22

Is it possible to use hardware-based full disk encryption (perhaps on a Samsung 840 Pro SSD) on a Mac, specifically a Macbook Pro 8,2? If so, how?

My understanding is that this will be handled in the BIOS or possibly EFI, however I think Apple's EFI is generally quite locked down.

I'm not looking for any software-based solutions such as FileVault 2 or TrueCrypt. I dual boot and matters will be simpler if it is handled in hardware.

Improve this question
7
  • 3
    While I understand that a hardware-based encryption is preferable if possible, I want to question your motivation: The disk encryption of the various hardware vendors seems poorly documented. Little information is provided but necessary to aim for confidentiality of the implementation. FileVault 2 on the other hand is currently undergoing a FIPS 140-2 certification [1] - a NIST standard for cryptographic modules.
    – gentmatt
    Jan 21, 2013 at 14:36
  • 1
    In my personal experience, software-based full disk encryption in a dual boot setup with Windows 7 is no problem if I only encrypt the OS X startup volume with FileVault 2 (this is my current setup). If you also want to encrypt your Windows or Linux volume, things get messy - so I've heard but not tested for myself.
    – gentmatt
    Jan 21, 2013 at 14:40
  • Well, I'm actually using Ubuntu primarily with OSX on the side. Also I have a shared partition, though perhaps that could be handled with TrueCrypt. It just seems like less trouble and will require fewer pieces of software if I can just have a single password on boot.
    – Eric Marsh
    Jan 21, 2013 at 15:13
  • Have you used Filevault 2 along with Ubuntu's full disk encryption? Did that work well? I'm just curious because I want to ditch my Windows partition for Ubuntu 12.04.
    – gentmatt
    Jan 21, 2013 at 15:42
  • No, sorry I haven't tried it. I don't think it would be a problem so long as you don't want to read one partition while booted to the other. I would expect maybe you could get around that by using TrueCrypt for both. I've used TrueCrypt a little, not an expert though
    – Eric Marsh
    Jan 21, 2013 at 17:54

4 Answers 4

Reset to default
4

I've asked myself exactly the same thing as I've also bough a Samsung 840 Pro for my MacBook Pro. After some research I've found this post indicating that the 840 Pro's hardware encryption requires TPM support, and that's only found in PC BIOSes, not in Mac's (U)EFI. To be sure, I've asked Samsung support which of the standards "ATA-Security", "Seagate DriveTrust" and "TCG OPAL" are supported by the 840 Pro, and their answer was:

Dear Customer,

Thank you for contacting Samsung SSD support regarding your inquiry. In response to your inquiry, the only one of the 3 that the unit supports is the ATA Security feaure. As for the encryption, the 840 Pro Series SSD only supports AES 256 bit hardware level encryption but requires the BIOS to be TPM enabled.

So there's no way to enable the 840 Pro's hardware encryption in a Mac.

However, there's also the Crucial M500 which supports TCG's Opal. In conjunction with a special Opal management software like WinMagic's SecureDoc for Mac it sounds as if it's possible to get hardware encryption to work on a Mac.

BTW, note that according to Sophos' support their SafeGuard does support Opal only on Windows, not on Mac OS. Also, McAfee's General Q&A for Opal states

Q: Will Opal drives be supported on Mac OS X?

A: No. Apple currently does not ship their devices with Opal drives so Opal is not supported on Endpoint Encryption for Mac.

But of course that's says nothing about that happens if you just put an Opal drive into a Mac yourself.

Improve this answer
5
  • TPM is not required. On my Windows 8.1 installation I was able to activate self-encryption of this drive without using TPM — you need just to change BitLocker settings in gpedit.msc. So theoretically this is possible on OS X, too, if the OS supports it.
    – Display Name
    May 27, 2014 at 8:38
  • Would you mind sharing which settings exactly you were changing in gpedit.msc?
    – sschuberth
    May 27, 2014 at 8:41
  • howtogeek.com/howto/6229/…
    – Display Name
    May 27, 2014 at 8:42
  • That article very much looks like BitLocker would be using software encryption in that case, i.e. en-/decryption is done by the CPU instead of the hard drive itself. Especially as they recommend TrueCrypt as an alternative.
    – sschuberth
    May 27, 2014 at 8:45
  • i didn't say the other parts are correct. btw, the most complete guide is here: superuser.com/a/700251/161593
    – Display Name
    May 27, 2014 at 8:47
2

Expanding on sschuberth's answer, as of December 2013, the Samsung 840 EVO (but not PRO) also has firmware that directly supports TCG OPAL. It's a good bet that an 840 Pro firmware update to do the same thing will come soon.

You need some software to manage the SED drive, otherwise you get little or no benefit from the built-in security.

WinMagic SecureDoc will manage the drive, but not for every OS X release out there (anecdotal evidence suggests 10.8.1: ok, 10.8.2: not ok).

You'll need to run WinMagic enterprise software, too, I believe. While they have a standalone edition of SecureDoc to support SEDs, it appears that it is only available for Windows.

NOTE: SecureDoc does not require a TPM for SEDs, nor does the 840 EVO running in TCG Opal mode. SecureDoc can support the use of a TPM if you have one and enable the feature (Windows only).

Improve this answer
1

This is a good question and - yes - finding an answer to it is almost impossible. Samsung sends to Apple support. I would expect to hear from Apple that it's not possible.

Full disk encryption HW vs FileVault - difference in performance is noticeable. If you are not business user on strict encryption requirements, then we need to look for HW based Samsung solution. But how to enable it on Mac - pain to find out.

Improve this answer
2
  • 1
    With recent CPUs, FileVault2 uses hardware AES, and has a negligible impact on performance according to some reports: osxdaily.com/2011/08/10/…
    – Alan Shutko
    Feb 26, 2013 at 21:54
  • We're not really average users. I prefer to use HW FDE because it's the elegant and "correct" solution, particularly when dual booting with a shared partition.
    – Eric Marsh
    Mar 5, 2013 at 13:12
1

Yes, Viasat's Eclypt product range works with Mac (EFI) and provides full disk, FIPS approved, hardware encryption.

See: Eclypt Core Self-Encrypting Internal Hard Drive

The datasheets for the Eclypt product range are not yet up to date (but Mac OS X 10.5+ is supported as is Apple UEFI). You can see the specific product at http://www.amazon.co.uk/Eclypt-Core-200-Internal-Encrypted/dp/B00GJV2OE4. Also you can look at this blog http://robert-palmer.net/category/eclypt-protects/ for proof. Or alternative contact Viasat UK directly.

Improve this answer
1
  • Hmm, its data sheet does not mention anything about EFI or Mac, just Windows.
    – sschuberth
    Oct 25, 2013 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .