0

I own a Samsung 980 Pro which, according to its own specification, supports Class 0, TCG/Opal 2.0 and IEEE16667. Since it's an NVMe drive, I cannot use hdparm in order to set up class 0 encryption but the UEFI of my Dell Notebook does.

I am aware of the fact that it's important to set the security level to maximum when dealing with Class 0 encryption drives which I did with hdparm in the past. The UEFI of my notebook provides a function called "Master Password Lockout" which seems to be doing just that.

Now to my questions:

  1. Am I correct in assuming that ATA security is still present for Class 0-capable NVMe drives and only the interface is different?
  2. Since hdparm doesn't seem to work, how can I send ATA Security commands to my NVMe SSD? I'm speficically interested in finding out, if the security level has indeed been set to maximum.
Improve this question
10
  • 1
    hdparm is for SATA drives. If you're working with NVMe drives, you should be using nvme-cli instead.
    – Gh0stFish
    Jul 12, 2022 at 9:28
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Jul 12, 2022 at 10:45
  • I can't figure ot how to send ATA security commands to the drive via nvme-cli. How do I do that?
    – Brickwall
    Jul 12, 2022 at 13:50
  • 1
    You should probably not trust such drives.
    – vidarlo
    Jul 12, 2022 at 15:02
  • I have read this paper which is one of the reasons I have created this thread. Regarding Samsung drives, you're most probably safe as long as you're using TCG Opal or setting ATA security to maximum.
    – Brickwall
    Jul 12, 2022 at 15:22

1 Answer 1

Reset to default
1

As far as I know, Dell's UEFI notebook firmware does not support encrypting NVMe drives.

That's my personal experience from working with mobile Precision workstations and the XPS consumer notebook variants. There is a (very brief) Dell Support KB article about this, too.

Are you sure the password you set in UEFI was not the master/admin password and / or the system password, both of which may be configured for protecting against unauthorized changes in the UEFI or preventing unauthorized system boot and boot path changes? Because those two passwords do not encrypt the connected drive(s).

While setting up ATA might work, for a new setup you almost certainly want to use Opal instead of the old ATA standard, because it has severe improvements in capabilities. As for managing the NVMe encryption I personally had the best experience using sedutil. A pretty good start are the Arch docs about SEDs, they cover the usage of sedutil as well. Samsung itself does provide an enterprise SSD toolkit, in case you prefer to go down that route. Have a look at these answers at AskUbuntu for further details.

Update 07/13/2022: Actually newer Dell notebook firmware allows setting a NVMe password.

Improve this answer
4
  • Actually you can, as you can see here and here. Unfortunately Windows 11 requires Secure Boot now and the sedutil bootloader is not signed. I guess the only option here would be eDrive.
    – Brickwall
    Jul 12, 2022 at 23:23
  • Oh well, great their UEFI revamp finally brought that option. I'm still using a 5540 and I checked on my machine, found the KB article and double checked on their newest model's service manual, they do not even bother to mention the NVMe password option in the "Passwords" section there..
    – PasWei
    Jul 13, 2022 at 9:30
  • In case you are using Windows only, Bitlocker eDrive sounds like a viable option. While on Windows you may as well use Samsung Magician > Encrypted Drive to double check whether the encryption is actually enabled after setting a password in UEFI.
    – PasWei
    Jul 13, 2022 at 9:30
  • eDrive is probably the best option right now because even though Dell supports NVMe passwords, I can't find any information about how it is implemented. With ATA drives I was able to verify that ATA security has indeed been set to max etc.
    – Brickwall
    Jul 13, 2022 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .