Self-Encrypting Drive (SED)

Many SSDs in business notebooks and servers encrypt their data themselves – often without anyone noticing. Such drives are called Self-Encrypting Drives. For data protection this sounds ideal. Whether a device is really protected this way when decommissioned, however, depends on details. This entry explains them.

How a SED works

An encryption unit works in the drive's controller, usually using the AES method. Every write operation is encrypted with an internal data key, every read operation decrypted. This happens without noticeable loss of performance and independently of the operating system.

Whether the data is actually protected depends on a second step: authentication. Only once a password or key is set does the drive lock itself when powered off. Without this setting, a SED decrypts everything for anyone who connects it. The encryption is then active, but does not protect against theft.

Term	Significance
Data key (Media Encryption Key)	Encrypts the stored data, stays in the drive
Authentication key	Protects the data key, is set via password or management software
TCG Opal	Widespread standard for SEDs in client devices
TCG Enterprise	Standard for SEDs in servers and storage systems
PSID Revert	Reset via an identifier printed on the label, which deletes the key in the process

SED and software encryption

In addition to hardware encryption, there are software solutions such as BitLocker or FileVault. They encrypt in the operating system and work on any drive. BitLocker used to be able to use the hardware encryption of a SED. After researchers demonstrated vulnerabilities in the implementation of individual SSD models in 2018, Microsoft switched the default setting to software encryption. An overview of both paths is provided by the entry Hard drive encryption.

What to note when retiring devices

• Use Crypto Erase: Deleting the data key makes all data unreadable (Crypto Erase). This takes only seconds.
• Do not trust blindly: Whether the key is really destroyed depends on the firmware. Reputable methods combine Crypto Erase with verification of the result.
• Blocking is lifted: A locked SED without a known password can often be reset only via PSID Revert. After that the drive is usable again.
• Documentation for each drive: For accountability you need a report with serial number, method, and result.

More on methods for SSDs in the guide Securely erasing hard drives and SSDs.

Relation to Second IT

Second IT erases HDDs and SSDs with Blancco. Every device receives a digitally signed erasure certificate with a serial number. Drives that cannot be erased securely are destroyed in-house in accordance with DIN 66399, certified for security level H-5. More on the certified data deletion.

Frequently asked questions about Self-Encrypting Drives

How can I tell whether an SSD is self-encrypting?

Clues are provided by the manufacturer's data sheet, entries such as "Opal" or "SED" on the label, and management programs that read out the drive's status. A printed PSID code also points to a SED.

Is a SED protected without a password?

No. Without authentication set, the drive automatically decrypts all data for any computer it is connected to. A SED offers protection only with the lock activated.

Is Crypto Erase enough as erasure for a SED?

If all data was encrypted from the start and the firmware destroys the key correctly, the data is unreadable afterward. Because this can be verified only to a limited extent from the outside, the result should be checked and documented for each drive.

What is TCG Opal?

TCG Opal is a widespread standard for self-encrypting drives in client devices such as notebooks. For servers and storage systems there is the TCG Enterprise standard. Whether a drive supports Opal is stated in the manufacturer's data sheet.

What is a PSID Revert on a SED?

A reset via an identifier printed on the label. The key is deleted in the process, the drive is usable again afterward, and the old data is unreadable. It helps with locked SEDs without a known password.