22

My system:

  • Intel Core i7-4790, which supports AES-NI
  • ASUS Z97-PRO mobo
  • Samsung 250GB EVO SSD (with built-in encryption option)
  • 64-bit Windows 7

If I just want to encrypt my boot drive with AES256 or similar, what would be the difference / faster performance / more secure? Flip Windows Bitlocker on and not use the SSD encryption, or enable the built-in drive encryption that the SSD offers, and don't worry about Bitlocker?

I'm thinking it might be better to offload the encryption to the SSD by using the Evo's encryption option, so that the processor doesn't have to do any encryption, this might be better for I/O performance and give the CPU a breather? Or since this CPU has AES-NI it might not matter?

I'm new to Bitlocker and this SSD encryption option, so any help is much appreciated.

2
  • 1
    you may want to read this detailed answer
    – phuclv
    Sep 16, 2018 at 4:06
  • 1
    Maybe you should try making a benchmarking of each option and posting it here for future reference, given that there's not enough information on the internet to answer this question, AFAIK. Sep 25, 2018 at 5:49

4 Answers 4

11

Old question, but since then several new developments have been found concerning Bitlocker and drive encryption (used either alone or in combination), so I will turn couple of my comments on the page to an answer. Maybe it is of use to someone doing a search in 2018 and later.

Bitlocker (alone):
There have been several ways to breach Bitlocker in it's history, luckily most of them have already been patched / mitigated in 2018. What remains (known) include, for example, the "Cold Boot Attack" - the newest version of which really isn't Bitlocker specific (you need physical access to a running computer and steal the encryption keys, and anything else, straight from the memory).

SSD drive hardware encryption and Bitlocker:
A new vulnerability has surfaced in 2018; if a SSD disk has hardware encryption, which most SSDs have, Bitlocker defaults to using only that. Which means that if that encryption itself has been cracked, the user essentially has no protection at all.
Drives that are known to be suffering from this vulnerability include (but are probably not limited to):
Crucial MX100, MX200, MX300 series Samgung 840 EVO, 850 EVO, T3, T5

More information about the SSD encryption problem here:
https://twitter.com/matthew_d_green/status/1059435094421712896

And the actual paper (as PDF) delving deeper into the problem here:
t.co/UGTsvnFv9Y?amp=1

So the answer really is; since Bitlocker uses the disks hardware encryption, and has it's own vulnerabilities on top of that , you're better off using the hardware encryption if your SSD is not on the list of cracked SSDs.

If your disk is on the list, you're better off using something else entirely since Bitlocker would use the drive encryption anyway. What is the question; on Linux I would recommend LUKS, for example.

1
1

I'v been doing some research on this and have a half complete answer for you.

  1. It is always better to use hardware based encryption on a self encrypting drive, if you use the software based encryption on bitlocker or another encryption program it will cause anywhere between a 25% and 45% slowdown in read write speeds. you could see a minimum of a 10% drop in performance. (note you must have an SSD with a TMP chip)

  2. Bitlocker is compatible with hardware based encryption, you can use samsung magic. v 4.9.6 (v5 no longer supports this) to wipe the drive and enable the hardware based encryption.

http://www.ckode.dk/desktop-machines/how-to-enable-windows-edrive-encryption-for-ssds/

  1. you can enable hardware based encryption via the BIOS by setting the master password. You will need to follow some of the steps in the article above, like turning off CMS.

  2. To answer your question I don't really know which is faster. I have reached out to Samsung but given the limited info on this. Unless I get a developer I doubt I will get a good answer to which is the better option. For now I plan to enable the hardware based encryption in my bios.

