Linux Disk Encryption and Self-Encrypting Drives: A Case Study on Opal2 Drives Security

Jul 16, 2026

Opal2 self-encrypting drives provide hardware-based disk encryption as an added protection layer or an alternative to software-only solutions. The study documents a real-world Linux integration effort for Opal2 drives and evaluates the security of Opal2 firmware through black-box testing. Using a testbed of 38 commercial off-the-shelf Opal2 drives from multiple vendors, the authors identify firmware security issues and incompatibilities, disclose them responsibly, and enable improvements across major Linux disk encryption tools. A public open-source toolset is released for independent evaluation.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages20

Reading Time50 min

Introduction

Sector-based (disk) encryption

Linux integration, standards, and security goals

Methodology, testbed, and black-box results

Practical impact

Appendices

arXiv :2607 . 1 1563v 1 [ cs .CR] 13 Jul 2026 Linux disk encryption and self-encrypting drives A case study on Opal2 drives security Milan Brož 1 ,2 􀀀 , Tamara Čierniková 1 , Ondřej Kozina3 , and Vladimír Sedláček 1 1 Masaryk University, Brno, Czechia {milan.broz,ciernikova,[vlada.sedlacek}@mail.muni.cz](vlada.sedlacek}@mail.muni.cz) 2 OpenSSL Corporation 3 Red Hat Czech [okozina@redhat.com](okozina@redhat.com) This work is licensed under a “CC BY 4 .0” license. Abstract. Opal2 self-encrypting drives provide hardware-based disk encryption serving as an additional layer of protection, or a replacement, for software-based solutions. This paper presents a case study of real-world Linux integration of Opal2 drives and the security of Opal2 firmware. The study was conducted on a testbed of 38 commercial off-the-shelf Opal2 drives from various vendors using a black-box approach. We identified several firmware security issues and incompatibilities, which we responsibly disclosed to respective vendors. Our findings led to improvements in Linux disk encryption tools used across all major Linux distributions. To enable independent evaluation for the public, we release our test scenarios for Opal2 drives as an open-source toolset. Keywords: SED Opal2, LUKS2, self-encrypting drives, disk encryption 1 Introduction Disk encryption is a common mechanism for protecting data at rest. It can be implemented in software, where the operating system handles encryption per disk sector, or in hardware through self-encrypting drives (SEDs) . The TCG Opal2 standard [37] defines a widely adopted specification for SEDs that offloads cryptographic operations to the drive controller itself. Opal2 can be deployed alongside software encryption as an additional security layer, or as a standalone solution where data confidentiality relies entirely on the hardware. Both use cases expect the underlying hardware to behave correctly and as specified; an assumption we put to the test. Linux disk encryption relies on the open-source Linux Unified Key Setup 2 (LUKS2) format [4] together with the cryptsetup [6] user-space configuration utility. The practical contribution of this work is the secure integration of Opal2 support into LUKS2, thereby enabling a user-friendly configuration of SEDs on Linux, which was not feasible with prior tooling. 2 M. Brož, T. Čierniková, O.Kozina and V. Sedláček We present a case study on the security of Opal2 drives. To this end, we assemble a testbed of 38 drives advertising Opal2 support and conduct a security analysis of intercepted firmware. Our testbed is a mix of second-hand units and new in-stock purchases, representing the diversity of Opal2 SEDs found in present Linux deployments. We employ a black-box analysis methodology: we rely exclusively on documented protocols, without any knowledge of the internal firmware implementation. Our security evaluation focuses on non-adversarial operational use of SEDs, deliberately setting aside hardware-level or supply-chain attacks. The black-box approach has a key advantage: every test is fully reproducible on any drive that exposes the required Opal2 interface. Importantly, our findings are not Linuxspecific; they apply to any platform that supports Opal2 drives. Analysis uncovered firmware-level issues affecting the correctness of encryption, including a discrepancy between the encryption block size and the physical sector size, potential reuse of sector tweak values, and insufficient randomness in the exported random number generator interface. All issues were reported to affected vendors through a responsible disclosure process. We make following contributions: – A black-box security analysis of 38 Opal2 drives, revealing firmware vulnerabilities, specification ambiguities, and implementation incompatibilities. The Opal2 tooling developed for this analysis is released as open source. – Backed by this analysis, we achieve Opal2 integration

FAQs

What problem does the paper address regarding Opal2 drives on Linux?

The paper studies how Opal2 self-encrypting drives are integrated in real Linux environments and evaluates the security of Opal2 firmware, aiming to ensure correct and safe disk encryption behavior.

How was the Opal2 security evaluation conducted?

The authors use a black-box approach on a testbed of 38 commercial off-the-shelf Opal2 drives, relying only on documented protocols without internal firmware knowledge to keep tests reproducible.

What kinds of firmware issues were discovered?

The study found firmware-level problems affecting encryption correctness, including mismatches between encryption block size and physical sector size, potential reuse of sector tweak values, and insufficient randomness in the exported random number generator interface.

Jul 16, 2026

Upload by Theodora