22

Just got Ubuntu 14.04 running on a Zotac Zbox CI320. I want to enable the Samsung 840 hard ware encryption that comes with this hard drive, but I don't know how.

Is there anyone that can help me set this up? Much appreciated.

2 Answers 2

14

There are different kinds of hardware encryption on SSDs, see SSDs with usable built-in hardware-based full disk encryption for an in-depth explanation.

You asked about the Samsung 840 EVO in particular. It is always encrypting your data and is unlocked by the ATA HDD password set in the BIOS, which defaults to blank. Later you can move the SSD to a new machine and enter the the ATA HDD password via the BIOS there to unlock it. Nothing involved in unlocking is stored outside of the drive itself.

As a Linux user, I prefer this solution over software-based drive encryption. There is no performance penalty and it is simple to setup and use.

6
  • Hi Mark! First, the link you provided is very interesting, thanks! I have a question for you, the BIOS SSD password of my laptop is at most 10 characters long. This would be a rather weak password if the password could be "brute force" attacked. I mean that if there is anything limiting the number of times per second that an attacker can try a new password; only then the 10 character password would be definitely safe. Do you have any insight into these surprisingly short BIOS SSD passwords? Just in case it is useful to anybody, I have a Toshiba Satellite P50t-B with a Samsung SSD 850 Pro.
    – jespestana
    Aug 16, 2015 at 15:51
  • 1
    See also this more recent article Use the hardware-based full disk encryption your TCG Opal SSD with msed -- tested on Ubuntu Trusty. This should come in handy because Opal 2-based SSDs seem to be turning into a de-facto standard. Newer versions of the msed program are here. A key limitation of current solutions is that they prevent the sleep/suspend (S3) feature which is quite essential on laptops.
    – sxc731
    Jan 15, 2016 at 9:02
  • 1
    @jespestana the difference with the BIOS password is that it can't* be accessed over the network, making the attack more default. *(Perhaps unless you have a serial-to-network connection on the computer, which is unlikely on a desktop or laptop) Jan 15, 2016 at 14:59
  • @sxc731 I don't have an spare computer to try msed, I would probably go for it otherwise. Thanks for the information!
    – jespestana
    Jan 17, 2016 at 11:52
  • @MarkStosberg Ok, you mean that as long as the attacker does not have physical access to the machine I would be safe. That's somewhat reassuring. Still I cannot understand why would Toshiba decide on this short BIOS password limitation...
    – jespestana
    Jan 17, 2016 at 11:56
4

I found the following similar questions:

To my knowledge a working SED setup requires a Trusted Platform Module (TPM), but the Zbox doesn't look like it features or supports TPM (1, 2).

While an answer in one of the questions above offers a solution that might even work in your case you should consider the following:

  • If your data is encrypted using TPM and your hardware somehow breaks, your data is gone. Forever.
  • Usually Linux users prefer software-based disk encryption and software-based RAID, because non-standardized or proprietary technology proved to be unreliable in terms of data security and data recovery. If you intend to use free software solutions like Linux for data security or redundancy, also plan in the required computing resources.
  • There have been reports of successful attacks like Warm Replug Attacks on some devices or setups.

Edit: Michael Larabel posted articles on Phoronix where he speculates that SED/OPAL support may be coming to Linux soon, just in case anyone stumbles over this post from the past looking for more up to date information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .