How SSDs Use Hardware-Based Encryption

SSDs store data in NAND flash memory.  Too increase Flash Memory reliability, SSDs utilize wear leveling which spreads the memory usage accross the whole address space. This design makes it difficult to completely and efficiently erase  stored data using software alone. To address this problem, most modern SSDs integrate built-in hardware encryption.

Benefits of Hardware Encryption

• No performance slowdown since a dedicated Encryption Engine inside the Flash Controller handles encryption instead of the main CPU.
• All data is encrypted automatically and on-the-fly, including temporary and hidden files.
• Encryption keys stay inside the drive, making the system resistant to OS-level malware.
• Completely independent on System OS, works on any operating system.

How Hardware AES Operates

Encrypted SSDs use two main keys:

1. Encryption Key (EK)

• Randomly assigned 128-bit or 256-bit AES key.
• Encrypts all data written to the NAND.
• Stored only inside the drive in encrypted form, no user access to this key

2. Authorization Key (AK)

• Set by the user.
• Locks and unlocks the drive.
• On OPAL 2.0 SSDs, the AK encrypts the EK and secures the drive.

Authentication Process

1. The system boots and loads a secure pre-boot environment.
2. The user enters a password or biometric credential.
3. A Key Deriving Function transforms these credentials into the Authorization Key.
4. If the AK matches, the drive unlocks.
5. The EK is decrypted and loaded into the SSD’s crypto engine.
6. The operating system begins loading normally.

Managing Encrypted SSDs

ATA Security

• Managed through the BIOS.
• Setting an ATA password creates the Authorization Key.
• Allows cryptographic erase through key updates.

TCG OPAL 2.0

• The industry standard for advanced drive security.
• Supports a 128 MB pre-boot environment for biometrics, TPM, or network authentication.
• Allows separate protected regions on the same drive, each with its own key.
• Supports centralized management and remote sanitization.