Dear sag47 and kilgoretrout,
Thank you for your suggestions.
I read some additional articles and I have new questions as well as some details for you:
1) Does LUKS utilize AES instructions of CPU (if CPU have AES support)? Is it done automatically?
2) If yes, what is the efficiency of AES CPU accelerated encryption and decryption? Is it comparable to SED with low CPU utilization?
I have few SED drives. Samsung EVO 850, Samsung EVO 870, and brand new ADATA Legend 960. I also have old Intel NVMe drive without encryption and traditional hard disk (which I want to use for backups). Both Samsung drives are currently encrypted by LUKS. It looks to work clearly slower on my laptop (almost 10 years old processor may not support AES instructions). My desktop has AMD Ryzen CPU and offer CPU accelerated AES256 encryption in UEFI/BIOS for both NVMe drives. I never turned on this encryption in UEFI/BIOS. I also never checked CPU utilization during operations on LUKS encrypted drive so I do not know if it affects computing power or AES instructions prevent noticeable encryption/decryption workload (that is why I asked first two questions).
3) AMD AES256 encryption offered by UEFI/BIOS. Is it safe and standardized or each motherboard producer have own implementation with own bugs? Can I use the disk when change motherboard?
4) ADATA Legend 960. Theoretically Self-Encrypting Disk. Theoretically, as it does not support OPAL 2.0, so I cannot configure it via
sedutil-cli. I spent some time trying to do it and finally looking for information if this drive support OPAL 2.0. See details in
this thread. It might be encrypted only via dedicated software for Windows! I still can return this disk, but currently I have very few alternatives available and for higher price (I believe that sellers expect that dollar significantly rise next week, so they prefer to keep the most expensive drives in warehouses to sell them for much higher price later). This SSD is quite fast and has high TeraBytes Written (TBW) as well as 5 year warranty. My concern is the risk of locking it (setting password for encryption) by malicious software / hacker attack. Can I prevent setup or change password for this drive (as most of the SED it is likely encrypt everything using default key with empty password). As it is not OPAL compatible, I have no idea how to change default key or prevent password setup. Should I worry? Maybe I should to return it and buy other drive (e.g. Samsung 9x0 EVO) even for higher price next week?