Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just got Ubuntu 14.04 running on a Zotac Zbox CI320. I want to enable the Samsung 840 hard ware encryption that comes with this hard drive, but I don't know how.

Is there anyone that can help me set this up? Much appreciated.

share|improve this question

There are different kinds of hardware encryption on SSDs, see SSDs with usable built-in hardware-based full disk encryption for an in-depth explanation.

You asked about the Samsung 840 EVO in particular. It is always encrypting your data and is unlocked by the ATA HDD password set in the BIOS, which defaults to blank. Later you can move the SSD to a new machine and enter the the ATA HDD password via the BIOS there to unlock it. Nothing involved in unlocking is stored outside of the drive itself.

As a Linux user, I prefer this solution over software-based drive encryption. There is no performance penalty and it is simple to setup and use.

share|improve this answer
    
Hi Mark! First, the link you provided is very interesting, thanks! I have a question for you, the BIOS SSD password of my laptop is at most 10 characters long. This would be a rather weak password if the password could be "brute force" attacked. I mean that if there is anything limiting the number of times per second that an attacker can try a new password; only then the 10 character password would be definitely safe. Do you have any insight into these surprisingly short BIOS SSD passwords? Just in case it is useful to anybody, I have a Toshiba Satellite P50t-B with a Samsung SSD 850 Pro. – jespestana Aug 16 '15 at 15:51
1  
See also this more recent article Use the hardware-based full disk encryption your TCG Opal SSD with msed -- tested on Ubuntu Trusty. This should come in handy because Opal 2-based SSDs seem to be turning into a de-facto standard. Newer versions of the msed program are here. A key limitation of current solutions is that they prevent the sleep/suspend (S3) feature which is quite essential on laptops. – sxc731 Jan 15 at 9:02
1  
@jespestana the difference with the BIOS password is that it can't* be accessed over the network, making the attack more default. *(Perhaps unless you have a serial-to-network connection on the computer, which is unlikely on a desktop or laptop) – Mark Stosberg Jan 15 at 14:59
    
@sxc731 I don't have an spare computer to try msed, I would probably go for it otherwise. Thanks for the information! – jespestana Jan 17 at 11:52
    
@MarkStosberg Ok, you mean that as long as the attacker does not have physical access to the machine I would be safe. That's somewhat reassuring. Still I cannot understand why would Toshiba decide on this short BIOS password limitation... – jespestana Jan 17 at 11:56

I found the following similar questions:

To my knowledge a working SED setup requires a Trusted Platform Module (TPM), but the Zbox doesn't look like it features or supports TPM (1, 2).

While an answer in one of the questions above offers a solution that might even work in your case you should consider the following:

  • If your data is encrypted using TPM and your hardware somehow breaks, your data is gone. Forever.
  • Usually Linux users prefer software-based disk encryption and software-based RAID, because non-standardized or proprietary technology proved to be unreliable in terms of data security and data recovery. If you intend to use free software solutions like Linux for data security or redundancy, also plan in the required computing resources.
  • There have been reports of successful attacks like Warm Replug Attacks on some devices or setups.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.