Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm currently trying to find my personal best solution for storing passwords and other sensible data. Recently I've used 1Password on iPhone and Mac but I'm not really satisfied with its predefined structure and storage scheme.

So I've decided to give a simple plain text file another chance... ideally a Wiki like editor with Markdown syntax - like TrunkNotes. But I've not yet found my final solution.

But now to the point: I plan to store that data on an encrypted volume in my DropBox to be accessible wherever I've need for. Since DropBox needs to transfer the whole file upon change I've thought about a growing sparse image created with the DiskUtilities from Apple using AES-256 encryption. Is the Apple solution equally secure as a TrueCrypt using the same encryption?

Both solutions rely on images that hold several files. Is there any alternative that can easily be integrated into the OS to encrypt single files instead of whole disk images? That would significantly reduce overall sync traffic.

share|improve this question
4  
Have you looked at GPG? It has been a while since I looked at it, but I seem to remember them having a secure text editor that would decrypt a file and allow you to edit it, and then reencrypt it. It would handle memory and temporary files so as to not leak information. –  mikeazo Mar 12 '12 at 11:52
1  
I'll check this out... suppose you mean gnupg.org –  Daniel Bleisteiner Mar 12 '12 at 13:24
    
Gave it a try... but the handling of encrypt/decrypt with copies of the files being generated is not ideal. Also the need for defining myself as receiver is not very intuitive. –  Daniel Bleisteiner Mar 12 '12 at 20:38
    
Hmm, must have changed some since I last used it. Anottherone to try is called Encryption Wizard spi.dod.mil/ewizard.htm –  mikeazo Mar 12 '12 at 20:51
add comment

3 Answers

up vote 7 down vote accepted

Is the Apple solution equally secure as a TrueCrypt using the same encryption?

Assuming that there is no "publicly known" security flaw within the file structure of the images created by said applications, the logical strength of said "container" would depend on the encryption algorithm utilized as well as the pass phrase implemented. Although, there are conspiracy theories surrounding TrueCrypt, they are beyond the scope of this question.

Is there any alternative that can easily be integrated into the OS to encrypt single files instead of whole disk images?

Yes, GnuPG, as stated by "mikeazo". You could generate a key-pair and encrypt your "sensitive" data using the public-key. You could write a script which would encrypt and decrypt, etc, all required files as necessary.

On the note of encryption algorithms, Blowfish, designed by Bruce Schneier, has the following notes based on cryptanalysis work:

There is no effective cryptanalysis on the full-round version of Blowfish known publicly as of 2011. A sign extension bug in one publication of C code has been identified. In 1996, Serge Vaudenay found a known-plaintext attack requiring 28r + 1 known plaintexts to break, where r is the number of rounds. Moreover, he also found a class of weak keys that can be detected and broken by the same attack with only 24r + 1 known plaintexts. This attack cannot be used against the regular Blowfish; it assumes knowledge of the key-dependent S-boxes. Vincent Rijmen, in his Ph.D. thesis, introduced a second-order differential attack that can break four rounds and no more. There remains no known way to break the full 16 rounds, apart from a brute-force search. Bruce Schneier notes that while Blowfish is still in use, he recommends using the more recent Twofish algorithm instead.

~ Wikipedia

GnuPG can utilize Blowfish; Blowfish has also been included in the mainline GNU/Linux kernel since version 2.5.47. A list of products utilizing the Blowfish cipher may be found here.

On a side note, the key size utilized by the encryption algorithm (chosen by you) also plays a role in the overall security of said information. Generally, the larger the key (measured in bits {b}), the more computing power required to brute-force said pass phrase.

share|improve this answer
    
Thanks for this complete and well structured answer! –  Daniel Bleisteiner Mar 23 '12 at 17:56
add comment

For fast, easy, and free file encryption, nothing beats Encryption Wizard

The latest version even has an encrypted password / key organizer.

share|improve this answer
add comment

You can do file level encryption in OSX with the openssl shell command's enc option.

A bit tedious to type every time, of course, but you can automate it with a shell script, or find a gui front end to it like Fileward.

However, there's a gotcha with this method: you have to be sure you securely delete the original file after you make the encrypted version.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.