Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Seagate Ships World's Most Secure Hard Drive

Posted by kdawson on Mon Mar 12, 2007 10:02 AM
from the laugh-at-lost-laptops dept.
Data Storage Encryption Security Hardware
An anonymous reader writes to let us know that after two years Seagate is finally shipping its full-disk encryption product, and you can get your hands on it in a laptop from system vendor ASI.
+ -
story

Related Stories

[+] IT: Seagate To Encrypt Data On Hard Drives 321 comments
Krishna Dagli writes "Seagate, using their new DriveTrust Technology, will automatically encrypt every bit of data stored on the hard drive and require users to have a key, or password, before being able to access the disk drive."
[+] Seagate Releases Hybrid Hard Drive 218 comments
An anonymous reader writes to tell us Seagate has released a new hybrid hard drive. This new drive adds the speed of a solid state drive to the conventional hard drive. Originally designed for laptops this new drive comes in 80, 120, and 160 GB flavors and features 256MB of flash memory.
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Seagate Ships World's Most Secure Hard Drive 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • worlds stupidest user with passwords like 'password' :-)

    Also how are they using AES? I thought P1619 (XTS-AES) is still a draft. Are they betting it will get adopted unchanged? Or are they using some other thing? Please tell me it's not AES in ECB mode...

    Tom

    • Re: (Score:3, Informative)

      by archen (447353)
      Actually it appears that it is using a CBC, there appears to be a middle layer that arbitrarily partitions sections that are encrypted and decrypted on the fly. I was pretty skeptical the last time this was mentioned on slashdot, but I have to admit this actually looks like a promising product. I'll wait for some more skillful security experts to evaluate it first, but I'm certainly keeping an open mind on it.
      • But CBC requires IVs. Are they using up sectors to store them?

        The whole idea of XTS is that you can get privacy without extra storage.

        Tom

      • Re: (Score:3, Interesting)

        by Loconut1389 (455297)
        I wonder what sector corruption does in CBC mode then? Lose more of the drive? Or have the used some overhead for extra forward error correction?
        • You lose the rest of the encrypted block, not the whole drive (I think).

          • Re: (Score:3, Informative)

            by J'raxis (248192)

            This is how Linux's crypto-loop works. The CBC is run across only individual 512-byte blocks of the disk. I think they use the sector number as an IV.

        • Re:Worlds most secure cipher meet ... (Score:4, Informative)

          by this great guy (922511) on Monday March 12 2007, @11:34AM (#18317819)
          Most good hard disk encryption technologies behave in way that if a single bit is flipped in an encrypted sector, then the whole decrypted sector becomes corrupted (and others sectors around this one are not affected). This sort of behavior is desired and help prevent content leak attacks.

          For example, Loop-AES behaves like this in multi-key-v3 mode where CBC is used with an IV computed from a secret key, the sector number, and plaintext blocks [1..n-1] in the sector. This is also how Microsoft Bitlocker behaves because they combine CBC with the Elephant diffuser. When CBC is not used, this property can be achieved using LRW or XEX, or wide-block encryption.

    • No need to blame the user. (Score:5, Insightful)

      by twitter (104583) on Monday March 12 2007, @11:36AM (#18317843) Homepage Journal

      worlds stupidest user with passwords like 'password' :-)

      That's a joke, but some people really think that way. Blaming "stupid users" makes them feel more secure or helps them pass the buck for choosing systems with poor security. When you think about it, it's not very funny.

      Passive encryption might be a step in the right direction, but I won't trust it as long as the software doing has owners and secrets kept from users. They can point to specs and tell me what they are doing, but that does not mean they are doing that. The owners can break in at will, the keys can be padded with zeros and finally, the owners can make mistakes.

    • Re: (Score:3, Interesting)

      by simm1701 (835424)
      actually using something as trivial as password (or passw0rd since many things refuse password when setting one) is not always a bad thing

      Take all these shops that you have to sign up with before buying something, all they store is your address, your email address, your email and on rare occasions order history (the ones that also store credit cards are a different matter but those are less common and I'm not talking about those here)

      Why should I use one of my more secure passwords? I dont like to change pa
  • What makes this the most secure?

    Is this really any more secure than dm-crypt? Faster, no doubt, but more secure?

    • Re: (Score:3, Informative)

      by Nutria (679911)
      What makes this the most secure?

      Because it's the only (publicly available) HDD with *cryption functions built into the circuitry.

      Is this really any more secure than dm-crypt? Faster, no doubt, but more secure?

      Probably not. But simpler for users/admins to put out in the field.

