Tag Info

Hot answers tagged

53

In a word: sufficient. This is block-level encryption, so it is filesystem-independent. Ubuntu's transparent encryption is done through dm-crypt using LUKS as the key setup. The built-in default for cryptsetup versions before 1.6.0 is aes-cbc-essiv:sha256 with 256-bit keys. The default for 1.6.0 and after (released 14-Jan-2013) is aes-xts-plain64:sha256 ...


39

The main obstacle of a TrueCrypt fork is the non-standard TrueCrypt license. While the intention of the authors seemed to be to write a share-alike license similar in spirit to the GPL, the license has a few quite unorthodox passages which can be interpreted in a way which puts unreasonable conditions on a fork. These conditions prevented the Open Source ...


30

The advantages are limited, but there are nonetheless scenarios where encryption helps. In any scenario where the attacker obtains the password┬╣ (with lead pipe cryptography, or far more realistically by reading the unlock pattern on the screen or brute force on the PIN), there is clearly no advantage to full disk encryption. So how could the attacker ...


29

For the determined attacker setup: The encryption technology used in Android 3 is dm-crypt. The relevant part here is the following: encryption uses a symmetric key, which is derived from the password/PIN typed by the user; the derivation parameters are stored in a LUKS-formatted block on the device itself. Password derivation is salted and uses many ...


29

A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been ...


21

One benefit of full-disk encryption is that it makes wiping the flash storage very fast. All of the data stored on the device is stored encrypted under a particular encryption key K. The system also stores an encryption of K under the user's PIN. To wipe the entire drive, all you have to do is wipe the spot that stores the encryption of K (which is just ...


20

There are a number of defenses you can use to help prevent and recover from theft. The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...


20

It's (theoretically) harder to duplicate a Smart Card. You can duplicate a USB drive easily. If I steal both, you are equally in trouble, but if I steal the USB, duplicate it, then replace it without you knowing, then you are in trouble and you don't know it.


19

Before you read all this, remember that this technique is at least 5 years old -- it's probably much easier by now (see the other answers). (But it sure was fun to figure this all out.) I did this a few years ago with Fedora 10 and Windows Vista to demonstrate how all the intricacies fit together. It was a bit involved (mostly because Windows Vista doesn't ...


19

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? What is EFS? Folders on NTFS are encrypted with a specalized subset of NTFS called Encrypting File System(EFS). EFS is a file level encryption within NTFS. The folder is actually a specalized type of file which applies the same key to all files within the folder. NTFS on disk format ...


19

In a data center, disk encryption can be useful for handling old disks: when a disk fails, you can simply discard (recycle) it, because the data it may still contain is encrypted and cannot be recovered without the corresponding key (this assumes that the server has the encryption key somewhere on its "system" disk -- or some other device -- and that the ...


16

Your first question is really a legal one, and you seem to be assuming two things: The attacker is a government of some sort. That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys. Neither of those assumptions are necessarily true. For all you know, some ...


14

Modern research seems to indicate that performing a single zero-pass of a hard drive is sufficient for most data dispositions. In which case, no, performing a file or partition encryption would not be faster. Except in the case of hardware accelerated encryption (such as the newer Intel i series processors) encryption speed is CPU bound, whereas a single ...


14

The standard approach is to fill the USB ports with epoxy resin. Of course, this must be combined with similar approaches to seal the case, so the attacker can't get in via the PCI bus, etc. Note that even if you do this, law 3 still applies: if a bad guy has unrestricted physical access to your computer, it's not your computer anymore. EDIT: reflecting ...


14

You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...


13

A quick calculation: First my assumptions: I assume the attacker has $1,000,000 to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh. I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1 A ...


11

Are there any scenarios I've missed? So my conclusion is that there is no point to enabling full device encryption on Android - a screen lock will do. Discuss! (I am quite happy to be proven wrong, I just can't see how there is a benefit to it) You forgot the possibility that the government can dump the contents of you storage/sim card/sd-card. ...


11

TrueCrypt is what you're looking for. Other (paid) solutions include PGP Desktop, and Jetico BestCrypt.


10

The whole idea of encryption is that it is meant to bring you confidentiality regardless of how the physical media is managed. Details about how a bit is "erased" (or fails to be erased) is relevant to security; encryption is about getting said security without having to bother with those details. It turns out that data on a SSD is a fickle thing and it is ...


10

LVM operates below the filesystem, so whatever it does, it does so at the disk level. So yes, indeed, when LVM implements encryption this is "full-disk encryption" (or, more accurately, "full-partition encryption"). Applying encryption is fast when it is done upon creation: since the initial contents of the partition are ignored, they are not encrypted; ...


10

Microsoft's 3rd immutable law: "If a bad guy has unrestricted physical access to your computer, it's not your computer anymore." So you have to trust the people running your data-centre. That's what trust means in information security: it's what you are reluctantly forced to do when you can't fully control, avoid, or transfer a risk. Still, you will want to ...


9

Not doing backups is crazy and scary given that your data is business/mission critical and not your movie collection. So whatever you do, backup your data. Consider the following scenario: you're performing the encryption and during the encryption process you have a power failure on the power grid. In that case you would will lose a lot, if not all your ...


9

Truecrypt, with an executable of the installer in the thumb drive (unencrypted ofc) so you can install it on any computer you plug your thumb drive. If it's possible encrypt with a pass in the form of HA&%^&G^ARELIBSFhahdjag62r&^^^5129380y. Drawback of this is that you'll have to carry another thumb drive with you to contain your password in ...


9

Don't do it! it's a bit too much data for backing it all up before encryption. This seems to indicate that you would only back up to protect against loss during encryption. Everyone is answering your question, but this the the elephant in the room. If you care about this data you need to back it up! Until you do that, don't even think about ...


9

If you live in the US and have access to PII (personally identifiable information), PHI (protected health information), or confidential data covered by contract NDA. Federal/state regulation, as well as insurer or business associate agreements may require encryption of an endpoint devices even in cases where they don't directly contain pertinent data. ...


9

The short answer is this: We have no idea, probably none. It might protect against stolen backups. But that assumes Amazon even makes backups. That seems very unlikely. If they did, why couldn't they recover data from their last S3 data loss? It's much cheaper and more efficient just to use multiple live copies. Also, Amazon would need the keys on every ...


9

Using more than one layer of encryption adds more complexity and very little security. Modern encryption ciphers rarely suffer catastrophic failures but software implementations are not that perfect. Using multiple disk encryption tools may decrease your risk in case one of them will have a known flaw or backdoor that will make your stored data vulnerable. ...


9

Android uses dm-crypt for disk encryption, and it is available since Android 3. And as you would know dm-crypt works at block device layer. So storage like YAFFS which works directly at nand flash chip level would not allow you to encrypt. But all other storage (which can be read block by block) can be encrypted. Yes, both device and external sd cards can ...



Only top voted, non community-wiki answers of a minimum length are eligible