Independent security researchers have identified significant vulnerabilities in the hardware encryption of numerous solid-state drives (SSDs) designed to meet the TCG Opal2 standard. These drives, widely used in laptops and workstations, are marketed with built-in encryption capabilities, but testing revealed critical flaws in their implementation.
The research, conducted by Milan Brož and a team of three colleagues, involved testing 38 Opal2-compliant drives from manufacturers including Samsung, Western Digital, Micron, Kioxia, and Lenovo. The drives were a mix of new retail units and secondhand units pulled from existing systems. The team focused on interacting with the drives solely through commands defined by the Opal2 documentation, treating each drive as a "black box."
Several drives exhibited fundamental encryption weaknesses. Two Lenovo OEM drives, for instance, were found to use the same tweak value across all sectors during AES-XTS encryption. This flaw means that identical data written to different locations on the disk would produce identical ciphertext, potentially revealing patterns in the encrypted data. While the researchers rated the real-world exploitation risk of this specific flaw as limited, it undermines a core principle of AES-XTS.
Another issue involved weak random number generators (RNGs). A SanDisk SATA drive showed a strong bias towards the byte value 0x8B, emitting it at roughly double the expected frequency. While Opal2 requires drives to expose their RNGs, it does not specify quality standards. The researchers noted that they did not find any products that directly pull encryption keys from these exposed RNGs. However, a generator bias in a Samsung drive, previously reverse-engineered by other researchers, had gone undetected until this new study.
The research also uncovered problems with Physical Security ID (PSID) reset tokens. These codes, printed on drive labels, are designed to wipe a drive back to its factory state. One batch of SanDisk drives generated PSIDs sequentially, sharing common prefixes and suffixes. This means that recovering one drive's PSID could allow an attacker to deduce PSIDs for other drives in the same batch. Additionally, six other drives were found to accept any garbage appended to a valid PSID, still treating it as correct.
The researchers highlighted a significant gap between advertised hardware encryption capabilities and actual implementation. Companies often deploy Opal2 drives to meet data-at-rest compliance requirements, relying on the "hardware encryption" label without independent verification. This study marks the first cross-vendor security comparison of Opal2 drives, with the last major public work on self-encrypting SSDs dating back to 2019.
The team reported all identified security issues to the affected vendors. Micron confirmed a sector-size bug on its Crucial T500 and subsequently shipped a firmware fix. However, other vendors either stated the issues were already known and unpatched, that the products were out of support, or provided no response. Some vendors reportedly address broken encryption firmware by deprecating the feature and advising customers to use software encryption instead. Firmware updates themselves remain challenging to obtain, often requiring Windows-only tools or bootable images from the vendor.
As a result of this research, new code has been integrated into cryptsetup, a tool for configuring disk encryption on most Linux systems, to enhance Opal2 support. A "single-user mode" feature, designed to prevent a drive administrator from unlocking a user's data, is also staged for a future release, along with necessary Linux kernel changes. The researchers found that out of 24 drives advertising single-user mode, only 14 supported it adequately. Cryptsetup will now verify a drive's single-user mode firmware before trusting it, defaulting to a safer configuration if the check fails.
The researchers have released the Opal Test Suite, an open-source tool that allows anyone to perform the same checks on their own drives. Their practical guidance now recommends layering software encryption over the drive's hardware encryption, allowing the hardware to serve as an additional layer of defense rather than the sole protection. Three of the tested drives were deemed unusable for real disk encryption.
