Full disk encryption without software

J

Jeroen1000

Limp Gawd
Joined
Sep 17, 2010
Messages
266
If I had the choice, I'd use Truecrypt on a CPU which supports hardware acceleration. Unfortunately, an AMD X2 250e does not support it. I also believe it is too slow a CPU for Truecrypt without hardware acceleration.

The next best thing would be a Self Encrypting Drive. Despite the fact the implementation cannot be verified (and may well be flawed) it does look attractive. I'm looking for opinions from ppl who have tried this.

My first question would be, how does one input the password? On the Hitachi website I have read a compatible BIOS is required so you are able to input the password at boot time. Is this true for all SED's?
Finally, my use for this is to encrypt my OS drive: my (future) RAID array will hold several Truecrypt file containers and I do not want the encryption keys to leak to the page file.

Also, if there are any other good methods I have missed, shoot aways:)

Cheers,
Jeroen
 
If I had the choice, I'd use Truecrypt on a CPU which supports hardware acceleration. Unfortunately, an AMD X2 250e does not support it. I also believe it is too slow a CPU for Truecrypt without hardware acceleration.
Click to expand...

Encryption is generally not too slow on modern processors, well depending on what options you use. Do a truecrypt benchmark. Any score above the drive speed will have limited impact on disk performance.
 
I have found the Truecrypt benchmarks to be different than real world performance. My array is encrypted with Truecrypt and it is running in a system with a latest generation Xeon with AES-NI. I remember the benchmark being ~850MB/s, but when I did a benchmark on the array with Crystal Disk Mark I was only getting ~450MB/s. For reference, before encryption at the top end of the array I was getting ~900MB/s. I will have to double check these numbers but that is what I remember them being when I tested.
 
Point well taken. It would immediately solve the issue if the benchmark comes out positive.
A side question, but I think I have this one correct, the encryption key normally cannot leak to the RAID array, leaving me with only the OS hard drive to secure?

@OldSchool, I probably won't be encrypting the array itself (since I'm planning on using TC containers). Unless someone gets me paranoid and says the decryption keys can somehow leak into the array. But I could end up encrypting it as I only require 250 MB/s. Somehow I doubt my Athlon CPU is up to that.
 
From what I understand the only realistic way of retrieving the key is by literally freezing the memory modules and moving them to a different system and extracting the key from memory. Also, there is some sort of rootkit that can extract they key, but the system already has to be infected with it for that attack to be successful - it is a keylogger of sorts.

Also, if it is of any help, the previous processor that was in my fileserver was an Athlon X2 6400+. That one benchmarked around 245MB/s in Truecrypt.
 
I'm not really afraid a rootkit could steal the key nor that someone will freeze my RAM. For the rootkit that attacked TC, I think you are referring to the bootkit called "stoned"?.
But a key could always get paged from memory to disk if you do not use FDE and I consider that as being the biggest risk. Sure, I could overwrite the pagefile at shutdown but that gets annoying fast:).

Thanks for the bench result, I'll try to benchmark my server soon (it is dead ATM as I got DOA RAM modules).

I've also been reading about the Self Encrypting Drive stuff, and so far it seems the BIOS needs to support the ATA Security Mode Feature Set. I'm still unsure whether there are bootloaders a la Truecrypt that can carry out the pre-boot authentication instead of the BIOS. The "key" point here is some software is required to talk to the hard drive.
But as I understand every single sector on the hard drive is encrypted, I would logically assume a bootloader approach will not work (as in does not exist). To clarify, the software to talk to the drive cannot be loaded from the drive at boot time because the drive is fully encrypted and will not decrypt anything until you authenticated.
 
Last edited:
My laptop's SU2300 CPU (dual core 1.2 GHz Core2Duo generation) scores at around 80 MB/s in TrueCrypt. Traditionally AMD CPUs have a higher AES performance per clock than Intel CPUs without AES acceleration.

If you use the ATA password based encryption (like used in Intel 320 SSDs), you will have to use another drive to boot if the BIOS does not support these security features. The drive will not respond to any access as long as it is not unlocked. You cannot even check if it is properly encrypted as the drive does not allow any access AFAIK.
 
Last edited:
If I would have gone the ZFS way, it sure would have.

I've got some further information to share about SED's. It seems some SED drives communicate via the BIOS (for setting and removing the password) and some drives have some sort of mini-linux OS on board that can interact with various software (like online armor and winmagic). This is enterprise grade stuff and drives can even be remotely erased and the password can be remotely entered as well. This negates some major "issues" that Truecrypt does not solve: emergency erase and the option to WOL (wake on LAN) a computer and input the password. I don't need emergency erase but inputting the password remotely is nice:)

edit: it seems authorized software can install itself onto a special area on the SED harddisk. This authorized software in turn communicates with the secure linux OS on the drive. Together they provide the PBA (pre boot authentication). Interesting stuff!
 
Last edited:
OldSchool said:
I have found the Truecrypt benchmarks to be different than real world performance. My array is encrypted with Truecrypt and it is running in a system with a latest generation Xeon with AES-NI. I remember the benchmark being ~850MB/s, but when I did a benchmark on the array with Crystal Disk Mark I was only getting ~450MB/s. For reference, before encryption at the top end of the array I was getting ~900MB/s. I will have to double check these numbers but that is what I remember them being when I tested.
Click to expand...

CrystalDisk works it's magic on the first available free space. You'd have to test the array while it's empty, or create a small partition in front dedicated for benching. It works out good that way too, short stroke all your drives just a little to give yourself a couple hundred GB or whatever given free space and use it as a workspace. Then you'll have your fastest speeds possible while doing large file editing like remuxing bluray, etc.
 
Well there seem to be a fair few vendors for managing SED drives:

- Winmagic
- Online armor (drive armor, part of Trend Micro now)
- Wave Trusted Driver manager
- Secude international
- CREDANT Full Disk Encryption DriveManager
- Softex SecureDrive

All for enterprises :(. I hope to find a vendor for simple user sign-on and if it can be done remotely that would be nice but not really required.

Ofcourse I'm still going to try Truecrypt as I've been using it for years on my normal desktop and this very laptop I'm using. The main downside for me is still the fact that I can't use Wake on Wan on an encrypted machine.
 
Last edited:
Yep, no WoL or WoW (or PXE) boot for encrypted drives.

Have you tried a Linux distro with encryption? My whole server is encrypted and still gets decent performance, even with the older processor.

If you are using Windows, then definitely stick with Truecrypt.
 
Well that is just it, with the above software I listed it is possible to enter your password remotely instead of having to be at the machine physically. So then, WOL would work. I'm also quite confident there are many software FDE vendors that offer similar functionality.

I'm going to have another search, maybe they give single licenses also or maybe I've missed a smaller vendor.
 
Last edited:
You must log in or register to reply here.
Back
Top