SafeGuard Device Encryption: OPAL Support

  • Article ID: 113366
  • Rating:
  • 7 customers rated this article 4.4 out of 6
  • Updated: 12 Feb 2016

This article provides information on SafeGuard Device Encryption and support for OPAL drives.

Applies to the following Sophos product(s) and version(s)
SafeGuard Easy 6.0
SafeGuard Device Encryption 7.0
SafeGuard Device Encryption 6.0
SafeGuard  Device Encryption 6.10.0

SafeGuard Device Encryption: OPAL Support

In general, SafeGuard Device Encryption supports all drives (HDD/SSD) that follow the OPAL specification. Known exceptions are listed in the second table of this article.

OPAL drives that were successfully tested by Sophos’ QA

Make Model Needs IGNORE_OPAL_AUTHORITYCHECK_RESULTS Installation Parameter? Notes
Fujitsu MJA2250CH G2 T1 No Fujitsu‘s HDD production has been acquired by Toshiba in the meantime.
The model is not available any more.
Hitachi HTS725016A9A365 No 500 GB version also available
Toshiba MK2561GSYD No  
Seagate ST250LT014 Yes Same hardware as below. Version with Seagate Firmware




Same hardware as above. Version with Lenovo Firmware

 LITE-ON  LCS-256M6S  Yes  FW 1C852T5, P/N 3C01140049 supported as of SGN 6.10
 Micron C400   Yes

Firmware version 04TH required

supported as of SGN 6.10

 Intel  SSDSC2BF180A4  Yes

SSD Pro 1500 180GB

supported as of SGN 6.10

Crucial (Micron)  CT512MX100SSD1  Yes Firmware version MU01 required

supported as of SGN 6.10

A tool is available (OpalReqCheck.exe) to generically check a drive’s parameters and basic compatibility. Information on this tool and the tool itself is available in article 122017.

OPAL Drives that cannot be managed by SafeGuard Enterprise (fallback to software encryption) 





A different size of the Z7K320 series has been successfully tested.

 SSD PB22-JS3 FDE 2.5  128GB


 SSD PB22-JS3 FDE 2.5  64GB

 Samsung  SSD PM810 FDE TM  
 Samsung  840 EVO   
 Samsung  SM841N MZ7PD256HCGM-000H7
 Hitachi  HTS727550A9E365  
 Hitachi  HTS723225A7A365  
 Toshiba  MK3261GSYD   
 Crucial  CT250MX200SSD3  FW: MU02


  • SafeGuard 6.0 supports Opal drives that comply with version 1.0 of the OPAL specification, Opal 2.0 drives are only supported if they are fully compatible with the version 1.0 specification.
  • Since version 7 of SafeGuard Enterprise / Easy no Opal checks are performed by default.


This means that, although an Opal drive is present, SafeGuard Enterprise will encrypt volumes on this drive via software-based encryption.


If you want to force that Opal checks are performed, use the following command line syntax:


MSIEXEC /i <name_of_selected_client_msi>.msi OPALMODE=0


An upgrade of SafeGuard Enterprise 6.x to SafeGuard Enterprise 7.0 on a PC with an Opal HDD used in Opal HW-encryption mode will preserve the Opal HW-encryption mode.


Technical background

In an ideal world, technical standards and specifications would be comprehensive and unambiguous and their real-world implementations would adhere to them and be, of course, bug-free. At Sophos, we have gone to great lengths to ensure that the support of Self Encrypting Drives (SEDs) that are based on the TCG Storage Group’s OPAL standard, follows the standard closely. To this end, two types of checks are performed at installation time:

  • Functional Checks
    These include, among others, checking whether the drive identifies itself as an “OPAL” drive, whether the communications properties are ok, and whether all SafeGuard Enterprise-required OPAL features are supported by the drive.
  • Security checks
    These checks are made to ensure that only SafeGuard Enterprise users are registered on the drive, just as only SafeGuard Enterprise users are the owners of the keys used to software-encrypt non-SED drives. If other users are found to be registered at installation time, or when an encryption policy arrives after a successful OPAL-mode installation, SafeGuard Enterprise automatically tries to disable these users. The ability to disable these users is required by the standard, with the exception of a few well-known default “authorities” which are needed to run an OPAL system in the first place and which have well-defined functionality.

If any of these checks fail in an unrecoverable way, installation does not fall back to software-based encryption. Instead all volumes on the Opal disk remain unencrypted.

While working on the OPAL feature, Sophos was in close contact with the drive manufacturers and it soon became clear that some specific drives need special treatment. Thus, the SafeGuard Enterprise client now maintains an internal table that stores specifics on how certain drives are best operated. However, this table includes only functional issues (such as optimizations to attain maximum data transfer speed). It does, of course, not cover security issues.

However, we also noted that some drives also have potential security issues. Please note the word “potential”. There is no way to find out automatically which privileges have been assigned to an unknown user/authority that is already registered on the drive at SafeGuard Enterprise installation/encryption time. If the drive refuses the command to disable such users, SafeGuard Enterprise will fall back to software encryption to ensure maximum security for the SafeGuard Enterprise user.

Please note that at least one manufacturer, Seagate, has chosen to preinstall those users that are not covered by the OPAL standard. Sophos does not believe that these pose any security issue in any way, as Seagate has a long history of implementing SEDs, and their current line of OPAL drives also boast a number of security certificates. However, Sophos cannot give any security guarantees in any other manufacturer’s name, which is why we implemented a special installation switch to enable customers to use such drives at their own discretion.

If you want use any drive in the table above that has a “Yes” in the “Needs IGNORE_OPAL_AUTHORITYCHECK_RESULTS Installation Parameter?” column, do as follows:

On the command prompt, type:

MSIEXEC /i <name_of_selected_client_msi.msi > IGNORE_OPAL_AUTHORITYCHECK_RESULTS=1

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent