0

It was recently discovered that the hardware encryption of many SSDs is completely broken and cannot be trusted at all.

Can this affect Macs? Does MacOS trust the hardware encryption of the SSD drives, or does it always use software encryption? Is there a way to check whether SSD-based or software encryption is being used?

2

This does not affect Mac because Apple doesn't use the SSD's built in hardware encryption algorithm. Apple's FileVault uses an XTS-AES 128 cipher that's "tied" to a password and protects the boot partition of your drive (the EFI is not).

The SSDs mentioned in the article can have the master password "reset" by simply writing a single bit to the SSD's firmware.

Operating Systems like macOS and FreeBSD boot an un-encrypted partition first, then it boots the encrypted one based on a password/phrase/credential supplied by the user.

Does MacOS trust the hardware encryption of the SSD drives, or does it always use software encryption?

It doesn't trust it nor distrust it. It uses it's own encryption rather than what's included with the drive.

Is there a way to check whether SSD-based or software encryption is being used?

For macOS through Sierra (10.12.x):

diskutil info diskX | grep -i encrypted

For macOS High Sierra and (10.13.x):

diskutil apfs list | grep -B6 FileVault
1

Source:

Most modern operating systems provide software encryption that allows a user to perform whole disk encryption. While software decryption offered by Linux, macOS, Android, and iOS offer strong software encryption, BitLocker on Windows falls prey to the SSD flaw by defaulting to hardware encryption when available.

This following source indicates that macOS seems to not be affected by the vulnerability. The story states in other places that Windows defaults to hardware encryption and uses software as the fallback; unlike macOS which defaults to software first.

Source:

"BitLocker, the encryption software built into Microsoft Windows, can make this kind of switch to hardware encryption but offers the affected disks no effective protection in these cases. Software encryption built into other operating systems (such as macOS, iOS, Android, and Linux) seems to be unaffected if it does not perform this switch," the researchers say.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .