49

Recently I had an SSD fail and am attempting to do a data recovery. The data recovery company tells us that it is complicated because the build-in drive controller uses encryption. I presume this to mean that when it writes data to the memory chips it stores it in an encrypted format on the chips. If this is true, why on earth would they do that?

  • 4
    Please edit your question to add some details on the OS this SSD was running on as well as the exact make/model of the SSD. To my knowledge, unless you have full disk encryption enabled or the drive has native encryption, it all sounds like a ruse by the data recovery company to deflect their incapability to some “magic” that prevented them from recovering data. SSDs should just be storing data in a raw format—like all other storage devices—and not any encrypted format by default. – JakeGould Oct 14 '15 at 4:32
  • 1
    some external drives do have hardware encryption by default but I'm not sure if an internal one also encrypts data – phuclv Oct 14 '15 at 4:39
  • 8
    @JakeGould many modern drives are internally encrypted. Annoyingly, finding sources is a pain when you actually need them, but at the very least sandforce's controllers certainly does this. – Journeyman Geek Oct 14 '15 at 4:52
  • 3
    @JakeGould: Many newer SSD controllers, including all recent SandForce and Samsung controllers, use always-on encryption. Some newer Seagate hard drives, including several consumer desktop models, are self-encrypting (see here; this is what enables the Instant Secure Erase feature). Most newer WD external hard drives are self-encrypting. – bwDraco Oct 14 '15 at 5:22
  • 1
    SSDs encrypt or at the very least scramble the data (citation needed here!) for wear levelling reasons. HDDs have no need to encrypt data at a firmware level for the same reasons. – Journeyman Geek Oct 14 '15 at 5:34
52

Always-on encryption allows you to secure your data by setting a password without having to wipe or separately encrypt the data. It also makes it fast and easy to "erase" the entire drive.

  • The SSD does this by storing the encryption key in plaintext. When you set an ATA disk password (Samsung calls this Class 0 security), the SSD uses it to encrypt the key itself, so you'll need to enter the password to unlock the drive. This secures the data on the drive without having to erase the entire contents of the drive or overwrite all data on the drive with an encrypted version.

  • Having all the data encrypted on the drive also brings another perk: the ability to effectively erase it instantly. By simply changing or deleting the encryption key, all data on the drive will be rendered unreadable, without having to overwrite the entire drive. Some newer Seagate hard drives (including several newer consumer drives) implement this feature as Instant Secure Erase.1

  • Because modern hardware encryption engines are so fast and efficient, there is no real performance advantage to disabling it. As such, many newer SSDs (and some hard drives) have always-on encryption. In fact, most newer WD external hard drives have always-on hardware encryption.


1In response to some comments: This may not be entirely secure considering that governments may be able to decrypt AES within the near future. It is, however, generally sufficient for most consumers and for businesses who are trying to reuse old drives.

  • 6
    "The SSD" refers to the OP's disk. This is not a claim that every SSD is self-encrypting. Edited to address the claim. – bwDraco Oct 14 '15 at 4:56
  • 2
    I just edited to clarify this specific claim. Remember: These questions and answers are for others as well as the original poster. Being as clear as possible about context helps everyone including users who would stumble across this thread in the future. – JakeGould Oct 14 '15 at 4:58
  • 4
    I like how the industry tries to convince the user that throwing away the encryption key is == destruction of data. In reality it most certainly is not. Encryption only buys time that the adversary has to invest in recovering your data. If you want 'Secure Erase' then you actually need to overwrite the data. – James Oct 14 '15 at 18:22
  • 8
    "there is no real advantage to disabling it". Yes, there is, right in the question. If the drive loses or messes up the key... basically 0 chance of data recovery... unless you've got the NSA working for you. – Fizz Oct 14 '15 at 21:50
  • 10
    @TechMedicNYC if you know a way to break AES-256 in less than say the next few billion years, please do share. – Josef Oct 15 '15 at 7:29
33

It is a beautiful utterly elegant hack used to save on wear on the disk. Scrambling/randomising data on MLC drives also improves reliabilty on smaller process sizes - see this paper and these two referenced patents (here and here, and encrypted data is essentially random (thanks to alex.forencich for digging that up in the comments). In a sense AES encryption works the same way as the LSFR used to randomise data on a non encrypted ssd, only faster, better and simpler.

This class of drive is known as self encrypting drives, and quite a few modern SSDs are built like this. Essentially, encryption is relatively 'cheap', and allows you to store data scrambled on a SSD (some drives do this without encryption to improve reliability anyway). If you need to format it? just make the data inaccessible until the space is needed by discarding the key. It's done at the firmware level, and is decrypted on the fly. This also helps save on wear since data is spread out in the process.

Unless you set an HDD security password in bios, or set some other type of supported security/encryption option, all this prevents someone from doing is desoldering your NAND chips and reading them elsewhere, or putting in a new controller and getting your data out - see this AnandTech review of the Intel 320. Of course, when your drive dies, and if it's the controller, that's exactly what a recovery service would end up doing. Unless they could somehow recover the encryption keys from where its stored, (firmware?) and transfer it, it's probably impossible.

In short, encryption increases the lifespan of your disk, and makes it 'faster' when deleting files.

  • 5
    What source do you think backs up the claim that the reason SSDs implement encryption is to save wear on the disk? That seems like an absurd claim to me, since SSDs know what space is free, they pre-erase it anyway, and secure erases are rare. Also, there are many obvious reasons to support encryption in firmware that have nothing to do with erasing. – David Schwartz Oct 14 '15 at 6:40
  • 9
    It is utterly insanely elegant, because you want to have a balance between the 1s and 0s on the disk to make sure it wears evenly. So you want a even distribution of bits, something normal data is extremely poor at but encrypted data is excellent at. So they run everything through AES to keep the 1s and 0s evenly distributed, elegant solution that also has side benefit of being able to secure erase the drive by forgetting the key. – r_ahlskog Oct 14 '15 at 7:44
  • 9
    @r_ahlskog "you want to have a balance between the 1s and 0s on the disk to make sure it wears evenly" Umm, do you have a source for this claim? – David Schwartz Oct 14 '15 at 8:34
  • 6
    The bits in modern flash memory are so small that there is crosstalk between them. Because of this, if too many adjacent bits are set the same way, it can cause more bit errors than if the bits were more random. Because of this, 'scrambling' or 'whitening' techniques are used to balance the number of 1s and 0s. This could be done with a simple linear feedback shift register. Or it could be done with an algorithm like AES that effectively scrambles the bits while also providing some nice security and fast secure erase benefits. – alex.forencich Oct 16 '15 at 5:02
  • 4
    Here is a better one that relates specifically to using AES for scrambling: jstage.jst.go.jp/article/elex/11/13/11_11.20140535/_article – alex.forencich Oct 16 '15 at 6:00
3

For security reasons! SSDs store the data scrambled all over the place and on different flash chips. Because flash can break, they all have more storage space than advertised and useable.

Now assume you have top secret information on your disk unencrypted. You now decide that's a stupid idea and encrypt the whole drive.

But you can't encrypt the whole drive. The SSD just shows you 16GB of space, while it has 20GB internal (in reality, the additional space is less). You encrypt all of the 16GB, but inside the drive there are still 4GB and you have no way to know what's stored there. Maybe one flash chip is even partially defective and the drive will never touch it again. A data thief could still directly read data from that.

Another reason is to allow fast data destruction. If you have to erase a 1TB SSD with 400MB/s, that will take 42 minutes. If you want to remote-wipe your SSD in a stolen laptop, in this 42m the thief will see that something is wrong and cut the power. For the same reason, most newer smartphones are encrypted by default, even if you don't need any pin.

Wiping a encrypted SSD/phone works by just wiping the 128bit (or 256bit) key. After that, all the data is worthless.. This takes less than a second.

  • A sensible long-secure-erase process would start off by storing some sort of flag, which the firmware only clears once the process has successfully run to completion, and a counter indicating how far the erase has progressed. If the device is powered up and this flag is set, resume erasing where it left off. A quick first step can be to simply erase the flash block mapping table, which results in plaintext being available but no way of knowing which parts fit together. Lots of thieves are interested only in the money they can get from the hardware, and have little to no interest in the data. – a CVn Oct 15 '15 at 13:15
  • @MichaelKjörling that won't work at all. If you are really interested in the data you could just erase the flag. Or directly read the flash chips without using the controller. – Josef Oct 15 '15 at 13:42
  • Except that most thieves are not interested in the data! They want the hardware that they can sell to get some money, and (unless you are, say, a journalist working with the Snowden documents) don't care about what's stored on the computer. Erasing the flash mapping table is also quite fast. And by the time we are talking about adversaries who are willing to desolder or manually reprogram the chips, we are way beyond almost any ordinary thief in the first place. If you have data that is sufficiently valuable that this figures into your threat model, you need to use a strong password. – a CVn Oct 15 '15 at 13:49
  • @MichaelKjörling in that case you can also just not erase the data at all, if the thief is not interested. – Josef Oct 15 '15 at 13:51
  • 'because flash can break' is a nice story, but not the reason for only revealing part of a SSDs capacity. The [main] reason is performance. – Hennes Oct 15 '15 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.