Encryption Done Right?

Arguably one of the most interesting features of the M500 is its hardware encryption engine. Like many modern drives, the M500 features 256-bit AES encryption engine - all data written to the drive is stored encrypted. By default you don't need to supply a password to access the data, the key is just stored in the controller and everything is encrypted/decrypted on the fly. As with most SSDs with hardware encryption, if you set an ATA password you'll force the generation of a new key and that'll ensure no one gets access to your data.

Unfortunately, most ATA passwords aren't very secure so the AES-256 engine ends up being a bit overkill when used in this way. Here's where the M500 sets itself apart from the pack. The M500's firmware is TCG Opal 2.0 and IEEE-1667 compliant. The TCG Opal support alone lets you leverage third party encryption tools to more securily lock down your system. The combination of these two compliances however makes the M500 compatible with Microsoft's eDrive standard. 

In theory, Windows 8's BitLocker should leverage the M500's hardware encryption engine instead of using a software encryption layer on top of it. The result should be better performance and power consumption. Simply enabling BitLocker didn't seem to work for me (initial encryption time should take a few seconds not 1+ hours if it's truly leveraging the M500's hardware encryption), however according to Crucial it's a matter of making sure both my test platform and the drive support the eDrive spec. There's hardly any good info about this online so I'm still digging on how to make it work. Once I figure it out I'll update this post. Update: It works!

Assuming this does work however, the M500 is likely going to be one of the first drives that's a must have if you need to run with BitLocker enabled on Windows 8. The performance impact of software encryption isn't huge on non-SandForce drives, but minimizing it to effectively nothing would be awesome.

Crucial is also printing a physical security ID on all M500 drives. The PSID is on the M500's information label and is used in the event that you have a password protected drive that you've lost the auth code for. In the past you'd have a brick on your hand. With the M500 and its PSID, you can do a PSID revert using 3rd party software and at least get your drive back. The data will obviously be lost forever but the drive will be in an unlocked and usable state. I'm also waiting to hear back from Crucial on what utilities can successfully do a PSID reset on the M500.

NAND Configurations, Spare Area & DRAM

 

I've got the full lineup of M500s here for review. All of the drives are 2.5" 7mm form factor designs, but they all ship with a spacer you can stick on the drive for use in trays that require a 9.5mm drive (mSATA and M.2/NGFF versions will ship in Q2). The M500 chassis is otherwise a pretty straightforward 8 screw design (4 hold the chassis together, 4 hold the PCB in place). There's a single large thermal pad that covers both the Marvell 9187 controller and DDR3-1600 DRAM, allowing them to use the metal chassis for heat dissipation. The M500 is thermally managed. Should the controller temperature exceed 70C, the firmware will instruct the drive to reduce performance until it returns to normal operating temperature. The drive reduces speed without changing SATA PHY rate, so it should be transparent to the host.

The M500 is Crucial's first SSD to use 20nm NAND, which means this is the first time it has had to deal with error and defect rates at 20nm. For the most part, really clever work at the fabs and on the firmware side keeps the move to 20nm from being a big problem. Performance goes down but endurance stays constant. According to Crucial however, defects are more prevalent at 20nm - especially today when the process, particularly for these new 128Gbit die parts, is still quite new. To deal with potentially higher defect rates, Crucial introduced RAIN (Redundant Array of Independent NAND) support to the M500. We've seen RAIN used on Micron's enterprise SSDs before, but this is the first time we're seeing it used on a consumer drive.

You'll notice that Crucial uses SandForce-like capacity points with the M500. While the m4/C400 had an industry standard ~7% of its NAND set aside as spare area, the M500 roughly doubles that amount. The extra spare area is used exclusively for RAIN and to curb failure due to NAND defects, not to reduce write amplification. Despite the larger amount of spare area, if you want more consistent performance you're going to have to overprovision the M500 as if it were a standard 7% OP drive.

The breakdown of capacities vs. NAND/DRAM on-board is below:

Crucial M500 NAND/DRAM Configuration
  # of NAND Packages # of Die per Package Total NAND on-board DRAM
960GB 16 4 1024GB 1GB
480GB 16 2 512GB 512MB
240GB 16 1 256GB 256MB
120GB 8 1 128GB 256MB

As with any transition to higher density NAND, there's a reduction in the number of individual NAND die and packages in any given configuration. The 9187 controller has 8 NAND channels and can interleave requests on each channel. In general we've seen the best results when 16 or 32 devices are connected to an 8-channel controller. In other words, you can expect a substantial drop off in performance when going to the 120GB M500. Peak performance will come with the 480GB and 960GB drives.

You'll also note the lack of a 60GB offering. Given the density of this NAND, a 60GB drive would only populate four channels - cutting peak sequential performance in half. Crucial felt it would be best not to come out with a 60GB drive at this point, and simply release a version that uses 64Gbit die at some point in the future.

The heavy DRAM requirements point to a flat indirection table, similar to what we saw Intel move to with the S3700. Less than 5MB of user data is ever stored in the M500's DRAM at any given time, the bulk of the DRAM is used to cache the drive's OS, firmware and logical to physical mapping (indirection) table. Relatively flat maps should be easy to defragment, but that's assuming the M500's garbage collection and internal defragmentation routines are optimal.

Introduction & The 128Gbit 20nm NAND Die Performance Consistency
Comments Locked

111 Comments

View All Comments

  • philipma1957 - Thursday, April 18, 2013 - link

    it is all about how much you want to pay. if you buy 1 960gb micron ssds and buy a pegasus r4. with 41tb hdds you can get a very fast booting mac setup. cost is 600 + 999 or 1600. pull one 1tb hdd from the pegasus and put in the micron 960gb ssd. you have a 1tb ssd as your boot drive and 3 x 1tb hdds for storage along with a 1tb hdd as a spare.. but that is a 1600 solution pretty high cost
  • Umika - Monday, April 22, 2013 - link

    I have now one of these M500 SSDs and I have actually managed to lock me out of the drive using 3rd party OPAL TCG software. Now the printed PSID comes into play: I have downloaded the Seagate SeaTools utilities for Windows to try to crypto erase the SSD, but to no avail - the SeaTools always terminate with an error message. Is there any other openly available software to try to erase or PSID revert the drive to factory settings?
  • gzon - Tuesday, April 23, 2013 - link

    I am also experiencing problems with the OPAL encryption. Windows 8 does not seem to revert the disk back to manufactured-inactive state. Also tried PSID revert with SeaTools but it did not work. Where can I find software to PSID revert the disk?
  • mikato - Tuesday, April 23, 2013 - link

    "the key is just stored in the controller and everything is encrypted/decrypted on the fly"
    What happens if the controller breaks somehow and you need data recovery? You're just screwed? Of course backing up is the best way to go but we all know not many people do that and with these large SSD sizes they'll be taking on more data and not just an OS and programs that can always be reinstalled.
  • odedia - Sunday, July 21, 2013 - link

    I can just drool over the thought of putting two of these in my 17 inch Macbook Pro. I currently have a 128gb Intel SSD and a 500gb spinning drive. This will be a serious upgrade, and I'll be able to RAID0 them together for better performance and easier drive management.
  • littlesandra88 - Tuesday, August 27, 2013 - link

    How can an ATA BIOS password not be secure, if it changes the password (makes a new hash)?
  • paaraa - Friday, November 29, 2013 - link

    People always keep hammering about the Samsung SSD's, but did you know about the bad block issue they have? Look up the 'SSD Endurnce Experiment' (the 200TB update) at Tech Report and you will see the bad block tally of the Samsung being way up there.

    New Egg current (black friday) has the 480gb M500 on sale for $279, pretty good. I have two M4's (128gb) and they have been great for years now.
  • Gallopsu - Monday, December 23, 2013 - link

    This article mentions increased performance by 25% over provisiong. Is this something that must be configured in the bios or firmware. Or is it accomplished by simply not filling it to capacity. Or should only format it to 768GB and leave the rest untouched? How can I confirm that it is actually working? Would hate to give up that space and not get the benefits.
  • clifforama - Tuesday, January 21, 2014 - link

    Have you had any response from Crucial regarding how to perform a PSID reset/revert?
  • bogdan_kr - Thursday, January 23, 2014 - link

    Yes, I would like to know that too. Crucial has not provided any information on their forums but I guess they could possibly send some more specific information to you Anand :-)

Log in

Don't have an account? Sign up now