The Keys to Unlocking Self-Encrypting Drives

By Wade Brown, Senior Research and Design Engineer at Dedicated Computing

Hardware based encrypting storage drives utilize cryptographic logic directly on the controller chip. Any hard drive using this technology is constantly encrypting and decrypting data, regardless of whether the drive has been locked. Unlike software-based encrypting techniques, hardware crypto engines are faster and transparent to the end user.

Self-encrypting drives (SEDs) are locked by providing a password, which is used to encrypt the hard drive's internal private key. After the hard drive has been reset or power cycled, the password must be provided to decrypt the private key. If the correct password has been provided, the hard drive media can be accessed normally. Otherwise, all data including master boot records are inaccessible.

There are three typical methods of unlocking a SED. The first method, if supported by the motherboard BIOS, makes use of the ATA Security feature. On boot, a BIOS can ask the user to provide a password to "unlock" the drive. A SED can use this feature to decrypt the private key. However, each hard drive implementing the ATA Security feature must be unlocked, as well.

The second method uses the SED concept, called "MBR Shadowing". This method involves the use of a small, embedded operating system stored on the SED. On boot, a fake MBR is presented to the BIOS which will then load the embedded OS. The embedded OS is designed to either ask the user for the password or to contact a central hub (e.g. software-based an IT security server) for credentials. On successful authentication, the embedded OS reboots and when the BIOS scans the drive again, the "real" MBR is presented. The embedded OS can unlock other SEDs in the same system.

Finally, the last method does not lock the entire drive or does not specifically lock the boot drives. In this case, the booting operating system is responsible for unlocking other drives (i.e. data drives) in the system. This method is ideal if the operating system drives are located internally while the data drives are accessible from the front of the chassis (e.g. removable drives). Theft of a data drive will be useless as when the drive loses power, it must be unlocked again.

Data on SEDs can be easily destroyed by simply asking the drive to generate a new private key. As previously stated, a SED constantly encrypts/decrypts data using the private key and when this key is regenerated, all previously stored data is immediately lost.

The encryption and locked functionality follows the OPAL 1.x or 2.x Trusted Computing Group (TCG) specifications. This specification defines the protocol for encryption devices and also defines the capability to lock specific LBA ranges on the storage media. Thus, it is possible to encrypt an entire hard drive or only specific block ranges. The OPAL specification also defines two user roles (admin, user), each with individual passwords. The OPAL specification is generally directed toward consumer grade storage devices (SATA, NVMe) while another specification, named "EnterpriseHardware-based targets enterprise grade storage devices (SAS).