Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives

Carlo Meijer, B.E. van Gastel

Research output: Chapter in Book/Report/Conference proceedingConference Article in proceedingAcademicpeer-review


We have analyzed the hardware full-disk encryption of several solid state drives (SSDs) by reverse engineering their firmware. These drives were produced by three manufacturers between 2014 and 2018, and are both internal models using the SATA and NVMe interfaces (in a M.2 or 2.5" traditional form factor) and external models using the USB interface. In theory, the security guarantees offered by hardware encryption are similar to or better than software implementations. In reality, we found that many models using hardware encryption have critical security weaknesses due to specification, design, and implementation issues. For many models, these security weaknesses allow for complete recovery of the data without knowledge of any secret (such as the password). BitLocker, the encryption software built into Microsoft Windows will rely exclusively on hardware full-disk encryption if the SSD advertises support for it. Thus, for these drives, data protected by BitLocker is also compromised. We conclude that, given the state of affairs affecting roughly 60% of the market, currently one should not rely solely on hardware encryption offered by SSDs and users should take additional measures to protect their data.
Original languageEnglish
Title of host publication2019 IEEE Symposium on Security and Privacy SP 2019
Subtitle of host publicationProceedings
Number of pages16
ISBN (Electronic)9781538666609
Publication statusPublished - 19 May 2019
Event40th IEEE Symposium on Security and Privacy - The Hyatt Regency, San Francisco , United States
Duration: 20 May 201922 May 2019
Conference number: 40

Publication series

SeriesIeee Security & Privacy


Symposium40th IEEE Symposium on Security and Privacy
Country/TerritoryUnited States
CitySan Francisco
Internet address


  • BitLocker
  • Hardware-encryption
  • Vulnerabilities


Dive into the research topics of 'Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives'. Together they form a unique fingerprint.

Cite this