P4510系列硬盘上的硬件加密？

嗨Mike，感谢您在英特尔®社区发帖。我们知道您想知道英特尔®SSDDC P4510系列是否支持Opal 2.0。
在确认之前，请让我对此进行调查。
我会尽快发布更新。祝你有个美好的一天。感谢，Diego V.



以下为原文

Hi Mike,

Thank you for posting in the Intel® communities.

I understand that you would like to know if Opal 2.0 is supported in the Intel® SSD DC P4510 Series. Please let me investigate on this before confirming it to you. I’ll post an update as soon as possible.

Have a nice day.

Regards,
Diego V.

嗨Mike，我已经确认英特尔®SSDDC P4510系列不支持Opal 2.0，但未来版本将支持它。
目前支持Opal的驱动器来自Professional系列：https：//ark.intel.com/#@ProfessionalSSDs英特尔®SSDDC P4510系列具有AES-256加密功能，但您必须使用软件才能使用此功能
我希望这些信息可以澄清你的关注。祝你有个美好的一天。感谢，迭戈五世。



以下为原文

Hi Mike,

I’ve got confirmation that Opal 2.0 is not supported in the Intel® SSD DC P4510 Series, however it will be supported in future releases. Currently the drives that support Opal are the ones from the Professional family: https://ark.intel.com/#@ProfessionalSSDs

The Intel® SSD DC P4510 Series has AES-256 encryption, but you would have to use a software to use this feature.

I hope this information clarifies your concern.

Have a nice day.

Regards,
Diego V.
 

你好迭戈，
感谢您的及时回应。
您是否有任何关于在Linux上启用硬件加密的软件选项的信息？
我们不需要从加密的P4510驱动器启动。
我们的用例是使用LUKS2软件加密我们会有不同的启动驱动器，因为我们不关心启动驱动器的吞吐量。
我们将几个连接到系统的P4510驱动器用于高吞吐量和加密的流写入/读取。
我们只需要一些方法来为P4510驱动器设置硬件加密密钥。
作为支持TCG Opal 2.0的一个小脚注，产品简介[1]表示“所有可管理性功能在产品发布时尚未提供，但将在未来的维护版本中提供。有关功能的详细信息，请参阅产品规格
描述和可用性。“
我们准备购买这些驱动器，如果它们可以像所宣传的那样支持TCG Opal 2.0，或者至少可以用于Linux上的某种硬件加密。
如果产品路线图需要NDA，我们非常愿意签署该文件。
否则，我们将环顾其他供应商以满足这一需求。
[1] https://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/dc-p4510-series-brief.pdf
问候，
麦克风



以下为原文

Hi Diego,
 
Thanks for your prompt response.
 
Do you have any information on software options to enable the hardware encryption on Linux?  We do not need to boot off of an encrypted P4510 drive.  Our use case is that we would have a different boot drive using LUKS2 software encryption, as we don't care about throughput on the boot drive.  We would have several of the P4510 drives connected to the system for high-throughput and encrypted streaming writes / reads.  We just need some way to set the hardware encryption key for the P4510 drives. 
 
As a small footnote to supporting TCG Opal 2.0, the product brief[1] says that "All manageability features are not available at the time of the product release but will be available in future maintenance release. Please refer to product specification for details about feature description and availability."  We're prepared to make a pretty large purchase of these drives if they can support TCG Opal 2.0 as advertised, or can at least be usable for hardware encryption of some sort on Linux.  If the product roadmap requires an NDA, we are more than willing to sign that document.  Otherwise, we'll have look around to other vendors to fill this need.
 
[1] https://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/dc-p4510-series-brief.pdf
 
Regards,
Mike

嗨，迈克，我明白了。请让我调查一下，看看我能找到什么可以帮到你。我会尽快联系你.Regards，Diego V.



以下为原文

Hi Mike,

I understand.

Please let me investigate and see what I can find about this that may help you.

