Bitlocker, TCG OPAL (SED)

[dZeus]

Hey,

I still haven't ordered my Crucial M4 SSD and am currently became aware of hardware full drive encryption (FDE) which is dubbed SED (self-encrypting drive), standardized through the OPAL specifications from the Trusted Computing Group (TCG). Right now, I use Bitlocker with USB for FDE, but the 0-performance impact of OPAL for FDE appeal to me, and I've read that bitlocker might amplify writes on SSDs (although maybe that's only when using a SSD based on a Sandforce controller which I am not going to get).

Now I have a few questions regarding TCG OPAL / SED.

Apparently Bitlocker in Windows 8 supports managing OPAL drives, but it requires TPM and UEFI for it.

- Is this UEFI requirement inherent to how OPAL works, or is it based on a concious decision that UEFI+TPM is the only way to provide a secure booting environment (preventing bootkits from compromising the boot process)?
- If the limitation is not inherent to OPAL, is it possible to retrofit a SED drive on an old notebook (e.g. onto my IBM Thinkpad T43 which does not have TPM 1.2 nor UEFI), and can I enable a request for a user authentication key in the pre-boot environment?

[Jammrock]

Read this from Anandtech and thought of this thread.

http://www.anandtech.com/show/6891/hardware-accelerated-bitlocker-encryption-microsoft-windows-8-edrive-investigated-with-crucial-m500

Did a little digging and found the eDrive dev guide here:

http://msdn.microsoft.com/en-us/library/windows/hardware/br259095

I'm not a storage expert type, so all this could be completely wrong

Based on this I would say IEEE 1667 is why UEFI is needed. I doubt very much BIOS and older UEFI implementations can support it. TPM would come in because IEEE 1667 requires some sort of certificate or biometric for authentication. The only way to effectively use a certificate at boot time would be to leverage a TPM module, which is designed to securely store certificates.

Just my guess though.

You can use BitLocker on older hardware, even with a BIOS and no TPM. You have to use a USB stick on boot to provide the BitLocker key, but it does work. Though they may have deprecated that in Win8 ... or maybe that was floppy support ... I don't remember. eDrive won't work though. It will be regular old software encryption.

[dZeus]

interesting... I wonder if IEEE1667 allows the use of smartcards for storing the bitlocker key of system volumes. Right now this is not supported by Windows, as the drivers for the smartcard reader and smart card itself need to be present when bitlocker loads the volume encryption key.

I'm surprised that MS doesn't support SED (Opal) without IEE1667, as there are quite a few around of those already; it would offload all the bitlocker cryptographic operations to the HDD.

Although, on newer CPUs with AES-NI, bitlocker already should be offload quite a bit of the crypto operations.

[Jammrock]

Windows and BitLocker have supported AES-NI for a while. I know Windows 7 and 8 have support. Don't know if Vista does.

I don't know about the OPAL without IEEE 1667 comment. If I had to guess I would say they did it that way because it was decided that was the best performance to security setup for businesses. Consumers probably didn't come into to play in the decision since most don't care, and most consumer hardware lacks smart card readers and TPMs. Old hardware would not be Windows 8 certified and so those scenarios would not necessarily be supported.