SSD encryption vulnerability & TPM

Question

I've recently read several articles about this paper: Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs) by Carlo Meijer and Bernard van Gastel.

The thing I haven't been able to confirm is whether or not machines using a Trusted Platform Module (TPM) are affected by these vulnerabilities. From my understanding, the TPM generates and stores (part of) the key used by the hard-drive to encrypt itself (the "Disk Encryption Key", DEK).

However, the vulnerabilities allow attackers to decrypt the data without access to the DEK. To me, this means that the TPM does not protect against the vulnerabilities.

Can anyone confirm this or offer a better explanation?

Articles on the paper:

https://www.bleepingcomputer.com/news/security/flaws-in-popular-ssd-drives-bypass-hardware-disk-encryption/

https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/

https://www.theregister.co.uk/2018/11/05/busted_ssd_encryption/

Answer 1

TPM just stores the AK (authentication key) that is used to decrypt the DEK (Data encryption key) internally in drive. Then DEK is used to decrypt data.
From Overview of Encrypted Hard Drives and BitLocker (eDrive) that is actually implementation of TGC OPAL2:

Strong security based in hardware: Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system.

Another good source of information is at:
https://wiki.archlinux.org/index.php/Self-Encrypting_Drives#Set_up_the_drive

About vulnerabilities

I own Samsung 850 EVO SSD and I really wanted to find the answer how bad it is, So I have been searching information about the flaws all day. Everyone claims the Samsung's SSD is not safe. So I have read the original whitepaper:
Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs)

There is particular table about security flaws:
Vulnerabilities are related only to ATA Security and impact 'Depends' for Samsung's ones. ATA Security:

...
The ATA password may be cryptographically bound to the DEK. This depends on the value of the MASTER PASSWORD CAPABILITY bit during the ATA security setup.
...
In case the MASTER PASSWORD CAPABILITY bit is set to Maximum, the decryption key is derived from slot 502. Otherwise, the key is stored in plain-text format in slot 465, and slot 502 and 503 are used for password validation only. Thus, allowing the encryption to be bypassed. ...

But in attack strategy they mentioned for OPAL (Bitlocker + HW Encrypted Drive):

(850) Since TCG Opal implementation is mostly identical to its predecessor, no weaknesses have been identified.

(840) If ATA security, with the MASTER PASSWORD CAPABILITY bit set to Maximum, or TCG Opal is used, then the DEK is cryptographically bound to the password.

That means it can't be bypassed without the AK (in your case stored in TPM).

I am a bit surprised that even Samsung recommended use of 3rd party software encryption as mitigation for the vulnerabilities even their disks should be fine if they are not using ATA Security.

What I wasn't able to find is information if you can use ATA Security operations if disk is in OPAL 2 (Encrypted drive for Bitlocker) mode. I think it can't be used because the mode is chosen once during setup of a drive and it is not easy to reset it - actually reset the DEK for which the PSID label is needed... But I am not sure.