4

I've recently upgraded (clean install) to Windows 10 Enterprise. I installed an 850 Pro SSD at the same time.

Knowing that this drive could support hardware encryption for Bitlocker, I naively assumed this would just work. I've since realised to my dismay that hardware encryption isn't being used at all, and Bitlocker is still using software encryption (although CPU accelerated).

I was a little bit suspicious when the encryption seemed to take some time to fully enable (some time like perhaps 5 minutes). I figured that if it was hardware enabled it should be instant.

I don't seem to have any option in my bios to enable UEFI, and I understand that the Windows eDrive feature is only possible with UEFI boot.

Having done a bit more research, it seems as though the hardware encryption feature of the drive can actually be utilised simply by using a bios ATA password, presumably after enabling the "Encrypted Drive" option in Samsung Magician.

Is this actually the case, and if so would it be best to remove Bitlocker encryption entirely and just use the ATA password?

While I'm not looking forward to the prospect of a complete re-install, I'm also not liking the fact that my CPU is doing work that the drive should be able to do more effectively on its own.

Any advice would be greatly appreciated.

Edit: My system is a Dell XPS 17 L702X (bios version: A19)

I don't know why UEFI isn't available. I've checked everywhere in my bios setup, and I can't find anything about legacy vs UEFI boot mode.

Screen shot of Samsung Magician "Data Security" tab

enter image description here

Edit: Samsung has this to say...

"With the introduction of the SSD 840 and 840 Pro Series SSDs, Samsung has added AES hardware-based SED technology to its consumer SSD lineup. Simply enabling the ATA password via the BIOS will automatically render all data on the drive unintelligible without the proper password."

This may be good enough for my purposes. I think I'll just remove the BitLocker encryption, as I guess I'm effectively double encrypting.

ﾤ ﾡ
  • 4,187
user1751825
  • 1,736

1 Answers1

3

Microsoft reports that you require a UEFI system to take advantage of hardware encryption. This also means disabling the CSM/ Compatibility Support Module. I can't find a direct Microsoft link but here is a news article citing it. Sorry. http://www.anandtech.com/show/6891/hardware-accelerated-bitlocker-encryption-microsoft-windows-8-edrive-investigated-with-crucial-m500

Since you reported that you are in Legacy BIOS mode, you might have a UEFI motherboard, but the CSM is enabled.

If you do find a CSM option, don't disable it right now as windows is still partitioned with MBR and it will not boot.

To be sure windows gets installed with GPT, you have to disabled the CSM before installing. The DVD should be ready to boot through UEFI.

There are some major ATA password vulnerabilities, so I prefer bitlocker as its more secure. https://wikis.utexas.edu/display/ISO/Breaking+ATA+password+security

To reiterate, bitlocker hardware accelerated encryption will only work with full UEFI mode and no CSM enabled.