FIPS 140-2 Validated SSD with AES256 Encryption Key to Secure Data
Data Security is an important topic with more and more data being stored digitally and needing protection from unwanted access. Breaches range from individuals’ identity theft to large corporations’ loss of credit card information and credit reporting data.
This article sorts out some of the details of the encryption methods recommended and used for Top Secret data by the US Government. It is an excerpt from our detailed Cactus 240SE Series Crypto SSD White Paper. It is applicable to all levels and types of business.
Cactus offers both an AES256 Encrypted 2.5” SATA SSD and an AES256 Encrypted External USB SSD. The SATA SSD have optional Amphenol R-SATA or Smiths rugged SATA Connectors.
What is a SED (Self Encrypting Drive)?
Data security is more than just having hardware encryption, good data security requires that the encryption engine must be properly designed with no bugs and/or loopholes to exploit.
The encryption key must also be properly protected as it is the single point of weakness of the entire data security system. This is the focus of the Cactus CryptoSSD products and in this White Paper, we will discuss how Cactus Technologies CryptoSSD products address these issues.
Encryption Method:
Encryption is a vast and complex topic; here we will only provide some basic information that is relevant to Cactus Technologies CryptoSSD products. The encryption algorithm used in Cactus Technologies CryptoSSD products is AES256.
AES is an encryption standard established by NIST (National Institute of Standards & Technology) in 2001. It is a subset of the Rijndael cipher and operates on blocks of 128bits with a choice of key sizes of 128, 192 or 256bits.
AES was adopted by the US Government and is now widely used in many encryption software. In the US, AES is published by NIST as FIPS 197; it is also included in ISO/IEC 18033-3 standard. It is also the only public cipher approved by NSA for TOP SECRET information.
Numerous papers have been published that discussed various method of attacking AES encryption; as of today, there is no known method that can successfully crack a fully and properly implemented AES encryption in a reasonable amount of time.
Risk of Quantum Computing to AES256 Encryption:
There has also been concern about quantum computing potentially being able to crack AES encryption fairly quickly. However, that is not the case.
Some encryption algorithms rely on factoring large numbers (e.g. RSA); there are known algorithms for attacking such type of encryption and quantum computing is well suited to running such algorithm.
Thus, quantum computing is a threat to such encryption, which is commonly used, for example, in securing websites.
AES encryption does not rely on factoring large numbers. In order to break AES256 encryption, one has to search through a large key space to find the key.
There are some algorithms that speed up the search of this key space but even with the help of quantum computing, studies have shown that this would merely reduce the time to crack AES256 down to the equivalent of cracking AES128, which would still take an impractically long time to do.
Therefore, at this time, AES256 is still widely considered to be resistant to quantum attack.
Due to the robustness of AES256 to resist various forms of attack, this is the generally recommended algorithm for securing stored data. Use of weaker strength keys, such as AES128, is not recommended.
AES Encryption Modes:
When encrypting large chunks of data, AES can be operated in various modes. There are six modes approved by NIST and published in document SP800-38E (Recommendation for Block Cipher Modes of Operation).
These six modes are:
- ECB (Electronic Code Book)
- CBC (Cipher Block Chaining)
- CFB (Cipher Feedback)
- OFB (Output Feedback)
- CTR (Counter)
- XTS (XEX mode w/ ciphertext stealing)
Each of these modes have strengths & weaknesses, we will not go into details here. Of these six modes, XTS mode is specifically suited for disk drive encryption. This mode originated as IEEE Standard 1619-2007 and was adopted by NIST in 2010.
According to SP 800-38E,
In the absence of authentication or access control, XTS-AES provides more protection than the other approved confidentiality-only modes against unauthorized manipulation of the encrypted data.
This is the preferred encryption mode for securing data in disk drives. While Cactus Technologies CryptoSSD products can support any of the six modes listed above, XTS mode is the one that is currently being deployed.
Final Thoughts:
Cactus Technologies designs and manufacturers highly secure FIPS 140-2 Validated, AES256 Encrypted SSD in our CryptoSSD line of products.
Our 2.5” SATA CryptoSSD have Extended (-40C to 85C) Operating Temperature versions, while the External USB CryptoSSD is rated for 0C to 70C.
If you need assistance with an OEM design or needing special features, please contact us.
