2

I read the wikipedia article and few others, however I still don't have some things clear. The main question would be what does hardware full disk encryption imply for the user, however I have more specific questions related:

  • Can I use the Samsung 840 EVO with an external 2.5" USB 3.0 case?
  • If so, would I be able to change it from one case to another or to the motherboard?
  • If yes to both of the above, what is the encryption actually doing? Stopping a hardware read/write while the disk pcb is off? That doesn't sound like very protecting. On the other hand, if it was no to any of the above, I don't see many end-user (with low to normal security needs) advantages.

My questions come specifically from this part from the Wikipedia's article:

Authentication on power up of the drive must still take place within the CPU via either a software pre-boot authentication environment (i.e., with a software-based full disk encryption component - hybrid full disk encryption) or with a BIOS password.

Improve this question

2 Answers 2

Reset to default
2

Encryption is handled at low level by BIOS. Every time you power up your PC, BIOS prompts for a password to enable disk access.

Data on disk is encrypted. If you connect an encrypted disk to a different PC, you will see garbage (no partitions at all).

If someone steal your PC, data is safe as it can't be decrypted without password. Almost for sure, robber will wipe off your hard disk to reinstall your pc...

If you PC breaks, you need to connect your disk to a PC with the same encryption system and enter the same password, otherwise you won't be able to read your disk anymore.

Improve this answer
1
  • It seems rather useless to me if you have to attach it to the exact same kind of computer. Given that modern CPUs easily to AES with like 5 GB/s I would go for software full disk encryption. For instance LUKS containers can be used with virtually all Linux distributions out of the box.
    – Martin Ueding
    Jan 9, 2016 at 19:05
0

No to the usb case.

You should be able to decrypt/use the drive in another computer but it is not 100% guaranteed as the bios can pass somehash(your password + serial number) or do other manipulations with your password and there is no guarantee that the other bios will do the same things. For what it's worth I did manage to normally decrypt a Samsung Evo 840 encrypted with a broken Think pad on a friends laptop.

The manufacturers are a bit vague on the implementation details, but what it should be doing is this. The drive already has an aes key randomly generated at the factory (and during every full wipe with the manufacturers sw) which is used to encrypt all data written to the drive. If you don't enter a password this doesn't protect your data as the key is unencrypted. If you set a password the key is encrypted with it.

That's why ssds can be wiped quickly - you just generate a new random aes key and the data is unrecoverable.

How much trust to put in this is up to you.

It's also the fastest method of encryption since the drive is doing it anyway.

Also lots of desktop motherboards don't support this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .