1598

Topic:
 
This KB document discusses the security impacts of using Y mode values 4, 40 and 80 during troubleshooting.
The Y mode values are used to troubleshoot reboot, keyboard, USB ports, NIC cards and BSOD issues.  These values do not guarantee to work on every single device.
 
Product version affected:
 
6.2 and newer SD versions
 
Environment:
 
Windows OS and devices
AES-NI enabled devices
 
Y mode = 0:
-Set by default
- When the Y mode is set to 0, the keyfile is transitioned from pre-boot to Windows in memory. In this situation, it does not require a reboot.
- Security implication: None
 
Y mode = 4:
-Restarts the machine after entering the credentials which allows the machine to boot up without our PBA sometimes fixing the booting issues
The key file is stored in memory after entering credential. Y-mode 4 requires a reboot (slower) but the system remains secure.
When the Y mode is set to 4, the keyfile is stored in memory and will be disappeared when the device is powered off (Recommended value during troubleshooting).
 
Reference information:
KB 1337 Slow performance when resuming from hibernation
 
Y mode = 40:
-Restarts the machine in similar way as Y mode 4.
-Security implications: When using this value, the keyfile is transferred to the hard drive (within the SD Space) and is not deleted when the device is powered off.
 
During the Pre-Boot Authentication there is a data key transfer to the drive if the value is set to 40. The data key will remains on disk (e.g. the reboot) and this method could be used to transfer data into the OS as well. Please be aware of the vulnerability, that this data should be deleted from the disk after use as it may contains sensitive info. Even though the data is obfuscated before being written to the disk and is deleted after being used, it may be vulnerable.

Reference Information:
KB 1515 Supporting Devices with Intel's SkyLake Microarchitecture using SD version 7.1 SR1
 
Y Mode = 80:
- If AES-NI is enabled and the system is using V5 boot logon then hibernation load time will be faster.
By default, this Y mode is set to 80.
With SD version 6.2 build 223 (6.2ML) if this Y-mode is not set in profile, please set it to 80.
Security implication: None
 
Reference information:
KB 1390: Slow performance when resuming from hibernation
 
NOTE:
SW Encryption
1) Y-Mode=4, will not work on some environments where BIOS wipes out the memory, secure, as a negative impact - reboot is using
2) Y-Mode=40, should work in 99% of cases, less secure, since preboot authentication information is saved into the disk, reboot is using
 
HW Encryption
1) Y-Mode=4, will work on 99%, secure, negative impact is that "single sign on" will not work