12

Due to the fact that TrueCrypt is "not secure" I've been looking for some other way to encrypt the data.

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues You should download TrueCrypt only if you are migrating data encrypted by TrueCrypt.

Could you provide some information about pros & cons connected with hardware-based encryption? What if the firmware is controlled by a third-party malicious? I'll be glad if could recommend some SSD which cover the following points:

  1. There is no problem with BIOS compatibility.
  2. The quality of the encryption is similar to the TrueCrypt.
  3. Firmware of the drive haven't been compromised.

By the way... Have you heard about TOMB?

  • This site was created for questions seeking specific hardware recommendations given a set of definitive requirements. General computing hardware issues are on topic at Super User. – Robert Cartaino Sep 16 '15 at 13:52
  • Their support from the software side is currently lacking. If you do not want to be tied to Windows only, your best bet is probably software full disk encryption + regular SSD. – Display Name Oct 25 '15 at 16:29
  • I definitely recommend this, the performance is much better than with software encryption. BIOS compatibility: most support it, but some hash passwords differently, so you may not be able to use the encrypted HD on a different computer. Quality of encryption/firmware: I'm afraid you just have to take this on trust, there's nothing that an end user can do to validate this. – paj28 Dec 15 '15 at 14:58
14

Whether the firmware has been compromised is a valid concern — it happens (it's been done for show, and it's rather rare but it has been found in the wild).

But a bigger concern is whether the firmware has been programmed correctly. Many SSD firmwares don't implement secure erase properly. Should you trust them to implement crypto properly? I haven't seen a reliable study on the topic, but I've heard (private rumors in some security communities) that some “self-encrypting drives” are actually mere password-protected drives, with no encryption if you just bypass the controller. As a consumer, there's absolutely no way to know whether a particular device does it right¹.

The upshot is that I wouldn't rely on the encryption capabilities of a storage device.

There's not much point in doing encryption on the drive itself rather than in the CPU anyway. This isn't the 1990s, most CPUs have plenty of spare cycles, of which encryption will only cost a little. Major operating systems come with native encryption: Bitlocker under Windows, dm-crypt under Linux, etc. If you have one of the cheaper editions of Windows that don't have full-disk encryption, or if you need an encrypted removable drive that's portable between operating systems, use one of the TrueCrypt successors.

¹ Finding a way to attack a particular model can have a cost in the $10k–100k range, so it's not something you can do casually — but once the attack is found, carrying it out on a particular drive has an incremental cost that can be in the $10–100 range, or <$1 if it's a pure software attack on a buggy firmware.

| improve this answer | |
  • Bitlocker isn't a very good choice. Thank you for pointing out the successors of the TrueCrypt. – belford Sep 11 '15 at 10:01
  • 1
    But if you 'really' want to use BitLocker there is also the possibility of installing a Trusted Platform Module (TPM). [quietpc.com/gc-tpm]: "Easy to install on TPM-ready motherboards from Gigabyte and ASUS" "Allows Microsoft BitLocker drive encryption to fully operate" "Because the TPM uses its own internal firmware and logic circuits for processing instructions, it does not rely upon the operating system and is not exposed to external software vulnerabilities." – minidec Sep 13 '15 at 8:12
  • 1
    Great answer. In general, I would trust a solution that you can control over something that is virtually inaccessible by you as a customer (i.e. software vs manufacturer firmware). As always, I'd recommend that you actually run tests that closely simulate your actual usage conditions. That way, you can make sure that, for your use case, the solution works. – Juan Carlos Coto Sep 14 '15 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.