Is it better to use Bitlocker or the built-in-drive-encryption that my SSD offers?

Question

My system:

• Intel Core i7-4790, which supports AES-NI
• ASUS Z97-PRO mobo
• Samsung 250GB EVO SSD (with built-in encryption option)
• 64-bit Windows 7

If I just want to encrypt my boot drive with AES256 or similar, what would be the difference / faster performance / more secure? Flip Windows Bitlocker on and not use the SSD encryption, or enable the built-in drive encryption that the SSD offers, and don't worry about Bitlocker?

I'm thinking it might be better to offload the encryption to the SSD by using the Evo's encryption option, so that the processor doesn't have to do any encryption, this might be better for I/O performance and give the CPU a breather? Or since this CPU has AES-NI it might not matter?

I'm new to Bitlocker and this SSD encryption option, so any help is much appreciated.

Answer 1

Old question, but since then several new developments have been found concerning Bitlocker and drive encryption (used either alone or in combination), so I will turn couple of my comments on the page to an answer. Maybe it is of use to someone doing a search in 2018 and later.

Bitlocker (alone):
There have been several ways to breach Bitlocker in it's history, luckily most of them have already been patched / mitigated in 2018. What remains (known) include, for example, the "Cold Boot Attack" - the newest version of which really isn't Bitlocker specific (you need physical access to a running computer and steal the encryption keys, and anything else, straight from the memory).

SSD drive hardware encryption and Bitlocker:
A new vulnerability has surfaced in 2018; if a SSD disk has hardware encryption, which most SSDs have, Bitlocker defaults to using only that. Which means that if that encryption itself has been cracked, the user essentially has no protection at all.
Drives that are known to be suffering from this vulnerability include (but are probably not limited to):
Crucial MX100, MX200, MX300 series Samgung 840 EVO, 850 EVO, T3, T5

More information about the SSD encryption problem here:
https://twitter.com/matthew_d_green/status/1059435094421712896

And the actual paper (as PDF) delving deeper into the problem here:
t.co/UGTsvnFv9Y?amp=1

So the answer really is; since Bitlocker uses the disks hardware encryption, and has it's own vulnerabilities on top of that , you're better off using the hardware encryption if your SSD is not on the list of cracked SSDs.

If your disk is on the list, you're better off using something else entirely since Bitlocker would use the drive encryption anyway. What is the question; on Linux I would recommend LUKS, for example.

Answer 2

I'v been doing some research on this and have a half complete answer for you.

1. It is always better to use hardware based encryption on a self encrypting drive, if you use the software based encryption on bitlocker or another encryption program it will cause anywhere between a 25% and 45% slowdown in read write speeds. you could see a minimum of a 10% drop in performance. (note you must have an SSD with a TMP chip)

2. Bitlocker is compatible with hardware based encryption, you can use samsung magic. v 4.9.6 (v5 no longer supports this) to wipe the drive and enable the hardware based encryption.

http://www.ckode.dk/desktop-machines/how-to-enable-windows-edrive-encryption-for-ssds/

3. you can enable hardware based encryption via the BIOS by setting the master password. You will need to follow some of the steps in the article above, like turning off CMS.

4. To answer your question I don't really know which is faster. I have reached out to Samsung but given the limited info on this. Unless I get a developer I doubt I will get a good answer to which is the better option. For now I plan to enable the hardware based encryption in my bios.

Answer 3

I am not familiar with your drive and the encryption options it offers, however hardware encryption can be used with multiple operating systems (e.g. when you want to dual-boot Windows and Linux), while software encryption might be harder to configure. Also, the safety of both methods depends on how and where you store your encryption keys.

I'm thinking it might be better to offload the encryption to the SSD by using the Evo's encryption option, so that the processor doesn't have to do any encryption, this might be better for i/o performance and give the CPU a breather?

You are right, hardware-based encryption does not lower the computer's processing speed.

I have never used encryption on any of my devices, so I'm sorry that I can't help you with the actual process of enabling it. Please do note that in most cases enabling encryption causes the drive to get erased (BitLocker does NOT erase data, however it has an extremely remote chance of corruption, as it is with all live-encryption software). If you want to have multi-OS compatible encrypted drive which stays unlocked until the computer is shut down, go with the hardware encryption feature your hard drive offers. But, if you want something a little more secure but limited to Windows, try out BitLocker. Hope I helped!

Answer 4

Let's do some Wikipédia.

BitLocker

BitLocker is a full disk encryption feature. It is designed to protect data by providing encryption for entire volumes.

BitLocker is a logical volume encryption system. A volume may or may not be an entire hard disk drive, or it can span one or more physical drives. Also, when enabled, TPM and BitLocker can ensure the integrity of the trusted boot path (e.g. BIOS, boot sector, etc.), in order to prevent most offline physical attacks, boot sector malware, etc.

According to Microsoft, BitLocker does not contain an intentionally built-in backdoor; without a backdoor there is no way for law enforcement to have a guaranteed passage to the data on the user's drives that is provided by Microsoft.

Self-Encrypting Drive

Hardware-based encryption when built into the drive or within the drive enclosure is notably transparent to the user. The drive except for bootup authentication operates just like any drive with no degradation in performance. There is no complication or performance overhead, unlike disk encryption software, since all the encryption is invisible to the operating system and the host computers processor.

The two main use cases are Data at Rest protection, and Cryptographic Disk Erasure.

In Data at Rest protection a laptop is simply powered off. The disk now self-protects all the data on it. The data is safe because all of it, even the OS, is now encrypted, with a secure mode of AES, and locked from reading and writing. The drive requires an authentication code which can be as strong as 32 bytes (2^256) to unlock.

Typical self-encrypting drives, once unlocked, will remain unlocked as long as power is provided. Researchers at Universität Erlangen-Nürnberg have demonstrated a number of attacks based on moving the drive to another computer without cutting power. Additionally, it may be possible to reboot the computer into an attacker-controlled operating system without cutting power to the drive.

Verdict

I think that the most important lines are these :

There is no complication or performance overhead, unlike disk encryption software, since all the encryption is invisible to the operating system and the host computers processor.

Typical self-encrypting drives, once unlocked, will remain unlocked as long as power is provided.

Because BitLocker is a disk encryption software, it is slower than the hardware-based full disk encryption. However, the Self-Encrypting Drive stays unlocked as long as it had power since the last time it was unlocked. Shutting down the computer will secure the drive.

So, either you have the more secure BitLocker or the more performant Self-Encrypting Drive.

Answer 5

Update: I believe this answer was correct and an example of real life enterprise experience in hardware and security ops. Maybe I failed to provide details in my initial answer which created the downvotes but also provided insight into the thought process for a more conclusive answer from the community as a whole. Windows but locker has been compromised since launch and has been a well known issue, and not included in enterprise Windows OS but available to consumer level packages for a layer of security/ band aid, NSA Backdoor.

Samsung EVO SSD's built in encryption would be my choice as it is natively optimized and one of the best SSD's out there for security in corporate environments. Also if you ever lose the key, Samsung can unlock it for a fee via the serial # on the SSD.