Does the MacBook Pro support FDE and maybe FIPS too?

Question

Level 1

20 points

Does the MacBook Pro support FDE and maybe FIPS too?

Does the MacBook Pro support FDE and possibly FIPS too? I bought a Seagate Constellation ST9500422AS drive, and I can't seem to invoke the HDE function. If you don't know specifically what I'm referring too, please don't guess the answer or suggest possible software solutions.

various PCs

Posted on Jan 31, 2011 5:32 PM

Reply

Answer 1

Best reply

etresoft

Level 8

46,200 points

Jan 31, 2011 5:58 PM in response to johnfinn68

johnfinn68 wrote:
Does the MacBook Pro support FDE and possibly FIPS too?

Yes

I bought a Seagate Constellation ST9500422AS drive, and I can't seem to invoke the HDE function. If you don't know specifically what I'm referring too, please don't guess the answer or suggest possible software solutions.

Well, my answer involves a software solution that utilizes Seagate Secure commands so that you can use Seagate's full disk encryption products on a Mac. But since you said not the suggest that, I won't.

Reply

Answer 2

johnfinn68 Author

Level 1

20 points

Feb 1, 2011 12:21 PM in response to etresoft

If there's a way to get FDE with the MBP using Seagate Secure commands, I'm all ears. I really need something that prevents users accessing any data on the drive, weather it's in the MBP or not. I can't even figure out how to get the MBP to halt at loading the EFI without a password (like six year old Dell 9200).

Reply

Answer 3

johnfinn68 Author

Level 1

20 points

Feb 1, 2011 12:30 PM in response to johnfinn68

http://www.winmagic.com/products/full-disk-encryption-for-mac

Etresoft gave me the link above as a possible solution to this problem that Apple has left wide open in the Mac's EFI security. Seagate's pre-sales support stated that (currently) Apple's EFI does not support the FDE function in the Momentus hard drive. Shame on them.

Reply

Answer 4

Mar 4, 2011 9:45 AM in response to johnfinn68

I've been trying the winmagic product with a seagate FDE drive (421 in my case) on the new macbook pro. It causes the system to crash on both sleep and hibernate. I've found no way to use it with this laptop (and I tried all their suggestions vis-a-vis hibernatemode and lidwake). Has anyone had any luck with this product and the 2011 macbook pros? Or has anyone found a better solution? The i7 in the new MBPs has built-in AES so even (properly implemented) software encryption should be fast. However, as far as I can tell truecrypt does not support full-disk encryption of the system partition on a mac. I'd really like FDE but there really seems to be no viable solution on a mac. Even in 2011.

Reply

Answer 5

atrealt

Level 1

0 points

Apr 1, 2011 11:07 AM in response to kensmosis

I'd spent crazy week with the setup of WinMagic for MPB with Seagate Momentus ST9500422AS trying to reach the pretty clear vision I had before getting all this nice things)

We have to read documentation before engaging more thoroughly. What I imagined was the very fast completely encrypted MacBook. Also there were Windows computers I read about with this SED setup seemed flawless and straightforward.

WinMagic does not put any EFI extension drivers to EFI itself to be able to work with fde on wakeup. It just creates boot partition to unlock the drive at boot time. This boot attempt arises only after hibernation but not after wakeup from sleep. So it's just impossible to have MBP to wake from sleep perfectly with fde sed supported by WinMagic.

So lets forget about sleep. WinMagic sets sleep mode of MBP to hibernate (sudo pmset -a hibernatemode 1) during setup. It works. But if you used to be happy with Mac opening lid and resuming immediately this is not the case. Also when closing lid or putting computer to sleep some other way do not try to open lid or turn it on again until MBP goes off completely (front light off)).

What could also be wrong was that if hibernatemode was set to 1 then Secure virtual memory (Preferences/Security) should be turned off to succeed with wakeup from hibernation.

Another idea is that you should by all means avoid computer disk from sleep as WinMagic does not provide any driver for Mac OS to unlock fde on the fly when it resumes. So carefully check Energy saver preferences both on battery power and power adapter (put harddisk to sleep when possible should be unchecked).

