Tag Info

Hot answers tagged

54

In a word: sufficient. This is block-level encryption, so it is filesystem-independent. Ubuntu's transparent encryption is done through dm-crypt using LUKS as the key setup. The built-in default for cryptsetup versions before 1.6.0 is aes-cbc-essiv:sha256 with 256-bit keys. The default for 1.6.0 and after (released 14-Jan-2013) is aes-xts-plain64:sha256 ...


53

You’re misunderstanding what BitLocker is supposed to protect against. The goal of BitLocker is to protect your data from cold boot attacks (as explained in a Technet blog entry). When you unlock a volume protected by BitLocker, the system gains access to the keys necessary to decrypt the drive and behaves as if it was a regular drive. That is necessary to ...


47

Chip-based banking cards typically use a 4-digit PIN. It would take at most a few hours to try them all if the card didn't protect against brute force attempts. The card protects against brute force attempts by bricking itself after 3 consecutive failures. The adversary does not have access to a hash of the PIN (there are physical protections in the card ...


39

The main obstacle of a TrueCrypt fork is the non-standard TrueCrypt license. While the intention of the authors seemed to be to write a share-alike license similar in spirit to the GPL, the license has a few quite unorthodox passages which can be interpreted in a way which puts unreasonable conditions on a fork. These conditions prevented the Open Source ...


30

The advantages are limited, but there are nonetheless scenarios where encryption helps. In any scenario where the attacker obtains the password¹ (with lead pipe cryptography, or far more realistically by reading the unlock pattern on the screen or brute force on the PIN), there is clearly no advantage to full disk encryption. So how could the attacker ...


29

For the determined attacker setup: The encryption technology used in Android 3 is dm-crypt. The relevant part here is the following: encryption uses a symmetric key, which is derived from the password/PIN typed by the user; the derivation parameters are stored in a LUKS-formatted block on the device itself. Password derivation is salted and uses many ...


29

A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been ...


28

Your first question is really a legal one, and you seem to be assuming two things: The attacker is a government of some sort. That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys. Neither of those assumptions are necessarily true. For all you know, some ...


21

One benefit of full-disk encryption is that it makes wiping the flash storage very fast. All of the data stored on the device is stored encrypted under a particular encryption key K. The system also stores an encryption of K under the user's PIN. To wipe the entire drive, all you have to do is wipe the spot that stores the encryption of K (which is just ...


20

There are a number of defenses you can use to help prevent and recover from theft. The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...


20

It's (theoretically) harder to duplicate a Smart Card. You can duplicate a USB drive easily. If I steal both, you are equally in trouble, but if I steal the USB, duplicate it, then replace it without you knowing, then you are in trouble and you don't know it.


20

Once you enter your password the drive behaves just like any other unencrypted drive, as the encryption becomes transparent to the OS. If you share your drive and other users/computers have the required permissions to access it, they will be able to do so and won't even know the drive was encrypted. Full disk encryption is designed to protect from offline ...


19

Before you read all this, remember that this technique is at least 5 years old -- it's probably much easier by now (see the other answers). (But it sure was fun to figure this all out.) I did this a few years ago with Fedora 10 and Windows Vista to demonstrate how all the intricacies fit together. It was a bit involved (mostly because Windows Vista doesn't ...


19

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? What is EFS? Folders on NTFS are encrypted with a specalized subset of NTFS called Encrypting File System(EFS). EFS is a file level encryption within NTFS. The folder is actually a specalized type of file which applies the same key to all files within the folder. NTFS on disk format ...


19

In a data center, disk encryption can be useful for handling old disks: when a disk fails, you can simply discard (recycle) it, because the data it may still contain is encrypted and cannot be recovered without the corresponding key (this assumes that the server has the encryption key somewhere on its "system" disk -- or some other device -- and that the ...


18

You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...


14

Modern research seems to indicate that performing a single zero-pass of a hard drive is sufficient for most data dispositions. In which case, no, performing a file or partition encryption would not be faster. Except in the case of hardware accelerated encryption (such as the newer Intel i series processors) encryption speed is CPU bound, whereas a single ...


14

The standard approach is to fill the USB ports with epoxy resin. Of course, this must be combined with similar approaches to seal the case, so the attacker can't get in via the PCI bus, etc. Note that even if you do this, law 3 still applies: if a bad guy has unrestricted physical access to your computer, it's not your computer anymore. EDIT: reflecting ...


13

A quick calculation: First my assumptions: I assume the attacker has $1,000,000 to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh. I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1 A ...


11

Are there any scenarios I've missed? So my conclusion is that there is no point to enabling full device encryption on Android - a screen lock will do. Discuss! (I am quite happy to be proven wrong, I just can't see how there is a benefit to it) You forgot the possibility that the government can dump the contents of you storage/sim card/sd-card. ...


11

TrueCrypt is what you're looking for. Other (paid) solutions include PGP Desktop, and Jetico BestCrypt.


10

The whole idea of encryption is that it is meant to bring you confidentiality regardless of how the physical media is managed. Details about how a bit is "erased" (or fails to be erased) is relevant to security; encryption is about getting said security without having to bother with those details. It turns out that data on a SSD is a fickle thing and it is ...


10

LVM operates below the filesystem, so whatever it does, it does so at the disk level. So yes, indeed, when LVM implements encryption this is "full-disk encryption" (or, more accurately, "full-partition encryption"). Applying encryption is fast when it is done upon creation: since the initial contents of the partition are ignored, they are not encrypted; ...


10

Microsoft's 3rd immutable law: "If a bad guy has unrestricted physical access to your computer, it's not your computer anymore." So you have to trust the people running your data-centre. That's what trust means in information security: it's what you are reluctantly forced to do when you can't fully control, avoid, or transfer a risk. Still, you will want to ...


10

I would still choose TrueCrypt for a matter of trust and the "many eyes" theory: After the "TrueCrypt scandal" everyone started looking at the source for backdoors. Currently there is an audit going on for TrueCrypt. Although they haven't finished yet and they have found vulnerabilities on the bootloader-full-disk-encryption feature, there is no evidence ...


9

Not doing backups is crazy and scary given that your data is business/mission critical and not your movie collection. So whatever you do, backup your data. Consider the following scenario: you're performing the encryption and during the encryption process you have a power failure on the power grid. In that case you would will lose a lot, if not all your ...


9

Truecrypt, with an executable of the installer in the thumb drive (unencrypted ofc) so you can install it on any computer you plug your thumb drive. If it's possible encrypt with a pass in the form of HA&%^&G^ARELIBSFhahdjag62r&^^^5129380y. Drawback of this is that you'll have to carry another thumb drive with you to contain your password in ...


9

Don't do it! it's a bit too much data for backing it all up before encryption. This seems to indicate that you would only back up to protect against loss during encryption. Everyone is answering your question, but this the the elephant in the room. If you care about this data you need to back it up! Until you do that, don't even think about ...



Only top voted, non community-wiki answers of a minimum length are eligible