      But closed-source, so we really don't know how well it was implemented.

      • I guess I still don't get it -- tell me again why doing this in the HDD circuitry is useful?

        I mean, we still do software RAID, and find it pretty useful -- and it's at the point where there's plenty of "fakeraid" out there to deal with Windows' lack of good (cheap) RAID tools. So, why not just implement something similar -- BIOS crypto? That would make it easy enough, without actually having to put more circuitry on the drive.

        For that matter, it seems to me like it would make much more sense to have a gener

  • Backdoored? (Score:5, Interesting)

    by J'raxis (248192) on Monday March 12 2007, @10:12AM (#18316789) Homepage

    Who knows what this thing is doing inside? They're using AES-128 so you may not have to worry about the encryption algo being unsecure, but who's to say this thing isn't caching the password in some place you don't know about (but that the manufacturer and your country's authorities do)?

      • > require the OS to supply the password at some interval to a write-only memory.

        Sounds really useful. From what I hear, write-only memory is about as cryptographically secure as it comes.
        • Um, it exists. Basically you put memory behind a controller which does not allow reads from a given bus. Hence, write only.

          NEWBIE!
      • But what about keyloggers on the computer?

  • Oh Goody! (Score:5, Insightful)

    by LibertineR (591918) on Monday March 12 2007, @10:17AM (#18316859)
    According to Seagate, any US company that loses a laptop using the Seagate drive in conjunction with the launch security management system from Wave Systems, will not have to give public notification of the loss, even if the data is of a highly confidential nature. This alone guarantees that the technology will find a market given the increasingly costly and embarrassing repercussions of laptop thefts.

    Who cares if this gets cracked by Tuesday, bitches?

    The selling point is that the banks wont have to tell you when Bubba leaves his laptop on the CAL TRAIN with your credit card data in standby mode, cause its encrypted!

    I feel so safe!

    • Next step - find out what the minimum passwords requirements are. With a password you're likely to type in every time the laptop boots, you can bet it'll be as simple as possible. For example, if it's 8 latters, must include capital and number, you can almost bet it'll be XxxxxxxN for a whooping 36 bits of security. Almost nobody bothers to type in a password to match the AES strength with any regularity...

      • Re: (Score:3, Informative)

        by Nutria (679911)
        Next step - find out what the minimum passwords requirements are. With a password you're likely to type in every time the laptop boots, you can bet it'll be as simple as possible. For example, if it's 8 latters, must include capital and number, you can almost bet it'll be XxxxxxxN for a whooping 36 bits of security. Almost nobody bothers to type in a password to match the AES strength with any regularity...

        Don't be so sure.

        I had to install PGP Desktop and encrypt my laptop's HDD, and when it asked me for th
    • To this day I do not understand why computers outside of a massively secure data center are allowed to keep records of ANY private data. We don't let any of our staff maintain local copies of any data. Not even e-mail. If you stole a computer from any of our offices, you'd basically have an underpowered Dell desktop. You could easily log into the system, but aside from a few cache files and browsing history, you'd have nothing.

      Why is it so hard for banks and insurance companies to do the same?

      It's not like

  • And in next year's news... (Score:5, Funny)

    by dpbsmith (263124) on Monday March 12 2007, @10:21AM (#18316899) Homepage
    it will transpire that ...Los Alamos National Laboratory misplaced a notebook full of top-secret data in which the encryption had never been turned on... ...a Microsoft executive lost a notebook full of plans for dirty ways to undermine Open Source, after sticking Post-It note to the screen to remind him of his wife's birthday, which he used as his password... ...all the scientific data from a major NASA mission costing $1.63 billion were stored on a contractor's laptop, who had encrypted all of it, chosen a good password, never wrote it down, and got hit by a bus without telling it to anyone... ...but NASA was able to recover the data by asking the FBI, which knew the backdoor and had been reading every NASA contractor's hard drive without a warrant.

    • Re: (Score:3, Insightful)

      by malcomvetter (851474)
      That makes a good laugh, but in all seriousness, we will likely read headlines like this in the next 5 years or so:

      Financial fraud linked to stolen encrypted laptop
      In the largest online fraud incident in history, experts linked the Personally Identifiable Information (PII) used in committing the fraudulent acts back to a laptop that was stolen over a year ago. Company X denies the experts' allegations saying "the laptop's hard drive was encrypted." Under this premise, Company X refrained from notifyi

  • real question (Score:3, Insightful)

    by Lord Ender (156273) on Monday March 12 2007, @10:25AM (#18316949) Homepage
    If I put one of these in a regular laptop--one which supports DriveLock, but nothing else--can this disk use the DriveLock password as the encryption key?

