
I assume this because a MAC requires some extra space (just a few bytes) which would destroy the nice powers-of-two sizes of individual sectors.


The encryption with K does not include checked integrity (i.e. This is about the amount of what can be deduced from the information. When the password is removed, it is actually replaced with a convention password (i.e. When the user changes his password, K is decrypted with the old password and re-encrypted with the new. When the disk is unlocked, K is decrypted with the password, and kept in some RAM on the disk (disks have RAM, several megabytes, if only for caching). one hour), one can surmise that the drive data is encrypted with a drive-specific key K, which never changes, and that key is stored somewhere on the disk (possibly in some EEPROM) encrypted with a password-derived key. Since the user password can be changed (page 28) without implying a complete re-encryption of the disk (it would take some non-negligible time, e.g.

This hints at a security feature done on the drive itself, not in software on the host computer.

All we can do is infer.įrom the documentation, we see that the password must be re-entered in a number of conditions (drive unplugged, computer shut down, computer put to sleep.) which boil down to: the drive was not powered at some time. What isn't documented, is not documented.
