Hacker News Reader

You're right. The AES key used on _all_ drives is 8bytes.

00000000

If it's anything else the user would have to enter the key. So in practice, it's not /really/ encrypted.

Nope. The drive's firmware generates the key pseudorandomly when it receives the "securely wipe drive" command, this happens at least once before the drive is shipped from a factory. Thence, the key remains unchanged, unless another "securely wipe drive" command is received. This happens transparently to the user.

Every SSD works that way? Is that a standard?

Bog-standard. As mentioned in sibling thread, you could find really old SSDs without this feature, but they're getting rare.

Drives that lack cryptographic scrambling are not rare. Search a few vendors' sites and you'll find some that don't support "self-encrypting" capabilities.

It's pretty common for drives to have hardware AES support even if they don't implement the full TCG Opal feature set for use as a "self encrypting drive". I think Phison is the only SSD controller vendor that doesn't advertise encryption capability on all of their mainstream SSD controllers.

I'm referencing work by the Drive Trust Alliance

https://github.com/Drive-Trust-Alliance/sedutil/wiki

Reply on news.ycombinator.com