    If that were the case, it would be a simple matter to retrofit existing laptops (which use DriveLock to protect the disks) with the improved security of full-blown encryption. And it could be done without any perceptible changes to the user!

    This could be a great product if they just Keep It Simple so that it works seamlessly with the already widely-deployed ATA Security Mode (DriveLock) protocol.
  • It's called /dev/null

    Granted, getting data back is a bit, erm, difficult, but write only memory? That's pretty damn secure.

    (And anticipating witty responses... I will accept that /dev/null isn't technically a hard drive, but then I'd have no joke, so work with me here!)

  • Back Door For Big Brother ? (Score:4, Insightful)

    by Junior Samples (550792) on Monday March 12 2007, @10:31AM (#18317045)
    Seagate is an American Company. Is it possible for them to provide a secure product without providing a back door for Big Brother to access? Can they be trusted? I'm very skeptical.
    • You're right I'll wait until China produces one. There's a government I trust.
    • For the tinfoil community, simply create a circuit to short-cut the battery (or any other low-power incendiary device) in case of wrong password and use a Sony laptop to be able to claim bad luck when the FBI ask you to enter your PW.
    • Is it possible for them to provide a secure product

      Of course. Stop living in 1993. (http://en.wikipedia.org/wiki/Clipper_chip [wikipedia.org])

      without providing a back door for Big Brother to access?

      Depends on whether or not they want to sell into the Chinese market.

    • Your hard disk may already contain "back doors" in the form of hidden sectors and undocumented features for accessing them. These may already be being used for forensic recovery. Their purpose may not be sinister: they may exist simply so that damaged areas of the disk can be transparently remapped. But it's just another reason why you can never be sure that a piece of data has been deleted from your disk, unless you physically destroy it.

      I wonder where Richard M. Stallman gets his disks from? I don't know

  • The incomplete article is missing any mention... (Score:5, Informative)

    by BenEnglishAtHome (449670) * on Monday March 12 2007, @10:36AM (#18317121)
    ...of the competitors in this market space. Several companies have been doing this for years with good track records. I think these links [slashdot.org] are still good.
  • Like Vista's BitLocker (which can do a similar thing in software), this is mainly to prevent the hard drive from being mounted on different hardware because the fact that the drive is actually encrypted is going to be transparent to the user. Any random idiot can still access the data on your laptop with one of these drives if you leave your password on a sticky note -- or use no login password at all.

    If you want to proect files on your laptop from being accessed by a logged-in user, you need to use somet

  • Video Camera Application? (Score:3, Informative)

    by mwilliamson (672411) on Monday March 12 2007, @10:52AM (#18317353) Homepage Journal
    Slap one of these bad-boys into a video camera with only the ability to only write/encrypt and then you'll have a tool journalists can use without fear their content will be pilfered by a herd of unwieldly pigs. Only once the cam is back from the field would the data be accessable. This of course assumes the drive uses some sort of PKI, it may be symmetric only, in which case you'd have to add something to generate the symmetric keys from a PKI infrastructure. Performance should still be good with the added PKI module since the internal crypto would still be using the hardware accelerator with the derived symmetric keys.
    • Your PKI doesn't do shit when some third-world government thug runs a few dozen 7.62x39 rounds through your camera. They generally don't want to steal your video, they don't want anyone to SEE your video AT ALL, and AK rounds accomplish this nicely.

      • by third world i'm assuming you mean US, in particular any government force with a gun, either your local PD SWAT team or certain branches of our military government...

    • pilfered by a herd of unwieldly pigs.
      How does one wield a pig?

      Get back or I shall slay you with my +9 Pork Chop of Gluttony!
  • This is mainly marketing hype. The Seagate drives are now the worlds most secure because they are shipped in a 'Clamshell/Blister Pack'. I dare anyone without specialized tools to access it.
  • LaCie had a 500GB AES 128-bit hardware encryption fingerprint-biometric (with FireWire 800, FireWire 400, & USB 2.0) like, 6 months ago! Why is this news?

    http://www.lacie.com/us/products/product.htm?pid=1 0872 [lacie.com]

  • Secure from who? (Score:3, Funny)

    by Assassin bug (835070) on Monday March 12 2007, @11:56AM (#18318151) Journal
    My highspeed, large-capacity Seagate drive wasn't secure from itself when it decided to critically fail 1 week after warrenty!

