Self-Encrypting Drives Found to Have Critical Security Flaws
Researchers discovered widespread vulnerabilities in TCG Opal2-compliant self-encrypting drives, compromising the hardware encryption relied upon by millions of devices.
Millions of laptops and workstations commonly use self-encrypting drives (SEDs) that promise hardware-level data protection through the TCG Opal2 standard. Users set a password, trusting that the drive's internal chip will securely encrypt all data. However, a recent investigation by security researchers has revealed significant flaws in these drives, undermining the very security they are designed to provide.
Milan Brož and his colleagues tested 38 TCG Opal2-compliant SEDs from various manufacturers, including Samsung, Western Digital, Micron, and Kioxia. These drives, sourced from both new stock and used laptops, were treated as black boxes, with tests limited to commands defined in the Opal2 standard. The findings indicate a concerning lack of security across many of these drives, with some failing even basic security checks.
Several drives exhibited critical weaknesses. Two Lenovo OEM drives, for instance, used the same 'tweak value' for encrypting every sector. This is problematic because the AES-XTS encryption mode relies on unique tweak values to ensure identical data appears as different ciphertext at different locations. Using a single value across the entire drive means patterns in the original data can survive into the encrypted output, potentially revealing sensitive information.
Further issues were found with the random number generators (RNGs) used by some drives. Two drives produced predictable, sequential numbers instead of random ones, while a SanDisk SATA drive showed a bias towards a specific byte value. Although Opal2 mandates that drives expose an RNG, its quality is left unspecified, leading to these inconsistencies that could impact the security of encryption keys derived from them.
The reset tokens, intended to securely wipe drives via a PSID (Physical Security ID) code printed on the label, also presented vulnerabilities. One batch of SanDisk drives generated sequential PSIDs, allowing an attacker who recovers one code to easily derive others. Six other drives were found to accept any arbitrary data appended to a valid PSID, effectively bypassing the intended security mechanism.
Vendors often purchase Opal2 drives to meet data-at-rest requirements, relying on the 'hardware encryption' label without independent verification. This is the first comprehensive security comparison of Opal2 drives, highlighting a significant gap between marketing promises and actual security implementation. The researchers also noted that some drives marketed with hardware encryption only supported Pyrite2, a less secure standard that does not encrypt data at rest.
Brož's team reported these issues to the affected vendors. While Micron released a firmware fix for a sector-size bug, most other vendors either acknowledged the issues as known but unpatched, stated the drives were out of support, or remained silent. Some vendors have responded by disabling the faulty hardware encryption features and directing customers to use software encryption instead.
To address these findings, the researchers have released the Opal Test Suite, allowing anyone to audit their own drives. They have also contributed Opal2 support to cryptsetup, a popular Linux disk encryption tool. The practical advice now is to layer software encryption over the drive's hardware encryption, using the hardware as a secondary security measure rather than the sole protector of sensitive data. The study underscores the need for rigorous independent testing of security features, especially those relied upon for sensitive data protection.