Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Is it possible to use hardware-based full disk encryption (perhaps on a Samsung 840 Pro SSD) on a Mac, specifically a Macbook Pro 8,2? If so, how?

My understanding is that this will be handled in the BIOS or possibly EFI, however I think Apple's EFI is generally quite locked down.

I'm not looking for any software-based solutions such as FileVault 2 or TrueCrypt. I dual boot and matters will be simpler if it is handled in hardware.

share|improve this question
2  
While I understand that a hardware-based encryption is preferable if possible, I want to question your motivation: The disk encryption of the various hardware vendors seems poorly documented. Little information is provided but necessary to aim for confidentiality of the implementation. FileVault 2 on the other hand is currently undergoing a FIPS 140-2 certification [1] - a NIST standard for cryptographic modules. –  gentmatt Jan 21 '13 at 14:36
1  
In my personal experience, software-based full disk encryption in a dual boot setup with Windows 7 is no problem if I only encrypt the OS X startup volume with FileVault 2 (this is my current setup). If you also want to encrypt your Windows or Linux volume, things get messy - so I've heard but not tested for myself. –  gentmatt Jan 21 '13 at 14:40
    
Well, I'm actually using Ubuntu primarily with OSX on the side. Also I have a shared partition, though perhaps that could be handled with TrueCrypt. It just seems like less trouble and will require fewer pieces of software if I can just have a single password on boot. –  Eric Marsh Jan 21 '13 at 15:13
    
Have you used Filevault 2 along with Ubuntu's full disk encryption? Did that work well? I'm just curious because I want to ditch my Windows partition for Ubuntu 12.04. –  gentmatt Jan 21 '13 at 15:42
    
No, sorry I haven't tried it. I don't think it would be a problem so long as you don't want to read one partition while booted to the other. I would expect maybe you could get around that by using TrueCrypt for both. I've used TrueCrypt a little, not an expert though –  Eric Marsh Jan 21 '13 at 17:54

4 Answers 4

Expanding on sschuberth's answer, as of December 2013, the Samsung 840 EVO (but not PRO) also has firmware that directly supports TCG OPAL. It's a good bet that an 840 Pro firmware update to do the same thing will come soon.

You need some software to manage the SED drive, otherwise you get little or no benefit from the built-in security.

WinMagic SecureDoc will manage the drive, but not for every OS X release out there (anecdotal evidence suggests 10.8.1: ok, 10.8.2: not ok).

You'll need to run WinMagic enterprise software, too, I believe. While they have a standalone edition of SecureDoc to support SEDs, it appears that it is only available for Windows.

NOTE: SecureDoc does not require a TPM for SEDs, nor does the 840 EVO running in TCG Opal mode. SecureDoc can support the use of a TPM if you have one and enable the feature (Windows only).

share|improve this answer

Yes, Viasat's Eclypt product range works with Mac (EFI) and provides full disk, FIPS approved, hardware encryption.

See: Eclypt Core Self-Encrypting Internal Hard Drive

The datasheets for the Eclypt product range are not yet up to date (but Mac OS X 10.5+ is supported as is Apple UEFI). You can see the specific product at http://www.amazon.co.uk/Eclypt-Core-200-Internal-Encrypted/dp/B00GJV2OE4. Also you can look at this blog http://robert-palmer.net/category/eclypt-protects/ for proof. Or alternative contact Viasat UK directly.

share|improve this answer
    
Hmm, its data sheet does not mention anything about EFI or Mac, just Windows. –  sschuberth Oct 25 '13 at 8:50

I've asked myself exactly the same thing as I've also bough a Samsung 840 Pro for my MacBook Pro. After some research I've found this post indicating that the 840 Pro's hardware encryption requires TPM support, and that's only found in PC BIOSes, not in Mac's (U)EFI. To be sure, I've asked Samsung support which of the standards "ATA-Security", "Seagate DriveTrust" and "TCG OPAL" are supported by the 840 Pro, and their answer was:

Dear Customer,

Thank you for contacting Samsung SSD support regarding your inquiry. In response to your inquiry, the only one of the 3 that the unit supports is the ATA Security feaure. As for the encryption, the 840 Pro Series SSD only supports AES 256 bit hardware level encryption but requires the BIOS to be TPM enabled.

So there's no way to enable the 840 Pro's hardware encryption in a Mac.

However, there's also the Crucial M500 which supports TCG's Opal. In conjunction with a special Opal management software like WinMagic's SecureDoc for Mac it sounds as if it's possible to get hardware encryption to work on a Mac.

BTW, note that according to Sophos' support their SafeGuard does support Opal only on Windows, not on Mac OS. Also, McAfee's General Q&A for Opal states

Q: Will Opal drives be supported on Mac OS X?

A: No. Apple currently does not ship their devices with Opal drives so Opal is not supported on Endpoint Encryption for Mac.

But of course that's says nothing about that happens if you just put an Opal drive into a Mac yourself.

share|improve this answer
    
TPM is not required. On my Windows 8.1 installation I was able to activate self-encryption of this drive without using TPM — you need just to change BitLocker settings in gpedit.msc. So theoretically this is possible on OS X, too, if the OS supports it. –  Sarge Borsch May 27 at 8:38
    
Would you mind sharing which settings exactly you were changing in gpedit.msc? –  sschuberth May 27 at 8:41
    
    
That article very much looks like BitLocker would be using software encryption in that case, i.e. en-/decryption is done by the CPU instead of the hard drive itself. Especially as they recommend TrueCrypt as an alternative. –  sschuberth May 27 at 8:45
    
i didn't say the other parts are correct. btw, the most complete guide is here: superuser.com/a/700251/161593 –  Sarge Borsch May 27 at 8:47

This is a good question and - yes - finding an answer to it is almost impossible. Samsung sends to Apple support. I would expect to hear from Apple that it's not possible.

Full disk encryption HW vs FileVault - difference in performance is noticeable. If you are not business user on strict encryption requirements, then we need to look for HW based Samsung solution. But how to enable it on Mac - pain to find out.

share|improve this answer
1  
With recent CPUs, FileVault2 uses hardware AES, and has a negligible impact on performance according to some reports: osxdaily.com/2011/08/10/… –  Alan Shutko Feb 26 '13 at 21:54
    
We're not really average users. I prefer to use HW FDE because it's the elegant and "correct" solution, particularly when dual booting with a shared partition. –  Eric Marsh Mar 5 '13 at 13:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.