SSD Encryption Questions

phoenix32x

Distinguished
Dec 27, 2011
27
0
18,530
Before I ask my questions, let me say right up front that I could not even qualify as an encryption n00b and thus my questions may seem pretty dumb to the people who are capable of answering them. For that I am sorry, but we all have to start somewhere.

When I read SSD reviews quite often they talk about opal this and encryption that, of which I don't understand a single bit of other than I know what encryption means. I also have seen something about opal in the Samsung Magician software. So I guess my first question is.

1. What is this opal something or other?

Next up, this whole encryption idea makes no sense to me at all. If you encrypt the data, then how can you or your operating system access it? And in reverse, if you or your OS can access it, then why can't someone else who has physical access to your computer? Do you have to type in a password or something every single time you or your OS try to access the drive? That would be a lot of typing! I just don't get how you and your OS can access the data but nobody else can. So I guess my next real question would be.

2. How does this encryption work, I must be missing something here?

Encryption sounds to me like it would take some serious processing. This processing has to be done by something somewhere. So the next question is.

3. How much of a performance hit (and it what areas, cpu, memory, ssd access speed, etc) does encryption cause?

An old joke between some of my friends and I (relating to data security and viruses, etc etc) was that the only way your computer would ever be secure would be to first disconnect it from the internet, then you would have to bury it in the back yard surrounded by concrete. Even then, it would only be 99% secure. Who is to say the encryption software/hardware doesn't have back doors built right into it for say the government, law enforcement, the company who makes the software/hardware, etc. Who cares about government or law enforcement access or maybe even the company who made it you ask? Well, nothing, and I mean nothing in this world ever stays secret. If they have that access, someone else will get it. But even if they don't, things can be hacked. So my next question is.

4. So how secure is this stuff really?

To be honest, I don't think I have or do anything on my computer that would ever justify needing to be encrypted, but this seems to be an important enough subject in general I really probable should learn at least the basics about it. So my last question, at least for now is.

5. Is there a really good primer (encrypting your computer for dummies I guess) out there that is accurate and you would recommend?

TYIA
 
Solution
Full disk encryption is useful for laptops IMO. There is a good chance a laptop will be stolen or misplaced. I don't see a good case for full disk encryption on desktops of home users. Business users could have a different need for full disk encryption on desktops. For a home user, the only sensitive information is usually financial or other personal info. File level encryption seems more appropriate for that.

Full disk encryption does have a performance penalty. There are hardware devices to speed it up or to secure keys, like the TPM --https://en.wikipedia.org/wiki/Trusted_Platform_Module module from Intel. Newer Intel CPUs have added specialized instructions to speed up encryption.

kanewolf

Titan
Moderator
Full disk encryption is useful for laptops IMO. There is a good chance a laptop will be stolen or misplaced. I don't see a good case for full disk encryption on desktops of home users. Business users could have a different need for full disk encryption on desktops. For a home user, the only sensitive information is usually financial or other personal info. File level encryption seems more appropriate for that.

Full disk encryption does have a performance penalty. There are hardware devices to speed it up or to secure keys, like the TPM --https://en.wikipedia.org/wiki/Trusted_Platform_Module module from Intel. Newer Intel CPUs have added specialized instructions to speed up encryption.
 
Solution
If the device (usually a laptop) has full disk encryption, the disk can only be read if (1) it is inside the laptop it was originally installed in, (2) usually the user has entered a BIOS password to power on the device, and (3) the user enters a Windows account password.

Basically what it does is prevent anyone from accessing the data on the disk unless all of the above three are true. So if they lose the laptop, a thief can't access the data because he doesn't know the Windows password. He tries booting off a flash drive to read the data off the disk directly, but the laptop prevents him because he doesn't know the BIOS password. Finally he tries to remove the disk and put it into another computer, but the new computer can't read it because the data is all scrambled and the decryption key is stored in the laptop motherboard.

The decryption is usually handled by a dedicated processor on the drive and/or motherboard. The TPM (trusted platform module) you may have heard about some Intel CPUs supporting is one of these.

It's incredibly rare for a home user to want this level of protection. Usually it's business and government which wants it. For the home user, it just represents an additional point of failure. If you should forget any of those passwords, the disk or even laptop motherboard turns into a brick. The only fix is to replace the drive or motherboard.
 

lrspartan

Commendable
Mar 11, 2016
1
0
1,510
First time poster / long time reader...

So our technology provider has recommended that we use Sophos for hard drive encryption. Would their encryption be better than what a Samsung Pro SSD has in terms of self-encryption? If possible, could you point me to the comparison information as well. A bigger n00b on this!