How is this in the case of hardware-encrypted pendrives? E.g. this one. Does one always require installation of drivers / software for such a device?
Yep, generally devices like that require special drivers. The drivers will be included in the device, on a read-only but unencrypted partition. You'll note that the device you linked only works with pretty specific Windows and MacOS versions, all fairly new, even though a normal flashdrive will happily work on anything back to Windows 98 or so without installing any drivers at all.
In fact, all transparent (that is, you interact with the data using a normal file browser, and it's mounted in the normal file system) encryption requires a driver. BitLocker has a driver that is present in all supported versions of Windows, and if you encrypt a flashdrive with BitLocker, it reserves a tiny bit of unencrypted space to store the necessary driver for read-only access to the flashdrive on versions and editions of Windows that don't have BitLocker already. The driver doesn't necessarily need to be kernel-mode - on OSes with support for FUSE drivers, you can use those - but then, FUSE has its own kernel-mode driver already.
How can it be safe? Where is the encryption key stored? After all, it must be physically inside the device - in addition, unencrypted. So how can it be safe?
Why in the world would the encryption key be stored in plain text anywhere?!? The actual data encryption key - the "master" key - is never stored in plain text anywhere except in the driver's ephemeral memory, and ideally for as short a time as possible there. The only way the master key is persistently stored is encrypted, and the key used to encrypt the master key is derived from the password (using a strong, slow password-hashing function). The password itself is of course also never stored anywhere, just like your password for a web site is never stored anywhere. The reason you encrypt ("wrap") the master key with the password-derived key, rather than simply deriving the master key from the password directly, is that it lets you change the password without needing to decrypt and re-encrypt all the data (you only need to re-encrypt the master key).
Here's a typical idea of what the process of unlocking an encrypted volume might look like:
- You enter your password into the software.
- The software runs your password through a strong hashing function to produce a password verifier value.
- The software checks that the password verifier matches the one it has stored; if not, you entered the wrong password. The verifier is stored in plain text, but its only purpose is to check whether the user entered the right password; changing the verifier doesn't let you decrypt the data (in fact, it makes it harder).
- The software notes that your password is correct (the verifier matches), so it runs the password through another password hashing algorithm (might be the same algorithm with a different salt, or another algorithm entirely).
- The output of this second password hashing algorithm is treated as a symmetric key, and used to decrypt the master key. The decrypted master key is stored only in the software (typically a driver)'s RAM.
- The software lets you access the data on the drive, transparently using the master key to encrypt and decrypt as you write and read.
- You lock and/or eject the drive, and the software deletes the master key (and your password) from its memory.
The only things that are stored persistently are the the encrypted data, the encrypted master key, and the password verifier. The password verifier cannot be used to get the original password or to decrypt the master key. The master key cannot be used to decrypt the data while it is itself encrypted. The data is safe unless the attacker can get the password.
Note, of course, that things like keyloggers and such could still capture the password as you enter it. Also, the master key does need to be stored in the software's memory, so an attacker that is able to read the software's memory (either using their own highly-privileged software, or by physically reading the RAM chips) will also be able to decrypt the drive.