5

I'm considering trying out yubikey and I've recently discovered that the (crucial m500) SSD I recently bought supports hardware encryption.

I think it should be possible to use a yubikey to provide the password for HDD encryption as it appears as a usb keyboard as far as I know.

I've never used hard drive encryption before, and it seems like a hardware based solution makes it a lot more convenient and high performing than a software based approach.

What are the pros and cons of this an approach?

I would want to dual boot windows and linux. Is hardware encryption external to the OS and therefore have no requirement for any special configuration?

Improve this question
1
  • Although hardware-based encryption can be crappy, it does allow you to implement secure deletion much more efficiently than on other devices. Secure deletion can be done simply by resetting the drive's key. This technique is called SED.
    – forest
    May 19, 2018 at 23:07

2 Answers 2

Reset to default
4

I recently had to make the choice between using hardware versus software encryption for my hard drive. In the end I decided to use software based encryption for the simple matter that the software used has been vetted, tested and is generally considered secure.

My biggest problem with hardware encryption is that often there is no disclosure of how the encryption happens, how the keys are stored and which algorithms are used. My biggest worries were:

  • random number generation
  • key generation
  • backdoors (master keys for "vendor recovery")

For me personally this was too black box to be secure and hence I opted for software encryption. In the case of 7200 RPM and especially Soild State Drives the performance impact is not noticeable generally. In case you are using heavy write applications, you will notice a difference in speed degradation but even then it's still the difference between super fast and ultra fast.

Improve this answer
2
  • 1
    Agreed on the black box culture, security through obscurity never works in the long term. I'm guessing you use a truecrypt virtual filesystem?
    – barrymac
    Dec 23, 2013 at 23:28
  • yep, correct. It works quite well;
    – Lucas Kauffman
    Dec 23, 2013 at 23:55
1

Of course hardware encryption is expected to achieve better performance than software encryption, but in reality this depends on the HW it self: nothing can be said for sure without benchmarks. Hardware encryption can be completely transparent, so you can use any OS without even noticing that the HD is encrypted. The encryption/decryption mechanism is done at lower level and it starts before the OS boots (i.e. BIOS/UEFI bootstrap). As said, because the encryption is transparent to the OS and because it is (probably) much faster than software solutions, we could say that hardware encryption is better than software encryption. However we must say that any proprietary solution could hide some (intentional or not) backdoor, so you have to carefully choose the people you are giving your trust. Also you didn't mention what algorithms are supported, which is a really relevant factor. About the youbikey: I don't think that your HW will support onetime passwords, so I don't think that you could use it. However your encryption system may allow you to authenticate using a key saved on a common usb-drive.

Improve this answer
2
  • Actually there is a static password type configuration that can be saved in the yubikey that I have. A USB drive with a key sounds like a nice standard type solution. will have to look into that. It's such a shame that we can't really trust manufacturers 100% to have a sound system without backdoors
    – barrymac
    Dec 23, 2013 at 23:26
  • In some cases (it all depends on your encryption system) you can also encrypt the key stored on your usb-drive. This way, if someone steal the usb-drive, won't get access to you HD.
    – smeso
    Dec 24, 2013 at 0:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .