Comment by mhw | Hacker News Reader

Comment by mhw | Hacker News Reader

Parent Full thread

One lesser-known fact about laptop hard drive encryption (the kind that's built in to the SATA firmware) is that the passphrase used to encrypt the disk is often not the passphrase that you type in to the BIOS. On Lenovo laptops, for example, the passphrase is generated by a complex calculation that was only known to Lenovo until someone reverse-engineered it: https://jbeekman.nl/blog/2015/03/lenovo-thinkpad-hdd-passwor...

If you remove the disk from the laptop (perhaps because the laptop breaks) you are unable to decrypt it (or remove the encryption key to reuse it as a blank disk, for that matter) unless you can reproduce not just the passphrase that you type in, but also the algorithm that the BIOS used to set the password on the disk. If you no longer have the laptop that you originally used to encrypt the disk then it's going to be difficult to decrypt the disk even if you do know the password.

Imagine the conversation:

"What's the encryption password for this disk?"

"'changeme'"

"Hmm. That doesn't seem to work with hdparm..."

"Well, that's what I typed into the laptop to unlock the disk, but it may not be what the laptop sends to the disk. I have no knowledge of the algorithm that <laptop supplier> uses, and no longer have the original laptop."

"Ok. Wait there while we talk to the laptop supplier."

Security by obscurity, it's useless. It must be some kind of known key derivation function. If it's something home-grown then actually that's much worse as I doubt Lenovo employs world-class cryptographers who can design something better than e.g. bcrypt or scrypt.

I don't buy that. For stuff like key derivation, there are loads of ways you could vary the process without compromising security.

For example, a normal disc encryption system with the caveat that the password is XORed with a secret before the key derivation algorithm is used (where the secret is unique to the exact laptop model) would effectively stop all decryption in its tracks until you knew the exact laptop model, but would not compromise security at all.

Where are you suggesting to keep the "secret" (to be XORed with)? It must be stored somewhere in the firmware or on the disk, right? Then I'm afraid it's not a secret, it's just a second salt (which KDF functions already have one) and can be easily read. I just don't see the point.

The point is if you no longer have the laptop and hadn't previously extracted the "second salt", thus out of luck

And you are probably unaware of why your password doesn't work.

Were you aware of this issue before GP posted ? I wasn't.

There would be lists of per-model salts shared online in days.

It could be a per-device salt.

And it could be stored in a tamper-proof chip on the device itself...

It's useless if the only method. If it slows down potential attack then it's just as effective as, say, multiple encryption cycles.

Reply on news.ycombinator.com