Bitlocker Hardware vs Software

Posted by nodiaque@reddit | sysadmin | View on Reddit | 3 comments

Hello everyone, We are currently implementing Bitlocker and I'm reading around the internet that Bitlocker used to be default use hardware encryption but this would have been default to software encryption since 2019 or something. I also read somewhere else that user on windows 11 with specific ssd can have a performance hit up to 45% when using the default software encryption. My question is which one should I use and why? Why was it defaulted to software encryption? Is there a reason why I shouldn't use hardware encryption? Thank you

Reply to Post

3 Comments

[-]

fuzzynavelsniffer@reddit

In 2018 several flaws were found in the hardware encryption implementation of several brands of SSDs. Microsoft is erring on the side of caution by defaulting to software encryption so they don't need to trust if a hardware SSD vendor is implementing encryption correctly. Source of the flaws: https://www.zdnet.com/article/flaws-in-self-encrypting-ssds-let-attackers-bypass-disk-encryption/

[-]

OsmiumBalloon@reddit

Hardware encryption can have bugs. So can software encryption, but if I use BitLocker software encryption, I only have to worry about bugs in Microsoft's stuff. If I use hardware encryption, I have to worry about bugs in Microsoft's stuff *and* all the storage device vendors, too. Using only software encryption makes the problem space significantly smaller. So I generally lean that way. I haven't noticed BitLocker noticably impacting performance, even on older hardware. However I also don't buy cheap SSDs, so maybe that makes a difference.

[-]

jcotton42@reddit

(Disclaimer: I work for Microsoft, though not on Windows). Completely anecdotal, but I have not noticed a meaningful performance impact on my personal rig using software Bitlocker. Common workloads on it include gaming and dev work, both of which can be very IO-intensive, in terms of both continuous high load (think installing games) and bursty random access (common when compiling code). I have also not had IO perf issues on my work laptop, which I do dev work on. There are known problems with hardware encryption on many consumer devices https://pupuweb.com/mitigate-windows-10-bitlocker-hardware-encryption-vulnerabilities-ssd/. The claim about SSD performance hits is from this article https://www.tomshardware.com/news/windows-software-bitlocker-slows-performance, however the lack of real-world benchmarks makes me skeptical of their conclusion.