Cryptsetup Lands Support For OPAL Self Encrypting Drives

Linux 6.4 or newer paired with the latest cryptsetup development code has landed support for the OPAL specification for self-encrypting drives.

The OPAL specification is backed by major hardware vendors including Samsung, Micron, SanDisk, Seagate, Hitachi. Toshiba, Kingston, Intel, Lenovo, and others for a self-encrypting drive standard. With code recently merged to the cryptsetup library there is the OPAL bits added. Luca Boccassi commented in the merge request:

"With this I can format, open, use, close and erase multiple partitions on the same SED disk as separate luks volumes, on disks that support Single User Mode and disks that do not. Requires kernel 6.4."

The updated Cryptsetup documentation with that merge goes on to explain:

"SED (Self Encrypting Drive) OPAL EXTENSION

cryptsetup supports using native hardware encryption on drives that provide an *OPAL* interface, both nested with *dm-crypt* and standalone. Passphrases, tokens and metadata are stored using the LUKS2 header format, and are thus compatible with any software or system that uses LUKS2 (e.g.: tokens).

*WARNING:* this support is new and experimental, and requires at least kernel v6.4. Resizing devices is not supported.

--hw-opal can be specified for OPAL + dm-crypt, and
--hw-opal-only can be specified to use OPAL only, without a dm-crypt layer."

The new code also adds a "--hw-opal-factory-reset" command for carrying out a full factory reset of OPAL-compliant drives.

It's exciting to see this support finally land in cryptsetup and will be found in the project's next release.