Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Author Topic: Solid State Drive - Self-Encrypted Drive  (Read 3990 times)

re0

  • Reg Member
  • ***
  • Posts: 844
Solid State Drive - Self-Encrypted Drive
« on: August 08, 2023, 01:05:03 AM »

So I bought a Samsung 990 Pro a few months ago and I didn't really initially seem bothered about encryption. I changed my mind and decided to enable hardware encryption using Samsung Magician (this uses BitLocker to manage it). Though, I question whether it is truly necessary if the drive is a Self-Encrypting Drive (SED), and I think BitLocker would be an annoyance if something went wrong.

I asked Samsung and they said "no" to it being an SED. Fine. But what does Secure Erase do if a drive is apparently not self-encrypting? I was under the impression that one of the main things a Secure Erase does is generate a new crypto key (therefore destroying the old one), rendering any data on the drive unreadable.
Logged
ISP: Gigaclear - Hyperfast 900 (up to 940 Mbps symmetrical)

Alex Atkin UK

  • Addicted Kitizen
  • *****
  • Posts: 5444
    • Thinkbroadband Quality Monitors
Re: Solid State Drive - Self-Encrypted Drive
« Reply #1 on: August 08, 2023, 02:16:11 AM »

From what I can find a Secure Erase drains the charge from all NAND cells.

I guess as the hard part is making them hold a charge to begin with, making them completely empty leaves no trace of what state they were in before?
Logged
Broadband: Zen Full Fibre 900 + Three 5G Routers: pfSense (Intel N100) + GL.iNet GL-X3000/ Spitz AX WiFi: Zyxel NWA210AX
Switches: Netgear MS510TXUP, Netgear MS510TXPP, Netgear GS110EMX My Broadband History & Ping Monitors

re0

  • Reg Member
  • ***
  • Posts: 844
Re: Solid State Drive - Self-Encrypted Drive
« Reply #2 on: August 08, 2023, 02:51:02 PM »

Please excuse me if I get some of the technical terms incorrect or mixed up. Terms are sometimes incorrectly thrown about on the web (as I also probably will do here!). It also doesn't help that manufacturers have made their processes ambiguous, perhaps even using terms that overlap.

I'm not sure if you're thinking of Block Erase (Sanitise)? Because that applies voltage to the NAND cells to erase them.

In the case of Samsung, it is not clear what the Secure Erase is doing. I want to make the assumption that it is purely a Crypto Erase as it only takes mere seconds to complete. But considering Samsung told me that 990 Pro is NOT an SED, what is it actually erasing if there is no encryption enabled?

I somehow doubt that the 990 Pro is not an SED. Previous generations were, including the 970 Evo. Digging through the datasheets show that mentions of SED are absent from 980 Pro and 990 Pro despite being present for the 970 Evo. I must have been misinformed.

My understanding is that SEDs always have an active crypto processor, even without any user input. Saying that the 990 Pro is not an SED while presumably having cryptographic erasure would surely imply that the crypto processor exists and is active, but is not being properly utilised until it is setup in Samsung Magician? Perhaps like a null key if that is even possible?

What I have been by support just raises more questions, as you can see. ???
Logged
ISP: Gigaclear - Hyperfast 900 (up to 940 Mbps symmetrical)

Alex Atkin UK

  • Addicted Kitizen
  • *****
  • Posts: 5444
    • Thinkbroadband Quality Monitors
Re: Solid State Drive - Self-Encrypted Drive
« Reply #3 on: August 08, 2023, 08:46:20 PM »

In the case of Samsung, it is not clear what the Secure Erase is doing. I want to make the assumption that it is purely a Crypto Erase as it only takes mere seconds to complete. But considering Samsung told me that 990 Pro is NOT an SED, what is it actually erasing if there is no encryption enabled?

What I read suggested that as this is not a normal write operation the NAND is able to drop charge to all cells basically instantly, thus being so fast.  No idea if technically that is even possible, but at least one person who did it said recovery software was unable to find anything on the drive afterwards.
Logged
Broadband: Zen Full Fibre 900 + Three 5G Routers: pfSense (Intel N100) + GL.iNet GL-X3000/ Spitz AX WiFi: Zyxel NWA210AX
Switches: Netgear MS510TXUP, Netgear MS510TXPP, Netgear GS110EMX My Broadband History & Ping Monitors

re0

  • Reg Member
  • ***
  • Posts: 844
Re: Solid State Drive - Self-Encrypted Drive
« Reply #4 on: August 10, 2023, 02:58:52 AM »

I think I may have misunderstood how SEDs work, which would be rather embarrassing.

