0

I have a Dell XPS 9550. This was shipped without a TPM.

I have since installed a Samsung 970 EVO SSD which as I understand is a self-encrypting drive (SED) and, what I am not sure about is, it can be encrypted without a TPM?

So, I have installed the drive, installed Windows 10, set "Encrypted Drive" to "ready to enable". Did a secure erase and reinstalled Windows 10.

Samsung Magician now shows the below ("Encrypted Drive" is "Enabled"):

enter image description here

Bit Locker will not enable on the OS drive without overriding the "your administrator must set the allow bitlocker without a compatible tpm" setting.

Does this mean my drive is encrypted?

Or do I need to override the TPM setting and setup bit locker still and then bit locker with use the hardware encryption on the drive?

Or do I need to set a BIOS system password?

I have searched but with no clear guidance or insight.

  • To summarize the comments on the answers below in case someone comes across this in the future (I used to have the same question), the drive is not secure in its above configuration since an authentication key has not been chosen. – Steve Nov 14 '18 at 19:55
3

There's a lot of information here so I'll try to answer directly and clear up anything that's incorrect. First and foremost, BitLocker drive encryption and the built-in encryption on the SED are two mutually exclusive forms of encryption and I would not recommend running both due the likely significant performance impact.

If you are using the built-in drive encryption (and it appears you are), then there's no need to use BitLocker. The SED stores the key on the drive controller (hardware outside of the OS) so it's faster and technically more secure without a TPM (although there are publicly known attacks against SEDs from Samsung and Seagate (and BitLocker for that matter)).

As far as your questions go:

  • Does this mean my drive is encrypted?

Well, yes. But what you're confusing is BitLocker with the built-in drive encryption on the SSD. As previously stated, they are two distinct forms of drive encryption. You are receiving the message, "your administrator must set the allow bitlocker without a compatible tpm" because you don't have a TPM and by default, BitLocker wants to store the key in the TPM for the additional security measure. If you change this setting, you can still use BitLocker but the key is stored on the drive and can be stolen/reclaimed by someone with the right tools and know-how. I'd also like to reiterate, dont' use both the SED encryption and BitLocker. It's redudnant and will likely destroy your IO experience.

  • Or do I need to override the TPM setting and setup bit locker still and then bit locker with use the hardware encryption on the drive?

If you want to use BitLocker over the SED built-in encryption, you'll need to remove the encryption which will wipe the drive, reinstall your OS without the built-in encryption and then enable BitLocker without TPM.

  • Or do I need to set a BIOS system password?

If you're concerned about people having physical access to your machine, it's best practice to set a BIOS password. However, know that there are many nullifying circumstances with this:

  1. If you allow your laptop to boot to every capable bootable device technology on the laptop, the BIOS password is functionally irrelevant as they'll just boot off of CD or USB to another OS, mount your drive, unencrypt it, and get your info. <-- this isn't trivial, but certainly far from unlikely.
  2. If someone has physical access to your laptop, they can perform the J38/39 jumper reset to unset the BIOS password (this still works, I did it about 3 months ago on a brand new Dell).

Edit: As stated in the comments, if you enable BitLocker, it can and will prefer to use the hardware encryption enabled by the SED due to performance reasons. However, as it's not yet enabled and your Samsung software is saying the drive is encrypted, it's probably using the built-in method on the SED.

  • I appreciate both are separate encryptions, and heave read that Bit Locker can use the hardware encryption on SED's, hence my confusion that I may need Bit Locker as the final key to secure the disc. But it seems not... If I set a BIOS level access password, that's one thing... But surely this still means someone could just remove the disc, mount it elsewhere and read the contents? – RemarkLima Nov 14 '18 at 19:10
  • @RemarkLima You’re right that Bitlocker can use the hardware encryption on a drive instead of software encryption, but there are many requirements for this such as BIOS support, a TPM, a supported hard drive, etc. Since you don’t have a TPM, you can’t use Bitlocker with the drive-based hardware encryption. But I highly recommend using software based Bitlocker anyways since AES is extremely fast on modern CPUs and self-encrypting drives can be difficult to set up securely and have been shown to be vulnerable to side channel attacks. – Steve Nov 14 '18 at 19:45
  • @Steve thanks for the heads up... So a new drive was a bit of a waste as I should have just fired up bit locker on the old SSD by the sounds of it. And to disable the SSD encryption is a mission... Oh well, we'll get there ;) – RemarkLima Nov 14 '18 at 19:58
  • @RemarkLima, yes, that's correct -- the BIOS password is tied to the BIOS chip on that physical motherboard so if the drive is removed and moved to a different system, the BIOS password is effectively nullified. Plus, as previously stated, they can take the bottom cover off the laptop, jump a few pins, and unset the password back to no password at all. Since you don't have a TPM, and aren't using cryptography that leverages keys stored in the TPM, the task of breaking into the drive is significantly reduced since the key comes with the drive in many cases. – thepip3r Nov 14 '18 at 22:00
  • 1
    @RemarkLima Because it allows ATA Secure Erase to operate in a fraction of a second, rather than several hours. Issuing the erase unit command thus wipes only the key. It just so happens that this can be used for password-based encryption as well by deriving this key from a user-supplied password. – forest Nov 15 '18 at 9:22
0

Does this mean my drive is encrypted?

Yes. You have successfully set up BitLocker using the built-in hardware encryption of your drive. The "?"-tooltip of Samsung Magician will clearly state that this is not a separate drive encryption but meant for use with BitLocker. In fact, using this option, BitLocker will simply rely on the drives always-active internal encryption, which is very efficient. You can double-check by invoking "manage-bde -status" from an elevated command prompt or PowerShell.

Or do I need to override the TPM setting and setup bit locker still and then bit locker with use the hardware encryption on the drive?

No.

Or do I need to set a BIOS system password?

No.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.