I was reading hardware based encryption, and found out that they are basically of 3 types.

1) SED - Encryption/Decryption done by the drive circuitry. Unlocked via Pre boot authentication. Can use TPM for extra safety.

2) Enclosed FDE - Has a separate chassis, which holds the chip for encryption and decryption. The hdd is inserted in that chassis. Everything going and coming of that disk is encrypted/decrypted on the fly.

3) Bridge and Chipset FDE - This encryptor is put in between the motherboard and the hdd. Their are (mostly) cables for in-out data connections.

What I am confused about, and something that I did not find anywhere is, how is the authentication or the steps are for the 2nd and the 3rd type. Who stores the keys, how does the user sets an authentication type, and who authenticates. Is the process pre-boot too?

  • Why does there need to be authentication? The data can only be decrypted if you supply the correct key. – forest Feb 12 '19 at 4:30
  • @forest.. Ok, but the steps are still not clear to me.. Who creates and maintains the keys. At what point of boot time is the key entered.. who does the checking of the keys correctness – Haris Feb 12 '19 at 6:18
  • I think you misunderstand how encryption works. The key is stored in your brain, nowhere else. The key is checked for correctness because only the correct key will result in correct decryption. If you use the wrong key, the drive will decrypt into gibberish, which is easy for the system to detect and respond by giving you an "incorrect password" notification. – forest Feb 12 '19 at 6:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.