New answers tagged

2

As with any security measure, this reduces the risk, it doesn't eliminate it. With no TPM, an attacker with physical access can just grab the disk, walk away and read the data at their leisure. If the disk is encrypted with a key in a TPM, the attacker needs to walk away with the whole computer (or at least pull out the RAM and store it safely, to try a RAM ...


1

TPM protects you from an attacker removing your hard drive and mounting it in another computer, or booting to another OS on the same computer. The pin protects you from an attacker logging into your computer directly.


0

In general, when you make a password that's "too long" for a system, what actually happens is that it gets truncated to the system's max length, then hashed, and the result of the hashing function(s) is used for authentication purposes. Therefore, the general approach to getting access when you created a password that's too long is to truncate the password ...


0

There are two ways to approach this, depending on just how inaccessible you want to make the data. If you simply want to require knowledge of the LUKS passphrase to regain access to the data (more or less the normal case, but expediated), then you can use cryptsetup luksSuspend on the dm-crypt device name. According to the man page, this: Suspends an ...


2

is it possible to extract the encryption key remotely via malware out off the ram memory, and if possible, how come that the law enforcement does not use this method instead of a cold boot attack? Of course it is possible. The malware requires to achieve privilege elevation ad access the encryption driver's memory; both things can be made difficult, but ...


5

Wiping the LUKS header would make the data completely irrecoverable, even if the password/encryption key is later discovered, since the passwords/keys used by LUKS merely encrypt a master key stored in the header and that master key actually encrypts the data. So first, deleting the first 2MBs of the device where the LUKS volume resides should make further ...


2

From what I understand about the information betrayed by observing results of TRIM operations on LUKS encrypted volumes, actual plain-text data is not likely to be recovered. As you say, filesystem and data layout information can be inferred. Rather, details on the crypto implementation could help an attacker reduce the key space in a brute-force attack. ...


2

You ought to be able to find something useful here (binaries and source included by r0m30 on github also). Up until recently, configuring these TCG Opal drives was only possible under Windows, or under Linux with a commercial solution that was not available to mere end-users. Fortunately, a programmer named r0m30 stepped up to the challenge and has ...


2

First of all: NO system is 100% safe, but using tpm is better than no tpm at all. TPM Chip is just some kind of encrypted storage, that resides on the motherboard of computers that support Trusted Plataform Environment, and have BIOSes prepared to handle it. PCR are registers with specific functions that are handled through the TPM_Extend operation. They ...


0

It notes on the same page you referenced that a temporary filesystem is loaded into /data, while the rest of the phone storage is encrypted. The purpose of this temporary file system is to perform the functions necessary to enable you to decrypt the phone, see a simple progress bar when decryption or to wipe the phone entirely. If you go to the section ...


0

ARM have a trusted computing implementation and some ARM licensees have their own solutions. This will allow you to encrypt your program and data both on disk and in memory, so no copying is possible without physically damaging the CPU. The issues is trusted computing technology requires a lot of integration work (from bootloader to application), which may ...


1

Here's a simple solution On first boot, require authentication from the server. Have a Username which is stored on the device. The server provides a password associated with that username. On later verification, send that password to the server. The server sends back a new password which is stored. The client acknowledges receipt of the new password. On ...


2

Your best bet would be a CD or DVD, as they are easy to use and easy to destroy (see below), with CDs being even easier to destroy because of the different data density. The main disadvantage is that they're bigger than a flash drive, and thus also harder to conceal, but I'm not sure if that's your problem. Anyway, if you don't fear X-rays, body scanners or ...



Top 50 recent answers are included