My system:

  • Intel Core i7-4790, which supports AES-NI
  • ASUS Z97-PRO mobo
  • Samsung 250GB EVO SSD (with built-in encryption option)
  • 64-bit Windows 7

If I just want to encrypt my boot drive with AES256 or similar, what would be the difference / faster performance / more secure? Flip Windows Bitlocker on and not use the SSD encryption, or enable the built-in drive encryption that the SSD offers, and don't worry about Bitlocker?

I'm thinking it might be better to offload the encryption to the SSD by using the Evo's encryption option, so that the processor doesn't have to do any encryption, this might be better for I/O performance and give the CPU a breather? Or since this CPU has AES-NI it might not matter?

I'm new to Bitlocker and this SSD encryption option, so any help is much appreciated.

  • 1
    you may want to read this detailed answer – phuclv Sep 16 at 4:06
  • Maybe you should try making a benchmarking of each option and posting it here for future reference, given that there's not enough information on the internet to answer this question, AFAIK. – Edel Gerardo Sep 25 at 5:49

Old question, but since then several new developments have been found concerning Bitlocker and drive encryption (used either alone or in combination), so I will turn couple of my comments on the page to an answer. Maybe it is of use to someone doing a search in 2018 and later.

Bitlocker (alone):
There have neen several ways to breach Bitlocker in it's history, luckily most of them have already been patched / mitigated in 2018. What remains (known) include, for example, the "Cold Boot Attack" - the newest version of which really isn't Bitlocker specific (you need physical access to a running computer and steal the encryption keys, and anything else, straight from the memory).

SSD drive hardware encryption and Bitlocker:
A new vulnerability has surfaced in 2018; if a SSD disk has hardware encryption, which most SSDs have, Bitlocker defaults to using only that. Which means that if that encryption itself has been cracked, the user essentially has no protection at all.
Drives that are known to be suffering from this vulnerability include (but are probably not limited to):
Crucial MX100, MX200, MX300 series Samgung 840 EVO, 850 EVO, T3, T5

More information about the SSD encryption problem here:
https://twitter.com/matthew_d_green/status/1059435094421712896

And the actual paper (as PDF) delving deeper into the problem here:
t.co/UGTsvnFv9Y?amp=1

So the answer really is; since Bitlocker uses the disks hardware encryption, and has it's own vulnerabilities on top of that , you're better off using the hardware encryption if your SSD is not on the list of cracked SSDs.

If your disk is on the list, you're better off using something else entirely since Bitlocker would use the drive encryption anyway. What is the question; on Linux I would recommend LUKS, for example.

I'v been doing some research on this and have a half complete answer for you.

  1. It is always better to use hardware based encryption on a self encrypting drive, if you use the software based encryption on bitlocker or another encryption program it will cause anywhere between a 25% and 45% slowdown in read write speeds. you could see a minimum of a 10% drop in performance. (note you must have an SSD with a TMP chip)

  2. Bitlocker is compatible with hardware based encryption, you can use samsung magic. v 4.9.6 (v5 no longer supports this) to wipe the drive and enable the hardware based encryption.

http://www.ckode.dk/desktop-machines/how-to-enable-windows-edrive-encryption-for-ssds/

  1. you can enable hardware based encryption via the BIOS by setting the master password. You will need to follow some of the steps in the article above, like turning off CMS.

  2. To answer your question I don't really know which is faster. I have reached out to Samsung but given the limited info on this. Unless I get a developer I doubt I will get a good answer to which is the better option. For now I plan to enable the hardware based encryption in my bios.

  • Are you saying "it's better" purely for performance reasons? Do both encryption methods generally provide identical security? I have heard of "self-encrypting" disks having shockingly bad encryption – fast, yes, but not actually secure. – grawity Jun 20 '17 at 16:46
  • Bitlocker has been breached and this has been demostrated by security experts. Essentially, if you can fake AD, etc needed to login to the computer, you can also bypass Bitlocker in the process. – DocWeird Aug 21 '17 at 6:54
  • Beg pardon, @DocWeird , but claiming that Bitlocker has been breached is claiming that AES-256 has been breached - and it hasn't been. What exactly do you mean? Re login, that is irrelevant to Bitlocker! You can boot from a Bitlocker'd drive without logging in at all! It is not the intent of Bitlocker to keep other authorized users on your machine from reading your files, but rather to prevent access to the hard drive's contents if someone steals the drive and connects it to another machine (which would let them bypass all SID-based access control). Are you sure you're not thinking of EFS? – Jamie Hanrahan Oct 29 at 2:17
  • There have neen several ways to breach Bitlocker, most of them already patched / mitigated (also including the Cold Boot Attack's newest version which really isn't Bitlocker specific), one was to simply bypass Windows authentication on the (stolen) computer (it involved faking a domain controller, local password cache and changing a password - which all lead to TPM yielding the unencryption key). More here: itworld.com/article/3005181/… – DocWeird Oct 29 at 8:01
  • And since we're on Bitlocker vulnerabilities, a new one has just surfaced; if a SSD disk has hardware encryption, Bitlocker defaults to using only that. Which means that if that encryption has been cracked, the user essentially has no protection at all. More here: mobile.twitter.com/matthew_d_green/status/1059435094421712896 and the actual paper (as PDF) here: t.co/UGTsvnFv9Y?amp=1 – DocWeird Nov 6 at 7:03

I am not familiar with your drive and the encryption options it offers, however hardware encryption can be used with multiple operating systems (e.g. when you want to dual-boot Windows and Linux), while software encryption might be harder to configure. Also, the safety of both methods depends on how and where you store your encryption keys.

I'm thinking it might be better to offload the encryption to the SSD by using the Evo's encryption option, so that the processor doesn't have to do any encryption, this might be better for i/o performance and give the CPU a breather?

You are right, hardware-based encryption does not lower the computer's processing speed.

I have never used encryption on any of my devices, so I'm sorry that I can't help you with the actual process of enabling it. Please do note that in most cases enabling encryption causes the drive to get erased (BitLocker does NOT erase data, however it has an extremely remote chance of corruption, as it is with all live-encryption software). If you want to have multi-OS compatible encrypted drive which stays unlocked until the computer is shut down, go with the hardware encryption feature your hard drive offers. But, if you want something a little more secure but limited to Windows, try out BitLocker. Hope I helped!

  • At first you state "I know for a fact that hardware encryption is more secure", but at the end you say he complete opposite ("if you want compatible, go with hardware encryption, but if you want something more secure, try BitLocker"). Which one did you mean? Did you account for things like described in this article? – grawity Jun 20 '17 at 16:52
  • 1
    hardware-based encryption is generally more secure is incorrect. It might be faster, but security depends on the encryption standard, not hardware or software, because regardless of how you encrypt the file, the output will be the same with the same key – phuclv Sep 9 at 8:59

Let's do some Wikipédia.

BitLocker

BitLocker is a full disk encryption feature. It is designed to protect data by providing encryption for entire volumes.

BitLocker is a logical volume encryption system. A volume may or may not be an entire hard disk drive, or it can span one or more physical drives. Also, when enabled, TPM and BitLocker can ensure the integrity of the trusted boot path (e.g. BIOS, boot sector, etc.), in order to prevent most offline physical attacks, boot sector malware, etc.

According to Microsoft, BitLocker does not contain an intentionally built-in backdoor; without a backdoor there is no way for law enforcement to have a guaranteed passage to the data on the user's drives that is provided by Microsoft.

Self-Encrypting Drive

Hardware-based encryption when built into the drive or within the drive enclosure is notably transparent to the user. The drive except for bootup authentication operates just like any drive with no degradation in performance. There is no complication or performance overhead, unlike disk encryption software, since all the encryption is invisible to the operating system and the host computers processor.

The two main use cases are Data at Rest protection, and Cryptographic Disk Erasure.

In Data at Rest protection a laptop is simply powered off. The disk now self-protects all the data on it. The data is safe because all of it, even the OS, is now encrypted, with a secure mode of AES, and locked from reading and writing. The drive requires an authentication code which can be as strong as 32 bytes (2^256) to unlock.

Typical self-encrypting drives, once unlocked, will remain unlocked as long as power is provided. Researchers at Universität Erlangen-Nürnberg have demonstrated a number of attacks based on moving the drive to another computer without cutting power. Additionally, it may be possible to reboot the computer into an attacker-controlled operating system without cutting power to the drive.

Verdict

I think that the most important lines are these :

There is no complication or performance overhead, unlike disk encryption software, since all the encryption is invisible to the operating system and the host computers processor.

Typical self-encrypting drives, once unlocked, will remain unlocked as long as power is provided.

Because BitLocker is a disk encryption software, it is slower than the hardware-based full disk encryption. However, the Self-Encrypting Drive stays unlocked as long as it had power since the last time it was unlocked. Shutting down the computer will secure the drive.

So, either you have the more secure BitLocker or the more performant Self-Encrypting Drive.

  • 1
    I believe that the question is not referring to EFS. – Scott Dec 6 '16 at 22:25
  • @Scott I believe you're right, but I tried my best to help. At least now we have more info about BitLocker, this might help a future answer if someone knows what exactly is the SSD Encryption. – NatoBoram Dec 6 '16 at 22:28
  • 1
    @NatoBoram - 'At least now we have more info about BitLocker" - More information on a well documented feature does not answer the author's question. Please edit your answer so it directly addresses the author's question. – Ramhound Dec 6 '16 at 22:38
  • Bitlocker also provides Hardware Encryption – NetwOrchestration Dec 7 '16 at 7:53
  • 2
    Just because the hardware encryption operation on the drive is invisible to the operating system does not mean it isn't slowing down the drive's operation by enough that using CPU based encryption would be faster overall. – simpleuser Jun 8 '17 at 3:29

Samsung EVO SSD's built in encryption would be my choice as it is natively optimized and one of the best SSD's out there for security in corporate environments. Also if you ever lose the key, Samsung can unlock it for a fee via the serial # on the SSD.

  • 2
    The fact that Samsung can unlock the SSD via the serial # is a red flag imho. Either Samsung uses a algorithm to make the key based on the serial # or has a database with the keys. – RS Finance Sep 17 at 8:13
  • Agree with @RSFinance. If another party can get your secure data without your permission, it is not secure. – UtahJarhead Oct 9 at 3:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.