Apr 2015 – for strange reasons there are NO enterprise ssd drives on the market with Opal 2.0 support that can be safely put in server. Only consumer ones.
Thanks for the msed link. I’ve been following that project on Github, but haven’t actually tried it yet. Also I’m waiting for the EFI pre-boot agent.
I never quite understood the point of full-disk encryption on servers. If you store the key in the TPM, the encryption is useless if the entire server is stolen. If the key is stored on the network, that machine could be stolen as well. If you don’t store the key at all, someone needs to manually provide it each time the server is rebooted.
So that’s probably why there are no Enterprise Opal drives: there’s no real use.
unlocked drive can be connected to another computer without power off. But in other cases it can be very useful.
There is another problem: most consumer drives can lost data in case of power-outages ( http://lkcl.net/reports/ssd_analysis.html ). So enterprise SSDs are desirable for valuable data. But in this case data will be unencrypted.
Intel enterprise drives S3500/S3700 and newer S3610/S3710 only support ATA passwords.
Consumer Intel 730 has power lost protection but no encryption.
Samsung 845DC (PRO) – no encryption.
850 PRO – no power lost protection.
How does disk encryption protect you in any other scenario? If someone breaks in via the network, the data is transparently decrypted anyway. The only scenario where disk encryption is useful is on laptops that are lost/stolen while switched off.
As far as I’m aware, the encryption does not consume any significant amount of power. Have you looked at the Crucial M series? They have power loss capacitors and some posts on the internet claim that they do their job, though I haven’t seen a through analysis like the one on the website you linked to. I have a Crucial M500 and so far haven’t lost a single bit that I’m aware of.
it seems they only help to protect already written data due to MLC flash writing specificity.
in both cases physical access to server and stealing will not give easy access to data.
In both of these scenarios, an attacker could break into your server room and just connect the (already authenticated) disk to his own laptop without powering it down. So physical access to the server does give easy access to the data.
It appears as if the open-source msed project has formed the DriveTrust Alliance, which promises something big for October 15th. We’ll see what happens. They already have a Github account, so it should continue to be free and open source.
I just want to let you know that I have it on good authority that the Sandisk X400 will NOT get OPAL via FW update. Either the drive ships with it or not.
Great article, thanks. Have you heard if the Samsung 950 Pro M.2 drives have received the promised firmware update to support Opal / IEEE-1667?
I’m waiting for the Opal support on the Samsung 950 pro too. Nothing yet.
Samsung better step up with that firmware. The 960 has already been released.
If they don’t it will be another Samsung product division that will be sworn off forever by me. I’ll never buy another one of their household appliances. Let’s not make it SDD too Samsung.