freezing - Prevents modifying security settings until the next restart.
This is all it can do. Locking ATA drives can be done using either the master password, which is a manufacturer-defined skeleton key, or the user password, which is set by the user (or NULL by default). When the drive is set to high security, the master password can be used in lieu of the user password. When the drive is set to maximum security, the master password can only be used to erase the drive. Setting a security password involves sending a
SECURITY_SET_PASS command along with the password type and the password itself, in the form of 32 ASCII bytes padded with NULLs if shorter or truncated if longer. Unlocking the drive is similar, except it uses the
A drive can be in one of several security states, from SEC0 to SEC6. From the ATA 8 standard:
A state transition table is available at figure 12 in section 4.20.11 of the same document. A nice and less technical overview of the ATA security feature set can additionally be found here.
So no, 2FA is not supported, only locking and unlocking with a 32 byte ASCII key is.