I’ll contact you back as soon as possible.

Regards,
Diego V.
 

嗨Mike，在调查了您对加密要求的担忧后，我确认AES-256加密确实是英特尔®SSDDC P4510系列中的一项功能，但无法启用或禁用。
它实际上内置于产品的ASIC中。
它会在将ASIC发送出ASIC并写入介质之前对通过ASIC的任何数据进行加密。另一方面，根据您的描述：“我们只需要一些方法来设置硬件加密密钥......”，我们的
解释是您希望以某种方式自定义加密密钥。
不幸的是，这是不可能的。
密钥只能通过安全擦除过程进行更改，但驱动器固件是生成新加密密钥的固件。
这不是可以任何方式定制或编辑的东西。我希望你能发现这些信息很有帮助。祝你有个美好的一天.Regards，Diego V.



以下为原文

Hi Mike,

After investigating on your concern about the encryption requirements, I was confirmed that AES-256 encryption is indeed a feature included in the Intel® SSD DC P4510 Series, however it cannot be enabled or disabled. It is actually built in to the ASIC of the product. It encrypts any data that goes through the ASIC before it is sent out of the ASIC and written to the media.

On the other hand, according to your description above: “We just need some way to set the hardware encryption key…”, our interpretation is that you would like to customize the encryption key in some way. Unfortunately, this is not possible. The key can only be changed through a secure erase process, but the drive firmware is the one that generates the new encryption key. This is not something that can be customized or edited in any way.

I hope you find this information helpful.

Have a nice day.

Regards,
Diego V.

你好迭戈，
也许我没有正确理解P4510加密功能。
如果无法设置密钥，硬件加密会提供什么保护？
TCG Opal 2.0的本质是，它被宣传为此驱动器的一项功能，它允许您以标准化方式设置加密密钥。
问候，
麦克风



以下为原文

Hi Diego,
 
Maybe I'm not understanding the P4510 encryption functionality correctly.  What protection does hardware encryption provide if there is no way to set the key?  The essence of TCG Opal 2.0, which was advertised as a feature on this drive, is that it allows you to set the encryption keys in a standardized manner. 
 
Regards,
Mike

嗨，迈克，我明白了，但是此驱动器目前不支持Opal。
它预计将包含在未来版本中，但在当前版本中，没有Opal支持。上面的信息指的是驱动器具有的当前加密方法，默认情况下是内置和启用的。
无法以任何方式禁用它或编辑加密密钥，因为固件会直接处理。我希望这可以更好地澄清这些信息.Regards，Diego V.



以下为原文

Hi Mike,

I understand, however Opal is not currently supported on this drive. It’s expected to be included in future releases but in the current one, there is no Opal support.

The information above is referring to the current encryption method the drive has, which is built-in and enabled by default. It’s not possible to disable it, or to edit the encryption key in any way as that’s handled directly by the firmware.

I hope this clarifies better this information.

Regards,
Diego V.

嗨迈克，我想知道除了我们已经讨论过的关于Opal支持或英特尔®SSDDC P4510系列使用的加密之外还有什么，我可以帮助你.Regards，Diego V.



以下为原文

Hi Mike,

I was wondering if there is anything else, besides what we have already discussed about the Opal support or the encryption the Intel® SSD DC P4510 Series uses, that I can help you with.

Regards,
Diego V.

不，但谢谢你伸出援手。
我对这些驱动器上Opal 2.0支持的误导性数据表感到非常失望。



以下为原文

No, but thank you for reaching out.  I'm pretty disappointed in the misleading datasheet on Opal 2.0 support on these drives. 

嗨迈克，我理解你。
我会转发您对文档中信息的反馈，以便合适的团队可以查看它.Regards，Diego V.



以下为原文

Hi Mike,

I understand you. I’ll forward your feedback about the information in the documentation so that the proper team can take a look at it.

Regards,
Diego V.