Advice on buying an encrypted disk

Question

1. How do I find an encrypted disk to buy?

2. What factors should I be aware of in selecting one?

3. Is there any proof that buying one likely to draw any attention?

4. How do I know there's not a backdoor?

Answer 1

To answer your points:

1. In terms of finding one - there are a number of vendors who sell already encrypted disks. A quick google for 'encrypted hard drives' will give you a current list - the normal vendors have them (my quick search gave me this useful guide but it may be out of date)

2. In terms of what factors you may need to be aware of, these would be my criteria:

   • physical security: is the case resistant to attack; does it have a kensington mount
   • authentication mechanism: on device or on PC; fingerprint, PIN, passphrase
   • speed: well, it's got to perform, right?
   • encryption: strength; is the encryption on board or at driver level? I would feel safest with the PIN/fingerprint on the device itself, and encryption enforced on the circuitry.

3. I don't think buying one will cause any suspicion - they are becoming more and more common for individuals to protect themselves in everyday life.

4. And as for your final point - you don't. There isn't likely to be a way to prove it, but best assume that unless you are an important target, it would be very unlikely that your drive would be compromised.

Answer 2

There is a backdoor in encrypted disks: it's called key escrow - anyone who posesses the escrow key can decrypt it. See Computer Online Forensic Evidence Extractor (COFEE).

I would strongly suggest that you use TrueCrypt system encryption, using the Advanced Encryption Standard (AES) with a 256-bit key in Extended Schedule with Ciphertext Stealing (XTS) mode. The most important thing is to use a complex pass phrase. This means that it has to be either a long string of a small set of characters (e.g. the letters of the English alphabet) or a short string of, basically, random bits whose byte value is not zero (null-terminator). Using an up-to-8-characters-long pass phrase consisting of the letters of the English alphabet places a brute-force attack on data encrypted with AES at below 10 seconds on a Cray XE6 with 1 million Opteron 6200-series chips and below 100 miliseconds on a Cray XK6. See Non-dictionary known-plaintext brute force attack on AES-256.

However, this can still be bypassed using COFEE to directly extract data from your system through built-in backdoors in Windows. Basically, many states can walk into any company or private residence and take data from company and peoples' computers. If COFEE ever falls into the wrong hands, all companies and private citizens that use Windows are screwed. If I didn't need all these Windows applications, I'd completely switch to openSUSE. You'll need DECAF by SOLDIERX. However, this will still not keep you safe from other backdoors in Windows.

The most secure operating system would be Slackware. I used it on a server of a financial institution that was under constant attack (about a dozen penetration attempts a day); however, it is not user-friendly. The server was replaced with a Windows server by another guy and, whammo!, a few weeks later 2 penetrations in a row.