Tag Info

New answers tagged

0

Generally on a computer, software encryption often runs on shared architecture such as your computers CPU. True hardware encryption would run on something like a Secure Cryptoprocessor or similar dedicated chipset. This can help isolate secure procedures from the rest of the system and often have architecture to very quickly run the needed calculations. ...


1

Ultimately, there is no difference: both "type" of encryption will end up running some software on top of some hardware so this is mostly a marketing argument. How an encryption stack works exactly depends, of course, from case to case and it is very important to review the details. For instance, some hard drive will implement some encryption layer in the ...


0

Hardware based encryption has several advantages: Speed - hardware encryption works much more faster than software one. Independence - it's independent from host system - OS, drivers, etc. Separate processor for number generation is also big plus. Security - More secure against malware, brute force attacks, cold boot attack, etc.


2

From what I can find on Sophos website, it looks like the encryption keys and revelant certificates are stored on a mssql database which holds the information. The SafeGuard Enterprise Database(s) hold all relevant data such as keys/certificates, information about users and computers, events and policy settings. The database(s) need to be accessed ...


2

The answers you're looking for can be found in the Cryptsetup documentation, but to summarize: LUKS uses PBKDF2 to derive a "slot key" from your password, with a default iteration count sufficient to take one second on the computer that created the LUKS volume. This "slot key" is unrelated to the key used to encrypt your data. It is only used to decrypt a ...


0

You could make use of the secure boot feature present in many computers, if the netbook does support it and the manufacturer hasn't locked it to Microsoft Boot Keys. What you could do then, is clearing the Secure Boot key database, and then making your own signing key and installing in the BIOS as PK (Platform Key) and KEK (Key Exchange Key). After this, ...


0

Not a direct answer to your question...but the following would be cumbersome as a comment/without formatting. Based on the link you provided, the exploit you want to prevent is essentially 'malicious alteration of initrd.img by someone with physical access to the hard drive'. Since you plan to move /boot to a USB stick, initrd.img will no longer be on the ...


3

I doubt this is possible to set up in the BIOS. However, even if it was, you have a bigger issue: The only way to identify a USB device is by its vendor and device ID. However, all devices by a specific vendor share the same device ID. So even if you could whitelist your own USB, any USB of that same make would also be accepted. Also, I'm pretty sure it's ...



Top 50 recent answers are included