HOW TO MANAGE ENCRYPTION OF 960 PRO

SOLVED
Constellation

HOW TO MANAGE ENCRYPTION OF 960 PRO

How to encrypt or link windows bitlocker to encrypted samsung ssd 960 pro? No support from company and also drive is slowing down about 30% just by the time of finishing the install and update.....
Anybody???
Is there a single person achieved the encrypton on the hardware level with these drives yet??
If the feature is not yet available, when it is expected to be available? Any links to additional encryption software etc..? 
Should I seek the replacement after 30% drop in a read speed's just after setting up my windows (i did it all on fully supported board and components - replicated it 2x) or it is a ok...not easy to accept fact after watching the fancy benchmarks internet is full with..
Any help is appreciated, Thanks!

See more topics labeled with:

1 ACCEPTED SOLUTION

Accepted Solutions
Nebula
Solution
Accepted by SamsungDave (Nebula)
‎03-16-2018 06:20 AM

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

Hello All,

After investigating the HW encryption problems from a compatibility point of view, we found this issue can be only be fixed with a BIOS update by the motherboard manufacturers.
Through technical collaboration with one of the major BIOS chipset companies, we have verified that a new BIOS update of the motherboard BIOS works well with the H/W encryption function in our SSD drives. We will continue to verify the solution with the other BIOS chipset companies.
We expect that the motherboard manufacturers will publicize the information of their BIOS updates for a solution.



Be sure to click " ✓ Accept as Solution" when you find an answer that works for you.

225 REPLIES
Samsung Moderator

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

Please contact out memory support team.  

 

This team’s operation hours are Mon – Fri 9AM ~ Midnight, Sat 9AM ~ 9PM, & Sun closed. This team has 3 ways of contact:
a. 1-800-samsung > 1 > 7
b. Samsungmemorysupport@sea.samsung.com
c. Live chat (this is a separated live chat function from  other products' live chat feature on our website)
 
Our SSD Memory support team members are equipped with a ton of knowledge and experience surrounding SSDs, SD cards, HDDs, and other memory products and will be your fastest way to a resolution when it comes to troubleshooting,  processing repair or exchange services.  We believe this team is best equipped to handle memory product inquiries and while our moderators can help, we are requesting that you please contact the above outlets for the services mentioned.
 
Please don't let this discourage you from posting. We still love hearing your feedback regarding your memory units and encourage you to continue reaching out to your fellow community members if you ever have questions. Thanks so much for posting!
 


Be sure to click " ✓ Accept as Solution" when you find an answer that works for you.

Constellation

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

Did you ever figure this out because i have the same question using Linux.

I got this far.

 

Let me say that I don’t think steps 1, 2, 3, and 8 are really needed for data drives, but I will go ahead and include them since I did execute them.

 

  1. yum install ncurses-devel
  2. cd <dist>/LinuxPBA
  3. make CONF=Release_X86_64
  4. cd <dist>/linux/CLI
  5. make CONF=Release_X86_64
  6. No libata kernel flag is required for NVMe drives
  7. sedutil-cli –initialSetup  <password>  /dev/nvme0
  8. sedutil-cli  --loadPBAimage  <password>  <file created in step 3>  /dev/nvme0
  9. sedutil-cli  --setMBREnable  on <password>  /dev/nvme0
  10. sedutil-cli  --enableLockingRange  0  <password>  /dev/nvme0
  11. Power off the server and remove power, don’t just reboot
  12. Drive should now be locked
  13. Verify with:  sedutil-cli  --listlockingranges  <password>  /dev/nvme0
  14. Look at range 0 and verify read and write are enabled and locked
  15. To unlock:
  16. sedutil-cli –setMBRdone on  <password>  /dev/nvme0
  17. sedutil-cli  --setlockingrange  0  RW  <password>  /dev/nvme0
  18. Now you can mount the partition on the drive
  19. I have only tried this once, and it couldn’t read the super blocks, so this is where I am in the investigation
Nebula

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

[ Edited ]

Hello All,

The 960 Pro only supports 2 types of Hardware level encryption, Class 0 (AES 256bit), and TCG/OPAL 2.0.

Class 0 is enabled through the BIOS drive password feature and TCG/OPAL requires 3rd party programs to activate.

 

Unfortunately we do not recommend software level encryption.

 



Be sure to click " ✓ Accept as Solution" when you find an answer that works for you.

Constellation

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO


SamsungDave wrote:

Hello All,

The 960 Pro only supports 2 types of Hardware level encryption, Class 0 (AES 256bit), and TCG/OPAL 2.0.

Class 0 is enabled through the BIOS drive password feature and TCG/OPAL requires 3rd party programs to activate.

 

Unfortunately we do not recommend software level encryption.

 


Can you give any examples of 3rd party programs?  I cannot find any that claim to work with the 960 pro.

Anonymous

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

Hi userGhI1G5AOCU,

 

There are no programs for software level encryption that is recommended by Samsung. However, I believe software such as Wave's EMASSY security suite provides TCG OPAL compaliant software level encryption which should work with our drives as long as OPAL 2.0 is supported. To obtain the software, you may need to contact the company directly as there doesn't seem to be an easy way to download the software.

 

Constellation

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

[ Edited ]

SED Util (https://www.drivetrust.com/sed-util/) is the defacto application for setting up TCG Opal drives. The commercial applications do the same thing, but they have additional management features designed for enterprise deployment etc.

 

Personally I would just stick to BitLocker software encryption for the OS drive, since it's significantly easier to use for most people and the performance difference is 0% since the so-called software encryption is actually done in hardware in the CPU with AES instructions.

Nebula

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

Hello user4Ch84Tjw3u,

I've had customers mention that software before, but we've never been able to get it to work on any of our drives.

 

They could do Bitlocker, but since the 960 drives don't have E-Drive support, its going to be software level encryption, which will decrease drive performance about 30-40%.



Be sure to click " ✓ Accept as Solution" when you find an answer that works for you.

Constellation

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

Hi,

 

I'm also struggling to enable the hardware encryption (960Pro 1TB NVMe in a HP Elitebook 850 G3)

 

I have read different statements

Basically they all write that there is no method to enable hardware encrytpion via a BIOS password for NVMe SSD drives.

And there still is no eDrive support. So I have a good SSD (I think) with useless hardware encryption.

 

 

regards,

Philippe

Anonymous

Re: HOW TO MANAGE ENCRYPTION OF 960 PRO

Hello userc17OpsynGO,

 

Yes, that is understandble. If your system does not have the option to activate hardware encryption, then you will not be able to use hardware encryption. The 960PRO has the ability to activate hardware encryption, so if hardware encryption for M.2 drives is added to your system via a BIOS update in the future, then at that point you should be able to use hardware encryption without any kind of issues.