2

I found that Thinkpads have hdd password support, which in terms uses some bizarre password hashing and ends up with 90 bits of entropy, which is again used as ATA security password to SED, which in terms encrypts the HDD:s own build-in always on encryption key...and kinda does what Im looking for.

But are there any other computers / motherboards / UEFI that support this, hopefully in more secure or complex ways?

Since it can be as simple as having hdparm-command to issue passwords, or as complex as having UEFI program to hash passphrase with keyfile from USB-stick to use the same hdparm, or complex combination of TPM included secrets unlocked via fingerprint reader & PIN:s to get secrets to hash together to get ATA security passphrase, etc... Or it could be done using Opal security extensions on UEFI / Motherboard with any or all of these... Or it could be something else.

I dont understand why this is not generally available in UEFI to secure SSD/M.2 HDD:s on hardware security level, independent of operating system etc.??? It would be more secure, more easy, and no worries about Bitlocker getting into recovery mode or about reinstalling new OS or anything like that, since the whole package would be handled by UEFI and hardware on the SED.

Notice: There was/is "ATA Security eXtension BIOS" but this is for old computers. https://www.fitzenreiter.de/ata/ata_eng.htm

Improve this question

1 Answer 1

Reset to default
1

For HDD/SSD password support similar to ThinkPads, your only (often complicated) options involve hardware-level security and UEFI/BIOS integration. I found out that ThinkPads use a method combining 90 bits of entropy to generate an ATA security password, securing the drive at the hardware level.

The ATA Security Feature Set is a traditional method allowing passwords to be set directly on the drive, manageable via tools like hdparm. Self-Encrypting Drives with Opal Security Standards support hardware-based encryption and are available in many enterprise systems from brands like Dell, HP, and Lenovo. So this probably identifies relevant.

Like I talked about in your other question, the TPM stores secrets and aids secure boot processes, combining with biometric authentication like fingerprint readers and PINs to unlock drives. TPM 2.0 is widely supported in modern systems. Some UEFI-based solutions from vendors like AMI provide enhanced security modules for sophisticated authentication methods.

High-security laptops such as Dell's Latitude and Precision, HP's EliteBook and ZBook, and Lenovo's ThinkPad T and X series include advanced drive encryption and multifactor authentication managed at the firmware level. Enterprise-level solutions from companies like McAfee, Symantec, and WinMagic also offer UEFI-integrated drive encryption, but again typically for enterprise environments only.

Improve this answer
9
  • 1
    Thanks for clarification. But what AMI products you mean? Any mainboards for desktop computers? Or is it laptops only (which laptops)? Im more interested about consumer grade products for home PC that could support these features, that would not be very expensive either. High-security laptops you mention are expensive and, well, laptops.
    – mmja
    Commented Jul 9 at 19:24
  • @mmja this is AMI's website and this is their UEFI firmware product. But again, this is primarily for enterprises and servers- not for domestic use like you're looking for. Sorry, but I guess the truth is this technology just is pretty expensive in reality. And plus, I don't exactly see why you'd need this feature- for personal use firmware level drive encryption is secure but not the most secure- if that's what your looking for?. Why do you want this, specifically?
    – security_paranoid
    Commented Jul 10 at 0:44
  • The reason it isn't available for domestic use is because it has no advantages over other products. Nor the cheapest. While this isn't the case for enterprise, for personal use firmware level drive encryption etc. just has nothing something cheaper or better can offer. So I ask again- why are you set on this specifically? Have you heard that it is the most secure? I am not judging you, I just want to help :)
    – security_paranoid
    Commented Jul 10 at 0:47
  • 1) One huge advantage is that you can install/reinstall/repair any OS you have on HDD without going to encryption/decryption/messingup hassle. 2) Its not expensive, just inprint hdparm-command to UEFI. 3) You can add additional software encryption like LUKS or Bitlocker ontop of that if you want or dont trust it enought. 4) Simplicity and security is much better than doing Bitlocker, LUKS, etc. 5) Just put a damm security chip X there like they have in hardware crypto wallets, add support to hdparm and keyfile and pin and thats it. Why not?
    – mmja
    Commented Jul 10 at 2:42
  • 1
    > "are still somewhat experimental. I am not saying not to want > this, but there are other options" No, they have been around for year and years now and bugs have been fixed years ago. There are no other options for hardware encryption really and to do it via motherboard / UEFI is the easiest one. > "Because there are plenty of ways you can automatically encrypt > Windows OS using an external Bitlocker drive" What? How is this possible? Well, that is not what I asked for anyway, I asked for motherboard/UEFI that can do this, not software solution in external hdd.
    – mmja
    Commented Jul 13 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .