LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices


Reply
  Search this Thread
Old 10-08-2023, 03:23 PM   #1
Zbigniew
LQ Newbie
 
Registered: Nov 2017
Posts: 11

Rep: Reputation: Disabled
Ad-hoc usage of Self Encrypting Drives (SED) [hardware encryption] like SSD, NVMe, and pendrive


Self Encrypting Drives (SSD, NVMe, pendrive) are on the market for quite a long time now and they usually offer AES256 hardware encryption. Strange thing is that it is still lack of information how to configure them on Linux!
I found few instructions how to set password for Self Encrypting Drive and configure Pre Boot Authorization (by SEDutil), but I can't find any instruction how to use these drives ad-hoc, I mean connect Self Encrypting Disk or pendrive, type the password and access the files on it?
 
Old 10-09-2023, 08:24 PM   #2
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
On Ubuntu, I use LUKS encrypted flash drives ad-hoc (software encryption). To unlock the drive I open Disks application and click the lock to type the password. Maybe it would be similar for hardware but I will likely stick to software encrypted drives.

If you own a specific model, then share the make/model.
 
Old 10-10-2023, 09:25 AM   #3
kilgoretrout
Senior Member
 
Registered: Oct 2003
Posts: 3,018

Rep: Reputation: 400Reputation: 400Reputation: 400Reputation: 400Reputation: 400
I also just use LUKS to encrypt my external hard drives and flash drives. In kde when a LUKS encrypted drive is connected, you are automatically prompted for the password. Personally, I don't trust the firmware of the self encrypted drives you describe and see no need for paying a premium for encryption when you have no way of knowing how secure that encryption is.
 
Old 10-11-2023, 03:26 PM   #4
Zbigniew
LQ Newbie
 
Registered: Nov 2017
Posts: 11

Original Poster
Rep: Reputation: Disabled
Dear sag47 and kilgoretrout,
Thank you for your suggestions.

I read some additional articles and I have new questions as well as some details for you:
1) Does LUKS utilize AES instructions of CPU (if CPU have AES support)? Is it done automatically?
2) If yes, what is the efficiency of AES CPU accelerated encryption and decryption? Is it comparable to SED with low CPU utilization?

I have few SED drives. Samsung EVO 850, Samsung EVO 870, and brand new ADATA Legend 960. I also have old Intel NVMe drive without encryption and traditional hard disk (which I want to use for backups). Both Samsung drives are currently encrypted by LUKS. It looks to work clearly slower on my laptop (almost 10 years old processor may not support AES instructions). My desktop has AMD Ryzen CPU and offer CPU accelerated AES256 encryption in UEFI/BIOS for both NVMe drives. I never turned on this encryption in UEFI/BIOS. I also never checked CPU utilization during operations on LUKS encrypted drive so I do not know if it affects computing power or AES instructions prevent noticeable encryption/decryption workload (that is why I asked first two questions).
3) AMD AES256 encryption offered by UEFI/BIOS. Is it safe and standardized or each motherboard producer have own implementation with own bugs? Can I use the disk when change motherboard?
4) ADATA Legend 960. Theoretically Self-Encrypting Disk. Theoretically, as it does not support OPAL 2.0, so I cannot configure it via sedutil-cli. I spent some time trying to do it and finally looking for information if this drive support OPAL 2.0. See details in this thread. It might be encrypted only via dedicated software for Windows! I still can return this disk, but currently I have very few alternatives available and for higher price (I believe that sellers expect that dollar significantly rise next week, so they prefer to keep the most expensive drives in warehouses to sell them for much higher price later). This SSD is quite fast and has high TeraBytes Written (TBW) as well as 5 year warranty. My concern is the risk of locking it (setting password for encryption) by malicious software / hacker attack. Can I prevent setup or change password for this drive (as most of the SED it is likely encrypt everything using default key with empty password). As it is not OPAL compatible, I have no idea how to change default key or prevent password setup. Should I worry? Maybe I should to return it and buy other drive (e.g. Samsung 9x0 EVO) even for higher price next week?
 
  


Reply

Tags
aes, encryption


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Slackware 15 - NVME clone to external NVME - Boot problem from external NVME Klaus150 Slackware 35 10-16-2022 04:29 PM
LXer: Data in a Flash, Part II: Using NVMe Drives and Creating an NVMe over Fabrics Network LXer Syndicated Linux News 0 05-20-2019 11:41 PM
How does ignored self encryption work on self encrypting drive? rblampain Programming 1 12-15-2017 08:13 AM
LXer: Western Digital self-encrypting hard drives riddled with security flaws LXer Syndicated Linux News 0 10-23-2015 02:02 AM
Seagate self-encrypting drives ("SED")- key creation only for Windows users? libCog Linux - Hardware 1 01-15-2012 12:01 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware

All times are GMT -5. The time now is 11:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration