Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives

Carlo Meijer, B.E. van Gastel

Research output: Chapter in Book/Report/Conference proceedingConference article in proceedingAcademicpeer-review

Abstract

We have analyzed the hardware full-disk encryption of several solid state drives (SSDs) by reverse engineering their firmware. These drives were produced by three manufacturers between 2014 and 2018, and are both internal models using the SATA and NVMe interfaces (in a M.2 or 2.5" traditional form factor) and external models using the USB interface. In theory, the security guarantees offered by hardware encryption are similar to or better than software implementations. In reality, we found that many models using hardware encryption have critical security weaknesses due to specification, design, and implementation issues. For many models, these security weaknesses allow for complete recovery of the data without knowledge of any secret (such as the password). BitLocker, the encryption software built into Microsoft Windows will rely exclusively on hardware full-disk encryption if the SSD advertises support for it. Thus, for these drives, data protected by BitLocker is also compromised. We conclude that, given the state of affairs affecting roughly 60% of the market, currently one should not rely solely on hardware encryption offered by SSDs and users should take additional measures to protect their data.
Original languageEnglish
Title of host publication2019 IEEE Symposium on Security and Privacy SP 2019
Subtitle of host publicationProceedings
PublisherIEEE
Pages72-87
Number of pages16
DOIs
Publication statusPublished - 19 May 2019
Event40th IEEE Symposium on Security and Privacy - The Hyatt Regency, San Francisco , United States
Duration: 20 May 201922 May 2019
Conference number: 40
https://www.ieee-security.org/TC/SP2019/program.html

Publication series

SeriesIeee Security & Privacy
ISSN1540-7993

Symposium

Symposium40th IEEE Symposium on Security and Privacy
CountryUnited States
CitySan Francisco
Period20/05/1922/05/19
Internet address

Fingerprint Dive into the research topics of 'Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives'. Together they form a unique fingerprint.

Cite this