Fujitsu HDD with AES 256-bit Encryption 220
An anonymous reader writes "Fujitsu today updated its 2.5" 320GB hard disk drive with automatic hardware-based encryption to effectively secure data against theft or loss. According to Fujitsu, the MHZ2 CJ series is the first hard disk drive in the world to support the 256-bit Advanced Encryption Standard (AES). The drive implements the AES hardware encryption directly into the processor chip of the hard disk drive, resulting in more robust security and faster system performance than software-based encryption."
Comment removed (Score:3, Informative)
Re:Is this really necessary? (Score:5, Insightful)
However disk encryption on the whole can and will slow computers down, not significantly on modern computers but it does.
By transferring the overhead from the CPU to the processor built into the hard drive there is no slow down to the overall performance of the computer
I don't know if any of you linux fans out there have performance/overhead stats on using the device-mapper tool, but for someone who is trying to get the best out of their processor, moving this process from software to hardware is the ideal solution.
Re:Is this really necessary? (Score:5, Informative)
Really not significantly.
I haven't done any benchmarks of the speed of the drive itself, though I suspect it adds some latency. But the actual CPU usage is insignificant, compared to just about anything else you might do on the machine.
Seriously, ntfs-3g is going to be a MUCH bigger slowdown -- yet I've run ntfs-3g on top of dm-crypt, and it was still usable. Just did a quick "find /", and watched top, and while find itself occasionally climbed to 10% CPU (and on Linux, that means 10% of one core), the actual kernel crypt process never rose above 1%. It's now installing software updates, and the kernel crypto process just rose to 15%.
Another statistic: After four days of using this computer since the last full reboot (hibernating every now and then), one crypt process has accumulated a little over an hour of CPU time. The other has a little over a second.
Keep in mind, most software doesn't know how to take advantage of more than one core, so most people do actually have most of a core just sitting idle. That's why dual-core feels faster. If, under heavy load, the crypt process might -- maybe -- take 20% of that core, you're still not really going to feel it. And most truly CPU-intensive tasks, like games, video encoding, raytracing, etc, are not incredibly disk-intensive.
All in all, I think that outside of embedded disks, the CPU time we spend on our storage isn't really relevant. At this point, doing some simple lzo compression may actually improve performance, as you're still going to be faster than the disk is, and reading less raw data from the disk takes less time.
No, the real reason we're seeing this in hardware is because Windows will support it, and easily. I imagine there's a fair chance there's some BIOSes out there that do it in software, too.
Re: (Score:2)
All in all, I think that outside of embedded disks, the CPU time we spend on our storage isn't really relevant. At this point, doing some simple lzo compression may actually improve performance, as you're still going to be faster than the disk is, and reading less raw data from the disk takes less time.
I've been thinking about such compression lately, since TuxOnIce [tuxonice.net] (Linux's alternative hibernation system) uses LZF for faster saving and restoring of memory contents. LZO is even faster than that, probably unnoticeable in normal use.
However, having used such compression schemes back in my DOS days (SuperStor et al), I recall one inherent problem. The compression ratios aren't easily predicted, so the effective free space is unknown, and depends on the kind of data. This is exaggerated now that a lot
Re: (Score:2)
Re: (Score:2)
I haven't done any benchmarks of the speed of the drive itself, though I suspect it adds some latency. But the actual CPU usage is insignificant, compared to just about anything else you might do on the machine.
Why bother with actual data, it always just gets in the way of what you want to say.
Re: (Score:2)
Really not significantly.
I haven't done any benchmarks of the speed of the drive itself, though I suspect it adds some latency. But the actual CPU usage is insignificant, compared to just about anything else you might do on the machine.
Neither have I, but playing HD media from encrypted disks I know you're wrong. The overhead of decrypting a 40Mbit stream plus thst you can't use DMA directly to get data means it is significantly slower. However, for anything less intensive I doubt you'll notice much difference, and things only get faster. H.264 hardware acceleration on Linux would probably solve that one anyway...
Re: (Score:3, Interesting)
Re:Is this really necessary? (Score:4, Interesting)
...and significantly increase the odds of the crypto chip becoming a throughput bottleneck all while providing limited expandability.
The reason to do encryption in software is that the encryption can be replaced as existing crypto techniques become thoroughly broken. If you have a chip that does it in hardware, you're permanently limited to a given crypto scheme and probably limited in how long the key can be. Thus, if we conclude in a year that 256 bits really isn't enough, you get to either buy a new drive that does AES512 or switch to software crypto. At that point, you've paid the added expense of the outboard crypto chip, but have gotten little from it.
If you want to design something like this, start by creating a standard for communicating with crypto processors and creating a standard programming language for configuring these dedicated processors to handle various types of crypto. Put the control over the encryption in the hands of the OS where it should be, rather than in the hands of hardware manufacturers many of whom have repeatedly cut corners in their crypto implementations in the past. Do I trust crypto hardware? Not as far as I can throw it. How do you generate a good random number in such limited hardware, for one? How do we know they didn't incorporate a back door master key---two copies of the key that is actually used for encrypting the data, one encrypted with your AES key, one encrypted using a public key for the NSA or the Chinese government or even an organized crime syndicate---if we can't see the source code? How do we know that the AES key is even used to encrypt the data on disk at all and isn't just used as an authentication mechanism like those crappy "secure flash" devices? I mean, this entire concept just has disaster written all over it....
Hardware crypto just doesn't make sense. I trust hardware to do one thing: execute programs. Anything that requires a greater degree of trust should be done in software so that it can be readily audited and subject to verification if desired.
Re: (Score:3, Insightful)
The danger to having encrypted data and unencrypted other partitions is that generally the "other partition" is your OS and such. (If your unencrypted partition is just storage for video editing, no problem.) You tend to leak information all over the place in this space.
Re: (Score:2)
I use an encrypted Disk Image(OS X) I have one app which i use regularly with that Disk Image. OS X let's you move all settings, preferences, and files to another location easily. So In order to even load the app, OSX tries to mount the Disk Image, which then asks for a password. The Disk Mounts and the app continues to load normally. Then using the app i can decrypt the files in question.
I order for anyone else to access that, they not only need the app which is
Re: (Score:3, Insightful)
Presumably, though, people who are considering whole-disk encryption are ones interested in running software that hasn't been well-designed and still having that data encrypted.
Personally, I'd probably trust a virtual machine running off of an encrypted image more than hardware disk encryption, and it allows you to run applications that
Re: (Score:2, Insightful)
What does that get you? Good device-level encryption already has the performance level of an unencrypted drive.
The main thing - security. Software is open to everybody for extensive audit. Hardware on another hand, while potentially faster, not easily accessible and as such presumed insecure by default (one of the axioms of cryptography).
So if you need real security - you do in-software full disk encryption, if you need performance and deniability - go hardware.
Re: (Score:2)
Software full-disk encryption is good, but true full-disk encryption that is secure is hard to come by. It also carries a performance penalty. In performance-critical applications, people are going to either choose hardware encryption or none. (Another axiom of security -- people will make the choices necessary to do their job efficiently. If security gets in the way, they will circumvent
Re:Is this really necessary? (Score:5, Insightful)
But in the enterprise, the ease of management of a built-in hardware-based encryption scheme can't be beat. And let's not forget that Window's dominates the enterprise market. Besides a few folk in the engineering department, nobody runs linux on their laptops. It's all Windows.
Having a laptop stolen is a huge concern today. This will help ease that concern.
Re: (Score:2)
Many companies are already implementing solutions for that. The company that markets PGP has a drive encryption solution for laptops that even requires entering a passphrase at boot time in order to decrypt and initialize the system.
This might have the advantage of being faster though, which would certainly be attractive. Still, I use a PGP-encrypted laptop and I've never really noticed any performance degradation.
Re: (Score:3, Interesting)
For the crypto in software case, a motivated bad guy can sniff memory to determine the key and method of encryption. To sniff the crypto in hardware takes a bit more effort, but I'm guessing your friendly neighborhood NSA can do it -- if they don't already have a back door.
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
My mouth is wattering (Score:5, Funny)
No thanks (Score:3, Funny)
Way more than enough.
Re: (Score:2)
Re:No thanks (Score:5, Interesting)
Re:No thanks (Score:4, Insightful)
It's frightening. According to the AT article, numerous computer experts offered their opinions that boiled down to "It's not his fault. The browser put them there and he didn't know they were there or how to remove them."
I would be very afraid of a court that would throw out (supposedly) expert opinions just to gain a conviction with regard to a truly evil (imho) crime.
Re: (Score:2)
Imagine... (Score:2)
Weakness? (Score:5, Interesting)
Re: (Score:2)
If you're cyphering after the xor stripes are created, well, it could create a weakness, but if the encryption is strong it shouldn't.
Key Storage? (Score:2, Insightful)
Aside from the data bits on the physical platter being encrypted, how is this secure?
Re: (Score:2)
Re:Key Storage? (Score:4, Funny)
Re:Key Storage? (Score:5, Informative)
Storing the key on the drive with no authentication would be retarded, the only thing it would protect you from are those data recovery places that people who don't have proper backups use.
Re: (Score:2)
Actually, there are authentication measures. (Score:2)
They claim that the drive generates its crypto key from a password supplied externally. However, they don't explain how it gets this password. I presume from the BIOS, but there's no solid info.
It could be from the OS if the drive isn't intended to be a boot drive, but that would be very strange and limit its usefulness.
Re: (Score:2)
Hello proudfoot
I will try to answer this to the best of my knowledge on the Bulk Data Encryption drives.
The drive uses the password as a key to open the drive to the user of the password. The drive is always encrypted, the password simply is the final key to allow access to the drive. If the password is changed then that key will follow the new password. If there is no password the drives believes the password is still there, but it is enter automatically.
The encryption key is set when the drive has a password set for the first time. The key can be changed by a HDDErase (version 3.2) (http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml) This will change the encryption key when the program is run. There is no physical way to access the encryption key and view it to find out what the sequence is. I am unable to provide you with the algorithm of the encryption. The encryption is set to 128-bit encryption.
We have sent our hard drives with bulk data encryption to Data recovery companies with a password we set on it and did not provide it to them. They all tried an none of them were able to retrieve the information off the drive.
You can visit: http://www.hitachigst.com/hdd/support/bulk_faqs.htm [hitachigst.com] if you have anymore questions.
Regards,
Kyle B.
Re: (Score:2)
Don't leave it in standby mode...
Re: (Score:2)
One concern I'd have in either scenario is what happens when you need to change the password?
Private key (Score:3, Funny)
Re: (Score:2)
Data Recovery? (Score:4, Informative)
I realize that being able to pull data when hooked up as a slave defeats the purpose of encryption, but I would hope that there is some way (maybe with a key created prior to the failure?) to recover.
Re:Data Recovery? (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
If you're generating a 256-bit AES key from less than 32 bytes of user input, then you're not really getting the full benefit of 256 bits.
Re:Data Recovery? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
More robust security unitl... (Score:4, Interesting)
I'm going to stick with kernel-mode volume encryption.
Re:More robust security unitl... (Score:5, Funny)
Re: (Score:2)
One or the other? (Score:2)
Re: (Score:2)
We have to know: how long does it take to load
Re: (Score:2)
Nope, losing customer data is business as usual and just a risk of doing said business.
Maybe we're being too hasty... (Score:2, Interesting)
Kind of like accessing a TrueCrypt volume on a networked machine, if you catch my drift.
Then again, none of these devices seem to have been thought out properly... I'll stick to TrueCrypt volumes and cheap external drives (which, by the way,
Encryption's End Game? (Score:4, Interesting)
10 Years from now will we all be content with the promise delivered with quantum cryptography, traveling the globe with all of our data instantly available with 'unbeatable' security?
Or will it continuously escalate to the point that we start seeing more and more networks running 'off' the grid? Transporting data in person as on-the-fly decryption becomes increasingly prevalent. (Here we come Johnny Mnemonic)
Re: (Score:2)
So where is that key anyway? (Score:5, Interesting)
"The conventional response to this problem has been the use of BIOS passwords(4) and software-based encryption. Seeking a more robust form of data security, Fujitsu has now developed 2.5" hard disk drives with hardware-based AES encryption using industry-leading 256-bit key.
The built-in AES automatically encrypts all data when storing it on the hard disk drive and decrypts the data when read. Unlike software-based encryption, the key does not reside in the computer's memory. This makes it more resistant to attack and imposes no processing overhead on the CPU, optimizing system performance. "
Let the guesswork begin?
Re: (Score:2)
Re: (Score:2)
I'd hope that the drive stores the password data in auto-erasing SRAM to thwart anything like cold-reboot attacks [slashdot.org] at the drive level.
How could this be faster? (Score:4, Insightful)
In a modern day computer the bottleneck is the long term storage (HDD, DVD Rom etc). Memory and CPUs are extremely fast by comparison.
So I don't entirely understand how shifting encryption down the IO bus is really helpful.
Plus by doing so you lose tons of functionality and if the implementation gets "broken" (AES gets cracked) then you are kind of stuck unless Fujitsu are going to release an update back-ported to all of their old drives (and a lot of hardware vendors can't even support stuff from a year ago, let alone several).
Plus aren't laptops designed entirely around keeping the hard drive in almost a zero power state as long as it can?
Re: (Score:2)
Re: (Score:2)
Performing encryption in hardware encrypts multiple bytes per cycle and takes none of the CPU's time since it is done on the disk's chips.
Re: (Score:2)
It'd be much harder for the drive electronics to decrypt the data fast enough if the interface was faster.
When you're decrypting and encrypting on the CPU, not only are you using CPU cycles that could be doing other things, but you're also still waiting on the IO bus to move the data once it's encrypted. You're on the wrong side of the link.
Re: (Score:2)
Even more importantly - provided you set up key init phase properly, keys are handled around in the hdd (where there is a chance of some specific protection) vs close to cpu/main memory where it is far easier to pull them in the plain.
Someone obviously find those valuable, quite surely there is also more to tha
Hardware based? (Score:3, Interesting)
It's simply security through obscurity.
Re: (Score:2)
Re: (Score:2)
It's simply security through obscurity.
The security gained from doing the crypto on the disk is only gained through obscurity. The security baseline in the crypto is security through crypto, not through obscurity.
Hardware based doesn't seem to mean much anymore. [...] [You're] just moving the work from one generic processor to another.
There are reasons to do this besides security. A big one is speed: crypto eats a substantial amount of resources (in particular for breakfast). By moving this to dedicated hardware, you free up your CPU to render the movie, compile the code, or whatever.
Also, since the motivation is likely speed (they mention that explicitly in the
Re: (Score:2)
Re: (Score:2)
Scenario where this is useful? (Score:2)
If that is right, well, dont see where this is useful. If the hard disk is stolen, could be used directly, a
Re: (Score:2)
It all depends on WHO has the keys...
Re: (Score:2)
Overall, it's really a pretty secure des
Prediction: Availability will suck (Score:5, Interesting)
Seagate has been most active in this space and the most disappointing. Seagate announced their encrypted drives a couple of years ago. Complete vaporware and required a custom BIOS, to boot. Seagate re-announced their encrypted drives about 7-8 months ago. A few of the Momentus FDE drives showed up in retail channels only to go out-of-stock/back-ordered in a matter of weeks. A month or so ago, Seagate showed their encrypted portable drives. Anybody seen one for sale? Seagate announced their encrypted SAS-connected and FC-connected server drives a couple of days ago. Availbility? Only to OEMs. I don't think even OEMs have access to the 1TB desktop disks that Seagate announced months ago and that's the model that home users and hobbyists would scarf up by the truckload if it were only available.
n-Crypt [n-crypt.co.uk] has never answered my emails.
Digisafe [digisafe.com] has a nice web site but I can't find any place to actually buy the drives.
Lots of other manufacturers, including some of the big ones, have made announcements but nothing has shown up in the retail channels. Even if you're willing to buy a new laptop to get the encrypted drives that are apparently going preferentially to OEMs, actually finding encrypted machines for sale on the web sites of the major players will have you clicking fruitlessly until your fingers cramp. Even the much simpler "bump in the wire" encryptors (e.g. from Digisafe [digisafe.com]) that are supposed to work with any IDE drive are simply non-existent in the marketplace. The whole range of products from Enova [enovatech.com] is tantalizing until you realize that you can't actually lay hands on any of it.
For years, I've used Flagstone [stonewood.co.uk]. They're expensive and insufficiently large. But at least I can pick up the phone and order one of them and, lo and behold, actually receive it in the mail. Given the way the dollar is tanking and the size of the available drives, I'd love to have another choice. Realistically, I don't.
Call me back when I can drop an encrypted drive into my shopping cart at NewEgg. Until then, this is so much supremely frustrating vapor.
Re: (Score:2)
Just go with software? (Score:2)
As an evil genius this intrigues me. (Score:4, Insightful)
Re: (Score:2)
just set yourself up a program that tries all the possible passwords.
then throw yourself into a cryostasis tube, wait 1 billion years, and hope that the hard drive is still working when the program's finished!
Crypto requires good integration (Score:2)
encryption into their products. However, after reading this article,
there are at least three concerns I am left with regarding Fujitsu's
offering, along with every other offering of this sort.
Firstly, AES-256 smacks of a marketing gimmick. AES-128 is perfectly
sufficient for anything that anyone wishes to protect; nobody has ever
discovered a weakness in AES-128 that would be cause for
concern. Using AES-256 bloats the key size while providing a
Re: (Score:2)
My gut feeling is that the drive data are encrypted until the host computer sends the drive key to drive. All data on the drive are encrypted using drive key. The host computer might send the drive key either from BIOS or from an operating system that was booted from a non-encrypted drive. Hopefully, it does so in a method that isn't unattended.
Attack vectors might include allowing the host BIOS to send the password, then boot using a thumbdrive; using a connector extension cable, power-up the drive and
Re: (Score:2)
However, I must take exception to your first point, if only from a technical standpoint.
Doubling the key size dramatically increases the security in the one way that can be a standard for such things: the time it would take to perform a brute-force attack.
2^128 is approximately 3E38. 2^256 is approximately 1.15E77.
Since there have been no published successful attacks against AES in its full form (no reduced-round versions) wit
Re: (Score:2)
CBC with a predictable IV... (Score:2)
Re: (Score:3, Informative)
Two possibilities: We've seen dramatic weaknesses in md5 and sha1, and it's not impossible that something similar could be found for AES. A reduction from 128 bit security to ~96 or even ~64 bits of security would be a relative disaster; 64-bit ciphers are simply not secure anymore.
Additionally, quant
Re: (Score:3, Informative)
Useless (Score:2)
Re: (Score:2)
Saving a few cycles can be significant. Even more significant may be the power savings. Since encryption on hard drives is probably most useful on portable devices (things which run on batteries), if you can save power by using a dedicated chip (which should consume less power than the equivalent CPU cycles required to decrypt), then there's another advantage.
Assuming the
Users and Passwords (Score:3, Insightful)
I'm guessing that most of the drives will be vulnerable to a dictionary attack. Every user will have to know the password, (and be able to enter it correctly), to boot up their machine, and if you forget the password, your hard drive becomes a brick. Enough people will be paranoid about forgetting their password that they will pick something short, simple, easy to remember and easy to type. In other words, they will likely choose a dictionary word of some sort.
If an organization has their IT staff assign passwords to the drive, so they are hard to crack, users will just keep the Post-it note with the password glued to their machine. Either way, a great idea that someone will screw up.
Users - making products insecure since the dawn of time.
Probably slower (Score:2)
Re: (Score:2)
Good for a swap drive, I guess (Score:2)
If you take them literally:
Ah, so they generate a new key on power-on, and any data written last time, is essentially lost. This drive isn't worth anything for most conventional uses, but would make a great swap, /tmp, squid cache, etc. My laptop's swap works sort of like that (random key each boot), except in software.
Of course,
Against Both ??? (Score:2)
I can understand how this protects you against data theft - as long as you don't keep the password scribbled on a PostIt stuck to your notebook.
But how are you protected against loss? If you data is gone due to a head-crash or theft, it's gone. You've lost it, that that's often a huge problem.
Fujitsu a No Go! (Score:2)
I'd rather put my money in Seagate or Western Digital.
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
Note that I have not read the specs, that just seems to be the most logical way to design something like this.
Re: (Score:3, Funny)
Hopefully there's some way to keep the thing from figuring the key once it's stolen, as most people will try to, you know, use the PC as a whole before they resort to stripping the drives out of it.
Re: (Score:2)
Re: (Score:3, Informative)
What it sounds like is that if you keep the computer from booting, like a pre-boot password, the drive is utterly useless to a thief. If they can get it to boot instead of staring blankly at the password prompt, the thing will recalculate the key and go merrily on its way.
Hopefully it figures the key on stored
Re: (Score:2)
What it sounds like is that the CNET author didn't know what he was talking about.
Fujitsu says it uses an ATA password [fujitsu.com] so it's most likely using the password to generate the key.
Re: (Score:2)
Each drive has a 128-bit key, and with a special command, can change the key to something random. This command is invoked when the Secure Erase function is requested.
The drive key is used as a salt to the ATA-password generated key. Normally, the ATA password just locks the drive, preventing it from being accessed. I