  • Hibernate (Score:3, Insightful)

    by Nom du Keyboard (633989) on Monday March 12 2007, @12:21PM (#18318535)
    And how secure is it if you hibernate, rather than shut down, your system? Does all the crook have to do is keep it powered, or do you need to re-enter your password each time you raise the lid? If so, I suspect the password is going to be rather short, and easily guessable.

    The real problem is not designing effective security, but getting people to use it properly. You can start on this by banning PostIt notes from the corporate environment -- or at least make them self-destruct.

  • Top 10 Most Secure Hard Drives (Score:3, Insightful)

    by malcomvetter (851474) on Monday March 12 2007, @01:27PM (#18319843)
    The Top 10 Most Secure Hard Drives in Existence to date:

    1. The world's most secure hard drive is the one not used to contain valuable confidential data (experts question its existence).
    2. Doesn't exist.
    3. Doesn't exist.
    4. A hard drive that contains some valuable confidential data, but remains physically within a datacenter. The OS that accesses it does not share its data with other OSes, and runs the full gamut of controls (prevention, detection, correction).
    5. Doesn't exist.
    6. Doesn't exist.
    7. Doesn't exist.
    8. Doesn't exist.
    9. A hard drive that contains some valuable confidential data, remains physically within a datacenter, but its OS shares data among other systems whose trust is "unknown" or "uncertain".

    And tied for 10th place (by virtue of consolation):
    10. An encrypted drive in a mobile device relying upon its user for security.
    10. An unencrypted drive in a mobile device relying upon its user for security.

    If the "laws of physics" of information security were known, we'd likely see a Newtonian-esque law that says something like (in a more scientific form): "any security system that relies upon a person to use the system correctly will fail [miserably]". What Seagate is trying to do is analogous to defying gravity or creating "information security perpetual motion". It just won't improve the situation for anyone (except perhaps the "checklist security" people who can tell their compliance regulation auditors that they can add a point to their useless overall score).

    • Re: (Score:2, Insightful)

      by lukas84 (912874)
      Because by now, a 3GB SATA controller is cheaper than a PATA controller.

      Supply & Demand.

    • Re:3gb/s sata on a 5400 rpm drive? (Score:5, Insightful)

      by MightyYar (622222) on Monday March 12 2007, @10:32AM (#18317061)
      Wild speculation here, but it could be one or more of the following:
      • They sell a lot of drives with a lot of different speeds. It might be cheaper for them to standardize on a few chipsets then to buy different chips and have different designs based on the drive's capability.
      • For marketing reasons, they may have decided to always have the latest-and-greatest buzzword on the box of all of their new products.
      • A major customer asked them to use this interface.
      In all, not the strangest decision I've come upon today.
    • Well, I'm assuming there is a microchip on the drive itself that does the encryption/decryption. I'm guessing there may be a lag between reading the data off the drive and sending it back to the computer via the SATA bus, so giving the highest possible burst speed I can see being an advantage here. More so than a standard 5400 RPM SATA drive that would only have to handle reading and writing, anyway.
    • Why not save $$ and put either a PATA or SATA 1 controller?

      What, precisely, makes you think also supplying PATA or an older SATA device would be cheaper? Perhaps it is cheaper for a manufacturer to not bother with multiple different SATAs, or fiddly, obsolete parallel buses and simply adopt one device across the board. In terms of R&D, supply chain, manufacturing and QA it is rather easy to imagine that obviating older standards is actually cheaper, but I don't know, because I don't manufacture millio
    • Hard drives have caches which can max the bus interface, since they operate at RAM speeds, and not disk speeds. So whenever you get cache hits, you can expect your data to go through the full 3GB/s.

    • Re: (Score:3, Informative)

      by pv2b (231846)
      There's a funamental difference here.

      Most DRM hinges on the fact that the content must stay readable, in however limited a sense. In other words, you're giving the encrypted content to the attacker, who also has to have the key in order to use it. The attacker and the intended recipient are the same person.

      When you take away that requirement, encryption actually becomes workable.

    • Re: (Score:2, Informative)

      by stratjakt (596332)
      You don't have to use the fingerprint reader, and my understanding is that it's more of a windows-logon thing than a boot-up thing.

      However, you could easily design a keypad that makes it nigh-impossible to lift a print. A simple rough textured finish on the top would do the trick.
      • Until the rough finish wears out. Most of my keyboards have the keys worn away pretty smooth. I even have a keyboard at home where the bumps on the J and F keys are almost completely gone. You could also lift a print from the screen, or anywhere else on the case also, not just the keyboard.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.