{"id":271127,"date":"2026-01-07T22:59:55","date_gmt":"2026-01-07T21:59:55","guid":{"rendered":"https:\/\/www.hwcooling.net\/?p=271127\/"},"modified":"2026-01-07T23:39:45","modified_gmt":"2026-01-07T22:39:45","slug":"windows-11-introduces-hardware-disk-encryption-with-panther-lake-chips","status":"publish","type":"post","link":"https:\/\/www.hwcooling.net\/en\/windows-11-introduces-hardware-disk-encryption-with-panther-lake-chips\/","title":{"rendered":"Windows 11 gets hardware disk encryption on Intel Panther Lake"},"content":{"rendered":"

In December, Microsoft promised that Windows 11 would focus on performance, including in games<\/a>, during 2026. One of the coming optimizations concerns disk encryption. Microsoft currently uses software algorithms for BitLocker disk encryption, which have certain performance limitations and can increase laptop power consumption. This year, Windows will gain more efficient hardware accelerated encryption\u2014but there is a complication.<\/p>\n

The software encryption currently used by Windows for the BitLocker feature is not particularly slow thanks to acceleration using AES instructions on modern processors, but today\u2019s NVMe SSDs with PCI Express 4.0 \u00d74 interfaces (reaching transfer rates up to 7400 MB\/s) or even PCI Express 5.0 \u00d74 (up to 15.0 GB\/s) place quite high demands on the system, and CPU load during data reads or writes can be relatively high. At the same time, BitLocker encryption should now be enabled by default on new installations of Windows 11 Pro, so an increasing number of users are exposed to this impact.<\/p>\n

In November, Microsoft announced that Windows would gain the ability to use encryption handled directly by hardware, which should no longer be associated with the performance drops seen with software encryption. The feature is now already present in the system and should soon be enabled on newly released computers, the first of which are likely to appear this month.<\/p>\n

Support for this hardware\u00a0accelerated encryption mode is somewhat complicated. You may recall that SSDs typically support encryption directly within the drive’s controller. However, Windows does not make use of these capabilities, and when hardware-accelerated encryption is now being discussed, it does not mean using the built-in encryption features of the SSDs themselves.<\/p>\n

The reason may be that there is relatively little trust in the correctness and security of encryption implementations at the level of SSD controllers and firmware. The large variability among different SSDs available on the market makes it impossible to thoroughly test and audit their implementations, and it can be expected that many SSDs may have various security issues in their firmware that could open paths to weakening or breaking encryption of stored data.<\/p>\n

\"Hardwarov\u00fd<\/a>
Hardware BitLocker in Windows 11: On the left, a diagram of how traditional software encryption works; on the right, the new hardware-accelerated approach (Author: Microsoft)<\/figcaption><\/figure>\n

Offloading encryption to a dedicated unit in the processor<\/h3>\n

Instead, the newly introduced hardware storage encryption will rely on a dedicated encryption unit that will be introduced by new processors and should be an integrated part of the platform itself. The SSD itself will therefore always receive data that is already encrypted and will never handle the encryption key at all. From the user\u2019s perspective, this encryption implementatio should work the same way BitLocker has worked up to now. The algorithm is XTS-AES-256.<\/p>\n

The downside is that this performance-improving innovation will not reach any older and current computers, since apparently no existing processors currently support it. It will arrive with new chip generations\u2014the first to offer the feature are the 1.8nm Core Ultra 300 \u201cPanther Lake\u201d<\/a> SoCs, which Intel is now releasing, and during CES 2026 the first laptops based on them should debut. Microsoft has confirmed that enterprise laptops based on Panther Lake with vPro technology will already support this hardware acceleration.<\/p>\n

Hardware-protected keys<\/h3>\n

As part of this change, in addition to offloading encryption and decryption to a unit within the processor, security is also increased by storing the keys in a special, protected storage area inside the processor. These protected keys will not be accessible anywhere in the system\u2019s main memory and will not even be \u201cvisible\u201d to the CPU cores themselves. This limits attackers\u2019 ability to access the keys through security vulnerabilities (for example, speculative attacks or other methods of finding and leaking sensitive data from memory). With software encryption, the keys must necessarily remain in RAM and can also leak from CPU core caches, because the CPU needs them when executing the cryptography routines.<\/p>\n

This key protection is a separate feature and does not have to be available on all processors. It is not strictly required for support of hardware encryption itself, which can function even without hardware key protection. This is also not the same as using a TPM\u2014the TPM will continue to exist in PCs with a somewhat different role.<\/p>\n

\"Hardwarov\u011b<\/a>
Hardware-accelerated BitLocker encryption in Windows 11. Whether it is active can be verified using the manage-bde -status<\/strong> command (Author: Microsoft)<\/figcaption><\/figure>\n

Encryption without impact on performance<\/h3>\n

According to example tests shown by Microsoft, CPU cycle savings at high transfer rates with a fast SSD can reach up to 70%. Acceleration (offload) using the dedicated unit in the processor ensures that the impact of encryption is practically negligible\u2014according to the test, CPU load can be virtually at the same level as with an unencrypted SSD. Actual results will likely vary depending on the hardware. These results were probably obtained on a sample of an Intel Panther Lake processor; other processors may behave slightly differently.<\/p>\n

\"Hardwarov\u011b<\/a>
Hardware-accelerated BitLocker in Windows 11 consumes far less CPU performance during disk operations. The orange bar shows CPU cycle usage with software encryption, the dark blue bar shows usage without encryption. The light blue bar shows CPU cycle usage with hardware BitLocker, which should be close to native performance without encryption (Author: Microsoft)<\/figcaption><\/figure>\n

Longer battery life, lower heat and less noise<\/h3>\n

In situations where software encryption reduced the effective performance of the SSD\u2014which can often happen, as reading and writing larger volumes of data may be slower than without encryption\u2014hardware BitLocker can increase performance by removing this \u201cbottleneck.\u201d Performance should again be restored more or less to the level of an unencrypted system.<\/p>\n