Start Here - oom-is/sedutil GitHub Wiki

[Zeroth, feel free at any point to refer to the Acronyms page.]

First, for reasons that should be very obvious as you read on, special thanks to Bob Thibadeau and Mike "r0m30" Romeo without whom we would almost certainly not have SEDutil as it stands today.

Second, a few words about different "whys".

Why SEDutil (or Sedutil, or sedutil):

The TCG Opal standard for Self-Encrypting Drives (technically the OPAL Security Subsystem Class (SSC) v2.0) provides a standard that is implemented in many "spinning rust" (magnetic) hard disks, in both 3.5" and 2.5" formats (mostly SATA-III, some SAS, small numbers of NVMe) and an increasing number of Solid State Drives (SSD). In particular, Seagate (where Bob Thibadeau used to be the Chief Technologist) implemented TCG Opal on a large number of their disks, particularly targeting "enterprise" customers who care about (are willing to pay for) features such as full disk encryption, full disk erase that's actually both quick and secure, etc.

There are some commercial (COTS) implementations of software that can manage TCG Opal drives, but those are mostly targeted at the same "enterprise" customers - so they may depend on things like Active Directory, or only support implementations where an encrypted drive needs network connectivity/key escrow. WAVE (a company where Bob Thibadeau used to be the Chief Scientist) had a very well-written COTS tool that supported individual users without requiring "enterprise" features or network connectivity - unfortunately as of 2019-10-21 WAVX is trading at $0.04/share. Le Sigh.

For users who need mostly a "standalone" ability to manage OPAL self-encrypting drives in personal systems or those which don't always have external tech support/network connectivity, the options are limited. Bitlocker is one option, SEDutil is another, and a third is Linux-kernel native support for OPAL. (I suppose "write your own software" remains another option, but there are few of us who want to tackle that project.)

Why not simply use Linux kernel support?

If the only operating system needed is Linux, then kernel-native support is a great way to do it. However, a large percentage of even the most IT-savvy folks still have to boot Windows occasionally, and some of us spend most of our days in Windows-only (or Windows-mostly) environments on the desktop or laptop.

Why not Bitlocker?

Bitlocker is the Microsoft-recommended product for disk encryption (full or partial) and is integrated into Windows 7 and later. However...well, this section got so long it got its own page. For starters, let's assume for the moment that running Windows on the PC at least some of the time is a requirement, but Linux must also be supported with full-disk encryption...Bitlocker really doesn't allow that.

SEDutil?

Yep, SEDutil. SEDutil was originally written by r0m30 as "msed" and later adopted by the Drive Trust Alliance, an organization sponsored by Bright Plaza Inc. (both of which organizations have strong involvement from...Bob Thibadeau). That's why we're here. Well, I make no assumptions - but at least that's why I'm here.

Why Another Fork?

There are at least a dozen forks of DTA/r0m30 sedutil that have had code added or written. It's possible at some point there will again be One True Tree of code for SEDutil, either because a "band of the willing" agrees to combine forces, or because DTA/r0m30 again take up the challenge of maintaining the primary tree. For now, though, this tree is being put together by one person with specific requirements/needs/desirements, with the intent to both make clear what code is being pulled in from other forks, and equally importantly to ensure any useful changes to the code, build process, or documentation are contributed back to the larger community. I'm not a full-time developer, but rather a security and systems engineer with over 25 years of relevant background - so I'm going to focus on fixing what I see as the major issues to make SEDutil as close as possible to the tool I need (and realistically it's already very very close).