Contents
Which is the encryption key for Opal 2?
An Opal 2 drive’s contents are always encrypted via a factory-set media encryption key (MEK, also known as DEK). Initially, the media encryption key is unprotected (otherwise you could not access the drive). A password must be set to protect the drive.
How does an opal 2 SSD protect itself?
An Opal 2 drive’s contents are always encrypted via a factory-set media encryption key (MEK, also known as DEK). Initially, the media encryption key is unprotected (otherwise you could not access the drive). A password must be set to protect the drive. (The password actually encrypts the MEK.)
What are the characteristics of an opal drive?
Opal drives are widely deployed media that are a class of self-encrypting drives (SEDs). Based on a specification from the Trusted Computing Group (TCG), such drives have extended characteristics beyond merely being self-encrypting.
Can a Opal 2 drive work with ATA passwords?
Opal 2 drives do not work with ATA passwords. They use their own pre-boot system (PBA) for unlocking (see below). Vulnerabilities were found in some early SSD models (e.g. Crucial MX100/MX200/MX300, Samsung EVO 840/850, Samsung T3/T5), so these models should not be used with Opal 2 hardware encryption.
How do I unlock an opal 2 SSD?
A password must be assigned. Encryption ranges must be specified. Special boot code, a PBA (a pre-boot authentication system), must be provided to unlock the drive. On Linux distributions, a low-level utility ( sedutil-cli) is available to provision and administrate Opal 2 drives. However, it is rather difficult to use directly.
Is there way to administrate Opal 2 drive?
On Linux distributions, a low-level utility ( sedutil-cli) is available to provision and administrate Opal 2 drives. However, it is rather difficult to use directly. The PBA’s provided along with sedutil-cli do not support international keyboard layouts or Secure Boot.
How to perform crypto erase on a primary boot drive?
To erase a primary boot drive or to perform a Crypto Erase on non-Windows systems, a Crypto Erase bootable USB drive must be created. The USB drive will contain a bootable Linux kernel with the Crypto Erase utility installed on it. The system can be booted to this USB drive to perform Crypto Erase on the target SSD(s).