selfencrypting

Self-encrypting refers to storage devices or systems that perform encryption automatically within the device, typically using a dedicated hardware encryptor. The term is most commonly applied to self-encrypting drives (SEDs), which implement full-disk encryption in hardware so that data is protected at rest without relying on host-based software.

In operation, data is encrypted as it is written and decrypted as it is read, using cryptographic algorithms such as AES in XTS mode. The encryption keys are stored in secure, non-volatile memory on the drive and are unlocked by a user credential, a pre-boot authentication module, or a trusted platform mechanism such as a TPM. Once unlocked, the host accesses data normally; encryption and decryption occur transparently.

Benefits include protection of data if the device is lost or stolen, minimal impact on host performance, and simplified compliance with data-protection requirements. Self-encrypting drives can also support enterprise features such as centralized key management, key escrow, and remote management. They are commonly used in laptops, servers, and commodity storage where data-at-rest protection is a priority.

Limitations and considerations: the security of an SED depends on proper key management and configuration; if a drive is left unlocked or unlocked credentials are compromised, data is exposed. SED security does not protect data in memory or against certain malware that targets authentication data. Standards and interoperability exist, notably the Trusted Computing Group’s Opal specifications and related implementations (eDrive) that enable cross-platform support, though not all devices support every feature.