256-bit AES encryption broken in SandForce SSD controllers

When SandForce announced the SF-2000 SSD controller family, it touted the controller's ability to encrypt data with a 256-bit AES algorithm. The previous generation of SandForce controllers did 128-bit AES encryption, but the new chip added a second hardware engine with AES-256 support. Trouble is, the SF-2000 controller's 256-bit encryption doesn't work properly. Although the latest SandForce controllers encrypt data using AES, they do so using only 128 bits.

We just got off the phone with SandForce, who we contacted in order to better understand this issue. A company representative told us the SF-2000 controllers retained their AES-128 support because the US government doesn't allow products with 256-bit encryption to be sold to some countries. Sounds like the mechanism that determines whether the controller uses 128- or 256-bit encryption is broken, although SandForce wouldn't go into specifics for "security reasons." The firm did say the problem exists in hardware and requires accompanying firmware changes. SandForce characterized the necessary hardware tweak as a "manufacturing step" rather than a re-spin of the silicon.

The flaw was unearthed by a security audit, and Intel takes some credit for identifying the problem in a specification update regarding its 520 Series SSDs. This discovery was made recently, according to SandForce, which again cited security concerns when we pressed for more details. We get the sense this issue has been known for days rather than weeks, though.

Intel has already announced it will be offering refunds to affected users until October 1. Kingston will have an exchange program and  will cover the cost of shipping for customers who request a swap. We've reached out to a couple of other SandForce partners about their plans and are waiting for details.

The various drive makers will be responsible for taking care of their customers. SandForce wouldn't discuss its arrangements with partners due to non-disclosure agreements surrounding the contracts involved.

While it's disappointing to hear of another problem related to SandForce-based SSDs, relatively few folks need to be worried about this particular problem. 128-bit AES encryption is deemed appropriate (PDF) for the US government's "secret" designation, and only information classified as "top secret" must be encoded with stronger (192- or 256-bit) encryption. Most SandForce users probably don't make use of their drives' encryption capabilities at all. Those who do can look forward to fixed drives becoming available "soon," according to SandForce.

Tip: You can use the A/Z keys to walk threads.
View options

This discussion is now closed.