30

Due to the recent security findings in that probably most SSDs implement encryption in a completely naive and broken way, I want to check which of my BitLocker machines are using hardware encryption and which ones are using software.

I found a way to disable the use of hardware encryption, but I can't figure out how to check if I'm using hardware encryption (in which case, I'll have to re-encrypt the drive). How do I do ti?

I'm aware of manage-bde.exe -status which gives me an output such as:

Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume C: [Windows]
[OS Volume]

    Size:                 952.62 GB
    BitLocker Version:    2.0
    Conversion Status:    Used Space Only Encrypted
    Percentage Encrypted: 100.0%
    Encryption Method:    XTS-AES 128
    Protection Status:    Protection On
    Lock Status:          Unlocked
    Identification Field: Unknown
    Key Protectors:
        TPM
        Numerical Password

but I don't know if the information I want is in this screen.

Pablo Fernandez
  • 7,438
  • 25
  • 71
  • 83
  • Do you have a reference for the claim about weaknesses in hardware crypto implementations? Sounds like a good read. – Nat Nov 15 '18 at 00:58
  • 3
    @Nat: See [this advisory](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180028) for details. Incidentally, it also solves OP's problem. – Kevin Nov 15 '18 at 02:17
  • 3
    @Nat: I believe this is the source of the information: https://www.ru.nl/english/news-agenda/news/vm/icis/cyber-security/2018/radboud-university-researchers-discover-security/ – Pablo Fernandez Nov 15 '18 at 17:18
  • 1
    Additionally type of encryption can be specified via Local Group Policy https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings. `Configure use of hardware-based encryption for fixed data drives` When not configured, Software encryption is used. – Maksim Shamihulau Feb 22 '21 at 08:25

2 Answers2

34

There exists a pretty new article on MSRC, partially explaining the issue and how to solve it. Thanks @Kevin

Microsoft is aware of reports of vulnerabilities in the hardware encryption of certain self-encrypting drives (SEDs). Customers concerned about this issue should consider using the software only encryption provided by BitLocker Drive Encryption™. On Windows computers with self-encrypting drives, BitLocker Drive Encryption™ manages encryption and will use hardware encryption by default. Administrators who want to force software encryption on computers with self-encrypting drives can accomplish this by deploying a Group Policy to override the default behavior. Windows will consult Group Policy to enforce software encryption only at the time of enabling BitLocker.

To check the type of drive encryption being used (hardware or software):

  1. Run manage-bde.exe -status from elevated command prompt.

  2. If none of the drives listed report "Hardware Encryption" for the Encryption Method field, then this device is using software encryption and is not affected by vulnerabilities associated with self-encrypting drive encryption.

manage-bde.exe -status should show you if hardware-encryption is used.

I don't have a HW encrypted drive ATM, so here is a reference link and the image it contains:

The BitLocker UI in Control Panel does not tell you whether hardware encryption is used, but the command line tool manage-bde.exe does when invoked with the parameter status. You can see that hardware encryption is enabled for D: (Samsung SSD 850 Pro) but not for C: (Samsung SSD 840 Pro without support for hardware encryption):

Bitlocker-Status

Lenniey
  • 5,220
  • 2
  • 18
  • 29
1

Bitlocker is using software encryption in your case.

It appears that Bitlocker has been defaulting to disabling hardware encryption for awhile, even if the drive supports it. This is probably primarily because of the research that came out in 2018 from Radboud University that discovered ways of bypassing hardware encryption entirely on certain SSDs. It does not appear SSD manufacturers are very good at implementing proper security. Also, hardware encryption is based on AES-CBC and is less secure than AES-XTS.

It's possible to re-enable hardware encryption in Group Policy. In the Local Group Policy Editor, under Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption, there are several subtrees: "Fixed Data Drives", "Operating System Drives", and "Removable Data Drives". Each has an item named "Configure use of hardware-based encryption for [x] drives." The default state of the item is "Not configured," which means that software encryption is forced. You can enable the item and determine which types of hardware encryption are allowed and/or whether software encryption can be used if hardware encryption is unavailable.

planetbeing
  • 150
  • 3