2

I have seen articles advising that in order to make the most of an SSD, it should be connected in AHCI mode.

Some SSDs allow the ATA password to encrypt the encryption key so my question is this - does this ATA password work in AHCI mode? I have a feeling it doesn't.. in which case, is there an alternative?

I only have an i3 so want to avoid software encryption.

Thanks!

  • 1
    Depending on your i3 version, it might support AES-NI, in which case you will barely feel anything with software encryption – Lucas Kauffman Jan 28 '13 at 12:42
  • Even on an i3, AES is ridiculously lightweight. I run TrueCrypt system encryption on an old P4 box with no issues. – Polynomial Jan 28 '13 at 12:44
  • My i3 doesn't support AES-NI, which is something I overlooked when I bought the laptop. There is a very noticeable slowdown with ubuntu home drive encryption enabled which alone is the reason I am considering buying an SSD with built in encryption. As a side note, is there a reason why TrueCrypt might be better performance-wise? – Mark Jan 28 '13 at 19:13
2

The disk lock is a built-in security feature in the disk. It is part of the ATA specification, and thus not specific to any brand or device. The disk lock can be enabled and disabled by sending special ATA commands to the drive. If a disk is locked, it will refuse all access until it is unlocked. Source

Based on that I believe that it is not part of the AHCI/SATA standard, however as other comments have suggested, Full disk encryption using software like true-crypt is recommended.

Furthermore:

While the ATA disk lock is intended to be impossible to defeat without a valid password, there are workarounds to unlock a drive. Many data recovery companies offer unlocking services,[25] so while the disk lock will deter a casual attacker, it is not secure against a qualified adversary. The drive is simply 'locked' whereas TrueCrypt actually encrypts the data on the drive.

In addition, You should be aware that ATA mode has noticeable performance loss over AHCI. There are a number of comparisons available online between the performance benchmarks of the two. It might be that any performance impact on your system from FDE may be negated by using AHCI mode. You will need to test for your own system.

Hope that helps,

  • This is what I thought.. a question then.. why would SSD manufacturers offer ATA password encryption of the encryption key when they recommend that AHCI is used instead of ATA? Is there an equivalent? – Mark Jan 29 '13 at 12:04
0

This doesn't directly answer your question, but I would suggest you reconsider the CPU-driven encryption. The main reason is obviously security - while the encryption provided by the drive might be fast, I don't think there is any guarantee it is as safe as well implemented drive/partition/file system encryption on kernel level. No matter what the manufacturers tell us, one cannot reasonably exclude the possibility of the encryption being back-doored. If you use an open-source solution, you can check for yourself (or have someone do it for you).

As far as performance is concerned, unless the usual workload is copying gigabytes of data to and from the drive, the software encryption overhead is likely to be acceptable. Apart from other things, caching is also likely to alleviate the problem (whenever plain-text can be cached, of course).

That said, the main reason for setting your HDD to use encryption is that nobody else does it before you do (thus effectively trashing your data) - I believe there usually are some protections in place when changing the hard-drive password (as opposed to setting the first one).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.