Difference between revisions of "Full Disk Encryption (FDE)"
Thinkpadded (Talk | contribs) (→TPM) |
Rachelsdad (Talk | contribs) (→Using Segate FDE) |
||
| Line 22: | Line 22: | ||
|} | |} | ||
| − | === Using | + | === Using Seagate FDE === |
Using FDE as as easy as setting up the hard disk password (from BIOS). You can choose to have just a user password, or both a user and a master password. | Using FDE as as easy as setting up the hard disk password (from BIOS). You can choose to have just a user password, or both a user and a master password. | ||
You can export the key to an external storage, for password recovery (you need the password !!) | You can export the key to an external storage, for password recovery (you need the password !!) | ||
| + | |||
| + | N.B.: The [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-69621 Lenovo FAQ on FDE] specifically states that on the T60 & T61, there is no means of backing up or exporting the key, but that the drive may be used in another system (it is evidently not tied to a motherboard [http://en.wikipedia.org/wiki/Full_disk_encryption#Full_disk_encryption_and_Trusted_Platform_Module Trusted Platform Module]). | ||
==== Lost password ==== | ==== Lost password ==== | ||
Three possibilities : | Three possibilities : | ||
* Use the master password to change the user key. | * Use the master password to change the user key. | ||
| − | * Recover the password using the previously exported key. | + | * Recover the password using the previously exported key. (See note from Lenovo FAQ, above.) |
* Reset the encryption key (which causes the hard disk to be instantly "wiped", and resets the "hard disk password"). | * Reset the encryption key (which causes the hard disk to be instantly "wiped", and resets the "hard disk password"). | ||
Revision as of 05:26, 18 September 2008
Full Disk EncryptionLenovo's 'Full Disk Encryption' (FDE) is a technology incorporated into some of Seagate's FDE-ready hard disks. It provides encryption of all of the contents of the hard disk. Hint:
This page have been written based on commercial documentation. It should be reviewed based on real life experience
Features
|
|
Using Seagate FDE
Using FDE as as easy as setting up the hard disk password (from BIOS). You can choose to have just a user password, or both a user and a master password. You can export the key to an external storage, for password recovery (you need the password !!)
N.B.: The Lenovo FAQ on FDE specifically states that on the T60 & T61, there is no means of backing up or exporting the key, but that the drive may be used in another system (it is evidently not tied to a motherboard Trusted Platform Module).
Lost password
Three possibilities :
- Use the master password to change the user key.
- Recover the password using the previously exported key. (See note from Lenovo FAQ, above.)
- Reset the encryption key (which causes the hard disk to be instantly "wiped", and resets the "hard disk password").
Wipe the disk
Wiping the disk is as easy as reseting the encryption key from the BIOS..
TPM
It should be possible to use TPM (with fingerprint readers...) not tested yet.
- T61 with TPM & fingerprints, FDE password works with a configured fingerprint but you must use windows based software to program the imprint. By keeping a small windows partition, I am able to boot linux with a fingerprint, fingerprint passes the TPM power-on password AND the FDE disk 1 password, which is separate.
Software alternatives
It is possible to get similar security, at a very slight performance impact, by using appropriate software-based full disk encryption solutions. For example, under Linux, you can use dm-crypt to encrypt the whole disk (including swap and root partitions) except for a bootloader. Numerous tutorials are available on the Internet.
Links
- Seagate MoMentuS 5400 FDe.2
- Thinkpad Bios simulator (R61/T61 not available yet, unfortunately)
- Wikipedia - Full disk encryption (why FDE ??)
- http://www.xml-dev.com/pipermail/fde/ - Full-Disk-Encryption Mailing list