5
  • Are you saying "it's better" purely for performance reasons? Do both encryption methods generally provide identical security? I have heard of "self-encrypting" disks having shockingly bad encryption – fast, yes, but not actually secure. Jun 20, 2017 at 16:46
  • Bitlocker has been breached and this has been demostrated by security experts. Essentially, if you can fake AD, etc needed to login to the computer, you can also bypass Bitlocker in the process.
    – DocWeird
    Aug 21, 2017 at 6:54
  • 1
    Beg pardon, @DocWeird , but claiming that Bitlocker has been breached is claiming that AES-256 has been breached - and it hasn't been. What exactly do you mean? Re login, that is irrelevant to Bitlocker! You can boot from a Bitlocker'd drive without logging in at all! It is not the intent of Bitlocker to keep other authorized users on your machine from reading your files, but rather to prevent access to the hard drive's contents if someone steals the drive and connects it to another machine (which would let them bypass all SID-based access control). Are you sure you're not thinking of EFS? Oct 29, 2018 at 2:17
  • There have neen several ways to breach Bitlocker, most of them already patched / mitigated (also including the Cold Boot Attack's newest version which really isn't Bitlocker specific), one was to simply bypass Windows authentication on the (stolen) computer (it involved faking a domain controller, local password cache and changing a password - which all lead to TPM yielding the unencryption key). More here: itworld.com/article/3005181/…
    – DocWeird
    Oct 29, 2018 at 8:01
  • And since we're on Bitlocker vulnerabilities, a new one has just surfaced; if a SSD disk has hardware encryption, Bitlocker defaults to using only that. Which means that if that encryption has been cracked, the user essentially has no protection at all. More here: mobile.twitter.com/matthew_d_green/status/1059435094421712896 and the actual paper (as PDF) here: t.co/UGTsvnFv9Y?amp=1
    – DocWeird
    Nov 6, 2018 at 7:03
0

I am not familiar with your drive and the encryption options it offers, however hardware encryption can be used with multiple operating systems (e.g. when you want to dual-boot Windows and Linux), while software encryption might be harder to configure. Also, the safety of both methods depends on how and where you store your encryption keys.

I'm thinking it might be better to offload the encryption to the SSD by using the Evo's encryption option, so that the processor doesn't have to do any encryption, this might be better for i/o performance and give the CPU a breather?

You are right, hardware-based encryption does not lower the computer's processing speed.

I have never used encryption on any of my devices, so I'm sorry that I can't help you with the actual process of enabling it. Please do note that in most cases enabling encryption causes the drive to get erased (BitLocker does NOT erase data, however it has an extremely remote chance of corruption, as it is with all live-encryption software). If you want to have multi-OS compatible encrypted drive which stays unlocked until the computer is shut down, go with the hardware encryption feature your hard drive offers. But, if you want something a little more secure but limited to Windows, try out BitLocker. Hope I helped!

2
  • At first you state "I know for a fact that hardware encryption is more secure", but at the end you say he complete opposite ("if you want compatible, go with hardware encryption, but if you want something more secure, try BitLocker"). Which one did you mean? Did you account for things like described in this article? Jun 20, 2017 at 16:52
  • 3
    hardware-based encryption is generally more secure is incorrect. It might be faster, but security depends on the encryption standard, not hardware or software, because regardless of how you encrypt the file, the output will be the same with the same key
    – phuclv
    Sep 9, 2018 at 8:59
-5

Update: I believe this answer was correct and an example of real life enterprise experience in hardware and security ops. Maybe I failed to provide details in my initial answer which created the downvotes but also provided insight into the thought process for a more conclusive answer from the community as a whole. Windows but locker has been compromised since launch and has been a well known issue, and not included in enterprise Windows OS but available to consumer level packages for a layer of security/ band aid, NSA Backdoor.

Samsung EVO SSD's built in encryption would be my choice as it is natively optimized and one of the best SSD's out there for security in corporate environments. Also if you ever lose the key, Samsung can unlock it for a fee via the serial # on the SSD.

3
  • 2
    The fact that Samsung can unlock the SSD via the serial # is a red flag imho. Either Samsung uses a algorithm to make the key based on the serial # or has a database with the keys.
    – RS Finance
    Sep 17, 2018 at 8:13
  • Agree with @RSFinance. If another party can get your secure data without your permission, it is not secure. Oct 9, 2018 at 3:04
  • 1
    @RSFinance Except this is not a fact but a fantasy. With Opal SSC-compliant drive this is not possible by design – assuming you initialized the drive properly before use, so that even a theoretical chance of vendor knowing the encryption key is left out. You might not trust in actual Samsung SSD's compliance to Opal SSC, but this is a different story.
    – ᄂ ᄀ
    Jan 15, 2019 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .