Milan Brož

— On the schedule —

Self-Encrypting Disks in Linux - Fast, Expensive, and Mostly Harmless

Opal2 self-encrypting drives (SEDs) provide hardware-based disk encryption. For several years, cryptsetup resisted implementing support for them in Linux disk encryption. Once we decided to add such support, we tried to do it properly - using appropriate interfaces, testing on real drives, and investigating the security impact. The talk will cover what we achieved, what we found, and why research, open source, and industry standards so often miss each other. We will discuss selected security aspects of SEDs based on the TCG Opal2 standard. Not all drives implement the interfaces and cryptographic primitives correctly, and reporting issues for old hardware is a futile effort. The talk is based on the cryptsetup/LUKS SED support implementation, now available in most major Linux distributions, and on our research paper available on arXiv.