[liberationtech] Encryption of Asus UX31A/Adata XM11 SSD

[konfkukor at riseup.net]

Hi,

I own an Asus UX31A ultrabook, which contains an Adata XM11 SSD. This SSD
uses the Sandforce SF-2281 controller, which encrypts the data using 128
bits AES. It uses a key for this which is (supposedly) unique per
controller, and which the manufacturer does not know. What I am interested
in, is how this encryption is implemented.

In the ideal case, according to this paper [1], when the user sets an ATA
password in the BIOS, this ATA password is used to encrypt the AES key
with which the data on the SSD is encrypted. Thus, when no password is set
the data is still encrypted; only the AES key itself is stored unencrypted
(but inaccessible to the user). When the user sets or changes the
password, only the AES key needs to be (re-)encrypted, instead of all the
data. (The paper then goes on explaining lots of ways in which someone
might still access the data, but those ways are not of concern to me now.
See also [2] as an example how not to do it, and also [3].)

I did notice that my BIOS allows me to set an ATA master password and ATA
user password, both up to 32 characters. So far so good. Only, I do not
know if one of them is used to encrypt this AES key and if these passwords
are stored in any safe way (i.e. hashed irreversibly).

Unfortunately, very very few manufacturers of SSDs seem to be willing to
disclose _anything_ about their product. In my case, when I asked them,
Adata pointed me to Asus, saying that it is an OEM model so that it may
have "special H/W design/Firmware". So I went to Asus, and asked them two
questions:

1. Is (one of) the ATA passwords used to encrypt the AES key,
2. Are the ATA passwords stored as an irreversible hash instead of cleartext?

They refused to say anything about it, however, "this to ensure the safety
of the encryption." The only thing they claimed was that if the ATA
password is set, it is impossible to access the data on the disk without
this password. I tried explaining to them that secrecy is generally not a
good idea in the case of encryption, and that being secretive about it
almost implies that they have something to hide, but to no avail. Asus'
customer service will not help me; they are not authorized to discuss or
disclose anything.

I am rather disappointing by that attitude of theirs. I am rather curious
what my computer does with my data, even though Asus seems to believe I
should not be. So my question to you is this: do any of you know how I
might learn some more about this? For example, who at Asus might know
something about this and is authorized to talk about it? How might I
convince someone at Asus to start talking? How might I find it out myself?


[1] Tilo Müller, Tobias Latzo, and Felix C. Freiling. "Self-Encrypting
Disks pose Self-Decrypting Risks".
https://www1.informatik.uni-erlangen.de/filepool/projects/sed/seds-at-risks.pdf
[2] Matthias Deeg, Sebastian Schreiber. "Cryptographically Secure? SySS
Cracks a USB Flash Drive".
http://janusseal.com/prod/as/pdf/SySS_Cracks_Kingston_USB_Flash_Drive.pdf
[3] "SSDs with usable built-in hardware-based full disk encryption".
http://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hardware-based-full-disk-encryption/