Also if you have Fusion or Parallels virtual machine running then MBP will not resume from hibernation (seems they both lacks host OS hibernation support). You have to either power off or suspend to disk virtual machine.

BootCamp is working perfect with this setup as well. If you'll have problems with setup I could help.

So it is possible to have everything working fine if forget about sleep and fast resume. I'm using this setup all the time but am thinking more often about PGP WDE I used before. The disk access will be slower but I will feel it only copying huge amounts of files etc. I'll have fast sleep resume with no problem I'm sure. And bootcamp setup is also supported.

In terms of security keep in mind that when you do hot restart self-encrypting drive (SED) does not lock itself (due to some crazy standart crazy specifications afaik)). So if someone would stole laptop turned on and locked and managed to hot restart it and boot from some media MBP's hdd will be completely opened.

Message was edited by: atrealt

Message was edited by: atrealt

Message was edited by: atrealt

Reply

Answer 6

May 6, 2011 7:34 AM in response to atrealt

Thanks for your detailed reply, atrealt; I appreciate your advice. However, at the time I posted I had read the manual and turned off secure virtual memory and tried all possible hibernatemode settings without success. My laptop could not wake from hibernation. Period. It wasn't a matter of waiting for it to write the data to disk. I could wait 20 minutes. If I opened the lid it went black and required a hard reboot every time. Tech support was unresponsive -- I suspect they have one guy working on the Mac version and, as you say, the EFI solution really is a hack rather than a proper extension. There are 3 reasons why my system may not work while yours did:

(1) I was testing it on a new macbook pro (Mar, 2011), whereas I see from the bottom of your post that yours is a slightly earlier model.

(2) I was (at the time I tried all this) in 64-bit kernel mode. For other reasons, I have since switched to 32 bit mode. However, by then I had fully installed my system and wasn't willing to mess around with bleeding edge FDE. So it may or may not work in 32-bit kernel mode on the new macs.

(3) or I'm unlucky -- i.e. anything else that randomly differs.

Regardless, I just want to post here as a warning to anyone else who may be considering FDE. Winmagic does not work on all macs. I had to return it for a refund (which they were very good about issuing). Unfortunately, there is no hardware FDE solution at this time -- they were the only hope. As far as I know there is no product for the mac that works with either Seagate FDE technology or the AES instruction set of the new intel processors.

Reply

Answer 7

atrealt

Level 1

0 points

May 7, 2011 2:20 AM in response to kensmosis

Seems that you were right in the assumption of 64bit kernel to be the point as my kernel is set to start in 32bit mode. Just curious either your kernel was set to start in 64bit with factory default of newer model or it was your experiment.

WinMagic does put some kext in the system and they are 32bit for sure and should not work with 64bit kernel.

Reply

Answer 8

jaś

Level 1

0 points

Aug 28, 2013 8:41 AM in response to johnfinn68

Hi Guys. I'd just like to add to this thread. I've been testing WinMagic software for about 2 years and can confirm it does not work properly with every Mac. There are always some problems with instalation and system stability. Paradoxically, it turned out that the best solution to have it working seamlesly is a configuration in which SecureDock is installed on Windows partition (it applies only to FDE/SED drives in OPAL standard). Once you have initiated hardware FDE protection on your mac using Windows partition you can enjoy pre-boot authentication and avoid any issues in OS X. SD Windows Edition works fine on both MBP 2011 and iMac mid 2010.

As far as FDE/SED drives are concerned, do not get confused by Samsung 840 "FDE 256Bit encryption". It is not an OPAL drive and thus CANNOT be managed by any software except in bios.

Reply

Answer 9

jaś

Level 1

0 points

Aug 28, 2013 9:21 AM in response to johnfinn68

Should you experience any boot problems following authentication, having put your credentials in, just press F8 instead of ENTER and change the value of:

"Special Y Mode" from 00 to 02

You're done.

Remember to have it then changed permanently in SecereDoc Control Centre preferences.

SecureDoc Windows Edition works fine on both Windows 7/8 in bootcamp (hybryd MBR/GPT) configuration as well as on EFI homogenic GPT instalation (alternative to bootcamp).

Reply