4

I've recently upgraded (clean install) to Windows 10 Enterprise. I installed an 850 Pro SSD at the same time.

Knowing that this drive could support hardware encryption for Bitlocker, I naively assumed this would just work. I've since realised to my dismay that hardware encryption isn't being used at all, and Bitlocker is still using software encryption (although CPU accelerated).

I was a little bit suspicious when the encryption seemed to take some time to fully enable (some time like perhaps 5 minutes). I figured that if it was hardware enabled it should be instant.

I don't seem to have any option in my bios to enable UEFI, and I understand that the Windows eDrive feature is only possible with UEFI boot.

Having done a bit more research, it seems as though the hardware encryption feature of the drive can actually be utilised simply by using a bios ATA password, presumably after enabling the "Encrypted Drive" option in Samsung Magician.

Is this actually the case, and if so would it be best to remove Bitlocker encryption entirely and just use the ATA password?

While I'm not looking forward to the prospect of a complete re-install, I'm also not liking the fact that my CPU is doing work that the drive should be able to do more effectively on its own.

Any advice would be greatly appreciated.

Edit: My system is a Dell XPS 17 L702X (bios version: A19)

I don't know why UEFI isn't available. I've checked everywhere in my bios setup, and I can't find anything about legacy vs UEFI boot mode.

Screen shot of Samsung Magician "Data Security" tab

enter image description here

Edit: Samsung has this to say...

"With the introduction of the SSD 840 and 840 Pro Series SSDs, Samsung has added AES hardware-based SED technology to its consumer SSD lineup. Simply enabling the ATA password via the BIOS will automatically render all data on the drive unintelligible without the proper password."

This may be good enough for my purposes. I think I'll just remove the BitLocker encryption, as I guess I'm effectively double encrypting.

9
  • Could you add a screenshot of the data security screen in magician? What's your system and why dosen't it have UEFI? I believe the 'proper' hardware encryption option on that drive is TCG Opal - it uses an onboard chip on the ssd for encryption. Class 0 is just sad. encrypted drive is bitlocker
    – Journeyman Geek
    Aug 22, 2015 at 7:39
  • TCG Opel's the 'better' hardware encryption option, and the one you should be using.
    – Journeyman Geek
    Aug 22, 2015 at 7:55
  • The system is reasonably old, but still quit respectably specc'd: i7-2720QM and 8GB ram. This is why I opted to upgrade the drive instead of replacing the system. Aug 22, 2015 at 7:55
  • Its possibly UEFI capable then. I don't think that's an issue tho
    – Journeyman Geek
    Aug 22, 2015 at 7:56
  • If UEFI is possible it definitely isn't enabled at the moment, MSINFO32 reports BIOS mode "legacy". Aug 22, 2015 at 7:57

1 Answer 1

3

Microsoft reports that you require a UEFI system to take advantage of hardware encryption. This also means disabling the CSM/ Compatibility Support Module. I can't find a direct Microsoft link but here is a news article citing it. Sorry. http://www.anandtech.com/show/6891/hardware-accelerated-bitlocker-encryption-microsoft-windows-8-edrive-investigated-with-crucial-m500

Since you reported that you are in Legacy BIOS mode, you might have a UEFI motherboard, but the CSM is enabled.

If you do find a CSM option, don't disable it right now as windows is still partitioned with MBR and it will not boot.

To be sure windows gets installed with GPT, you have to disabled the CSM before installing. The DVD should be ready to boot through UEFI.

There are some major ATA password vulnerabilities, so I prefer bitlocker as its more secure. https://wikis.utexas.edu/display/ISO/Breaking+ATA+password+security

To reiterate, bitlocker hardware accelerated encryption will only work with full UEFI mode and no CSM enabled.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .