What happens after setting up HDD password?

Question

I am wondering what happens when I set HDD password in my laptop (Samsung with ssd). I mean a given case. I have been having working system without any password. Then one day I decide to set up HDD password in BIOS. Does whole disk in that very moment become encrypted ? I did not notice any moment waiting etc... I understand that after having password set all written data would be encrypted, but what happens with existing one. Perhaps I am missing something

Answer 1

Usually, disks supporting encryption do this in two steps.

In step one (usually on factory manufacture) a secret key is chosen at random. Then, a decryption key is chosen, and initially it is blank.

The secret key is encrypted using the decryption key and, when the system is powered up, an API exists whereby the user can supply the decryption key, if needed. Then, the secret key is stored into a temporary memory buffer and used to encrypt (and decrypt) all traffic to the magnetic platters.

To change the password, you supply the old password, whereby the encryption key is decrypted and re-encrypted with the new password. This takes only a few instants.

To decrypt the hard disk you need to know the secret key, which never leaves the disk itself. While some encryption schemes are vulnerable to brute force and statistical analysis (for example because the encryption scheme is a simple "SECRET KEY (XOR) HARD DISK SECTOR" - it has happened), current schemes are pretty solid.

There are some very sophisticated techniques that can recover the hard disk secret key, if the model is known and supported, from the powered down hard disk provided it hasn't been powered down too long, from the residuals in the hard disk's volatile memory. But at that point it makes much more sense to worry about a rubber-hose attack.

The advantage of the double-key system is, as you experienced, that there is no need to decrypt and reencrypt the whole disk whenever the user key changes. This makes the operation very, very fast and reduces the risk of a mishap happening in mid-encryption which might leave the disk effectively "bricked".

Of course, there are rumors - I can't seem to find the reference now, so let's call it a theoretical possibility - that the master key is not actually random at all, but may (e.g.) derived from the disk serial number, maybe hashed with a secret salt (or alternately, it can be random generated... and then secretly stored together with the disk serial number). Knowing the hash, the salt and the disk serial number, and by dismantling the disk or overriding its interface, it then becomes possible to "easily" recover the disk content. At the same time, such a backdoor isn't easy to uncover.

Answer 2

Unless you specifically enabled full device encryption, merely setting a device password does not encrypt the device. Hard disks have supported passwords for decades, but have not had encryption capabilities until recently. These passwords just won't expose the raw device to the BIOS until you've unlocked them, but the actual data remains unencrypted.