Perhaps SEDs have the necessary cryptographic processing capabilities for data encryption, but they are doing nothing useful until encryption is explicitly enabled. This would be contrary to the idea that the encryption is always-on without any user input; I thought utilising TCG Opal or BIOS Class 0 just gave an additional layer of control and were both unnecessary. In other words, I thought the underlying data was encrypted without specifically enabling anything, but the keys would not be protected so the data would be readable until the keys were erased.

Anyone is free to correct me if I am wrong.
Logged
ISP: Gigaclear - Hyperfast 900 (up to 940 Mbps symmetrical)

Alex Atkin UK

  • Addicted Kitizen
  • *****
  • Posts: 5444
    • Thinkbroadband Quality Monitors
Re: Solid State Drive - Self-Encrypted Drive
« Reply #5 on: August 10, 2023, 08:09:26 AM »

I assumed it was off until explicitly enabled, as surely you'd have to provide a secret key or encryption would be pointless if the drive just auto-decrypts without user interaction.
Logged
Broadband: Zen Full Fibre 900 + Three 5G Routers: pfSense (Intel N100) + GL.iNet GL-X3000/ Spitz AX WiFi: Zyxel NWA210AX
Switches: Netgear MS510TXUP, Netgear MS510TXPP, Netgear GS110EMX My Broadband History & Ping Monitors

re0

  • Reg Member
  • ***
  • Posts: 844
Re: Solid State Drive - Self-Encrypted Drive
« Reply #6 on: August 10, 2023, 09:18:42 AM »

encryption would be pointless if the drive just auto-decrypts without user interaction.
Not necessarily? Obviously in the case of theft it would be pointless as there would be no barrier to accessing the data. But if the drive was being recycled or sold, just rotating the key would make it practically impossible to access the data unless the implementation is flawed or there is a breakthrough in encryption cracking. Though, I think physical destruction would probably be better for certain types of environment.
Logged
ISP: Gigaclear - Hyperfast 900 (up to 940 Mbps symmetrical)

Alex Atkin UK

  • Addicted Kitizen
  • *****
  • Posts: 5444
    • Thinkbroadband Quality Monitors
Re: Solid State Drive - Self-Encrypted Drive
« Reply #7 on: August 11, 2023, 09:39:16 AM »

Not necessarily? Obviously in the case of theft it would be pointless as there would be no barrier to accessing the data. But if the drive was being recycled or sold, just rotating the key would make it practically impossible to access the data unless the implementation is flawed or there is a breakthrough in encryption cracking. Though, I think physical destruction would probably be better for certain types of environment.

Its not explicit but that does sound like how it should work:
https://www.intel.com/content/www/us/en/support/articles/000036098/memory-and-storage.html

Quote
If the IntelĀ® SSD does not have a configured security interface (such as TCG Opal) the encryption function of the device does not provide confidentiality of user data. Under these conditions, the encryption engine in the device behaves more as a data scrambler.
Logged
Broadband: Zen Full Fibre 900 + Three 5G Routers: pfSense (Intel N100) + GL.iNet GL-X3000/ Spitz AX WiFi: Zyxel NWA210AX
Switches: Netgear MS510TXUP, Netgear MS510TXPP, Netgear GS110EMX My Broadband History & Ping Monitors

re0

  • Reg Member
  • ***
  • Posts: 844
Re: Solid State Drive - Self-Encrypted Drive
« Reply #8 on: August 11, 2023, 02:49:41 PM »

That is what I thought SEDs were doing. But Samsung is straight up saying that their drives are not encrypting unless its explicitly enabled, which is confusing me. The encryption engine must be doing something even without data confidentiality.

Edit: It may be worth considering that it is not regarded as encryption as a non-authorised party can access data on the drive. That explains why Intel has described it as a data scrambler.
« Last Edit: August 11, 2023, 03:02:36 PM by re0 »
Logged
ISP: Gigaclear - Hyperfast 900 (up to 940 Mbps symmetrical)
 

anything