Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

When using a laptop, an encrypted HD/SSD can be an important security measure. However, laptops are prone to accidents (fluid spills, dropping on the floor, etc) that may mandate some or all of the components to be replaced.

Are there hard disk encryption schemes that tie the encryption key to other hardware than the HD?

Meaning the drive would be unreadable when it's plugged into a machine other than the (destroyed) original one. Just to avoid them when using a laptop ;-)

share|improve this question
Why would you tie the encryption key to some hardware part? – F. Hauri Jan 29 at 22:11
I don't know and I don't want to. I thought there might some schemes that do it, especially when they use the TPM. That's why I asked this question - just to be sure I can access my data when the rest of the computer is gone. – chiborg Jan 30 at 10:50
1  
If so, most of open-source tools would do the job as you mean, by default. Linking HW to something like salt is possible, but is not usual (it's a not so good idea). Well, @Polynomial answer, like mine, are quite right. – F. Hauri Jan 30 at 11:21

2 Answers

up vote 1 down vote

None that I know of. The standard for disk encryption is TrueCrypt, which accepts a password, key files, and smart cards as authentication credentials.

So, at worst, you could use your key files if you put them on a single drive and it fails. Of course, that should be a moot point since you're doing regular backups, right? ;)

share|improve this answer
1  
TrueCrypt is hardly the standard, even on Windows (there's Bitlocker!). On Linux, it's available but hardly ever used except for containers that must also be accessible from Windows. – Gilles Jan 29 at 14:54
1  
I've often heard it described as the standard, and I don't know of another free open-source cross-platform solution that's as pervasive as TC is. – Polynomial Jan 29 at 14:57
up vote 0 down vote

Under GNU/Linux, there is a standardization effort: cryptsetup

and some (older project) like cryptmount.

Both suites are based on (same) kernel crypto modules and could accept a passphrase. When installed on root file system, the passphrase will be asked at boot (before mounting root /).

Both suites use the block device abstraction layer dm-setup present as standard in Linux kernel from version 2.6.

Quite simple to install, but some linux experience may be useful.

share|improve this answer
And this software is not tying the encryption to some hardware id, right? The passphrase protects the encryption key which is stored somewhere on the hard drive? – chiborg Jan 29 at 17:28
Right, however, there was some (older) version of cryptmount who build key from a derivation of passphrase (hash), so passphrase could not be changed. Newer version use a self generated key, protected by the passphrase. But there is no link to hardware ID (not now and not prior)...( Unless you modify mount script ;-) – F. Hauri Jan 29 at 18:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.