Tag Info

Hot answers tagged

44

In a word: sufficient. This is block-level encryption, so it is filesystem-independent. Ubuntu's transparent encryption is done through dm-crypt using LUKS as the key setup. The built-in default for cryptsetup versions before 1.6.0 is aes-cbc-essiv:sha256 with 256-bit keys. The default for 1.6.0 and after (released 14-Jan-2013) is aes-xts-plain64:sha256 ...


37

The main obstacle of a TrueCrypt fork is the non-standard TrueCrypt license. While the intention of the authors seemed to be to write a share-alike license similar in spirit to the GPL, the license has a few quite unorthodox passages which can be interpreted in a way which puts unreasonable conditions on a fork. These conditions prevented the Open Source ...


27

The advantages are limited, but there are nonetheless scenarios where encryption helps. In any scenario where the attacker obtains the password¹ (with lead pipe cryptography, or far more realistically by reading the unlock pattern on the screen or brute force on the PIN), there is clearly no advantage to full disk encryption. So how could the attacker ...


25

For the determined attacker setup: The encryption technology used in Android 3 is dm-crypt. The relevant part here is the following: encryption uses a symmetric key, which is derived from the password/PIN typed by the user; the derivation parameters are stored in a LUKS-formatted block on the device itself. Password derivation is salted and uses many ...


20

There are a number of defenses you can use to help prevent and recover from theft. The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...


19

In a data center, disk encryption can be useful for handling old disks: when a disk fails, you can simply discard (recycle) it, because the data it may still contain is encrypted and cannot be recovered without the corresponding key (this assumes that the server has the encryption key somewhere on its "system" disk -- or some other device -- and that the ...


18

One benefit of full-disk encryption is that it makes wiping the flash storage very fast. All of the data stored on the device is stored encrypted under a particular encryption key K. The system also stores an encryption of K under the user's PIN. To wipe the entire drive, all you have to do is wipe the spot that stores the encryption of K (which is just ...


18

Before you read all this, remember that this technique is at least 5 years old -- it's probably much easier by now (see the other answers). (But it sure was fun to figure this all out.) I did this a few years ago with Fedora 10 and Windows Vista to demonstrate how all the intricacies fit together. It was a bit involved (mostly because Windows Vista doesn't ...


16

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? What is EFS? Folders on NTFS are encrypted with a specalized subset of NTFS called Encrypting File System(EFS). EFS is a file level encryption within NTFS. The folder is actually a specalized type of file which applies the same key to all files within the folder. NTFS on disk format ...


14

The standard approach is to fill the USB ports with epoxy resin. Of course, this must be combined with similar approaches to seal the case, so the attacker can't get in via the PCI bus, etc. Note that even if you do this, law 3 still applies: if a bad guy has unrestricted physical access to your computer, it's not your computer anymore. EDIT: reflecting ...


13

Modern research seems to indicate that performing a single zero-pass of a hard drive is sufficient for most data dispositions. In which case, no, performing a file or partition encryption would not be faster. Except in the case of hardware accelerated encryption (such as the newer Intel i series processors) encryption speed is CPU bound, whereas a single ...


12

A quick calculation: First my assumptions: I assume the attacker has $1,000,000 to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh. I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1 A ...


11

TrueCrypt is what you're looking for. Other (paid) solutions include PGP Desktop, and Jetico BestCrypt.


10

The whole idea of encryption is that it is meant to bring you confidentiality regardless of how the physical media is managed. Details about how a bit is "erased" (or fails to be erased) is relevant to security; encryption is about getting said security without having to bother with those details. It turns out that data on a SSD is a fickle thing and it is ...


10

Microsoft's 3rd immutable law: "If a bad guy has unrestricted physical access to your computer, it's not your computer anymore." So you have to trust the people running your data-centre. That's what trust means in information security: it's what you are reluctantly forced to do when you can't fully control, avoid, or transfer a risk. Still, you will want to ...


9

Not doing backups is crazy and scary given that your data is business/mission critical and not your movie collection. So whatever you do, backup your data. Consider the following scenario: you're performing the encryption and during the encryption process you have a power failure on the power grid. In that case you would will lose a lot, if not all your ...


9

Truecrypt, with an executable of the installer in the thumb drive (unencrypted ofc) so you can install it on any computer you plug your thumb drive. If it's possible encrypt with a pass in the form of HA&%^&G^ARELIBSFhahdjag62r&^^^5129380y. Drawback of this is that you'll have to carry another thumb drive with you to contain your password in ...


9

Don't do it! it's a bit too much data for backing it all up before encryption. This seems to indicate that you would only back up to protect against loss during encryption. Everyone is answering your question, but this the the elephant in the room. If you care about this data you need to back it up! Until you do that, don't even think about ...


9

Are there any scenarios I've missed? So my conclusion is that there is no point to enabling full device encryption on Android - a screen lock will do. Discuss! (I am quite happy to be proven wrong, I just can't see how there is a benefit to it) You forgot the possibility that the government can dump the contents of you storage/sim card/sd-card. ...


9

Using more than one layer of encryption adds more complexity and very little security. Modern encryption ciphers rarely suffer catastrophic failures but software implementations are not that perfect. Using multiple disk encryption tools may decrease your risk in case one of them will have a known flaw or backdoor that will make your stored data vulnerable. ...


8

I think that while @Scott is absolutely right - these days, unless you need a multi-pass for regulatory reasons wiping data is fast - the much simpler solution is to have the entire drive encrypted using a strong passphrase, then lose the passphrase when you need to destroy the data. Your risk will be around someone having a copy of that passphrase. Other ...


8

That's not entirely correct. If you use dm-crypt by itself (without LUKS) then no key information is stored on the disk, and the key is re-derived every time you enter the passphrase. This isn't really any different from loop-aes. Using dm-crypt With LUKS, your passphrase is used to encrypt the master key, and the encrypted master key is then written to ...


8

LVM operates below the filesystem, so whatever it does, it does so at the disk level. So yes, indeed, when LVM implements encryption this is "full-disk encryption" (or, more accurately, "full-partition encryption"). Applying encryption is fast when it is done upon creation: since the initial contents of the partition are ignored, they are not encrypted; ...


8

1) I think disk encryption makes sense for any kind of portable media that is easily lost or stolen. For example a USB drive that you use to transport information, or one that you backup your laptop to (e.g. a time machine backup for a Mac). There's going to be times when this drive and the source system are not in the same physical location, and the data ...


8

I would use KeepassX, which uses encrypted file via your password and optionally via key file and would not care about these theoretical problems.


8

The short answer is this: We have no idea, probably none. It might protect against stolen backups. But that assumes Amazon even makes backups. That seems very unlikely. If they did, why couldn't they recover data from their last S3 data loss? It's much cheaper and more efficient just to use multiple live copies. Also, Amazon would need the keys on every ...


8

The problem you describe is accurate. I have considered the same problem, and have come up with some "solutions" that can be helpful. Lets start by listing some possible attacks: Copy SSH keys from storage (offline attack) Memory dumping - Cold boot attack Console access DMA Attack Now, lets list some countermeasures. TPM - Ideally, you would store ...


7

Is the Apple solution equally secure as a TrueCrypt using the same encryption? Assuming that there is no "publicly known" security flaw within the file structure of the images created by said applications, the logical strength of said "container" would depend on the encryption algorithm utilized as well as the pass phrase implemented. Although, there ...



Only top voted, non community-wiki answers of a minimum length are eligible