2

I'm considering setting up a hidden partition, but I'm becoming increasingly confused the more times I see it claimed that plausible deniability isn't effective. Under not-unusual circumstances, it seems suitable to me.

Perhaps I'm mistaken in my understanding, so here's the impression i have for how it works:

1) You encrypt your entire drive.

2) Within your encrypted drive, you partition off a smaller section as a "hidden" parititon. You put your secrets here. The hidden partition is a subset of random data within a drive full of random data. Even when the drive is decrypted, the hidden section just looks like free space.

Let's say, for the sake of example, that I live in the Notorious UK. The fuzz pull me in, open my laptop, and upon seeing it's encrypted, demand the password. If i deny I go to jail, so of course I give them the password - to the drive, but not the hidden partition.

At this point the claims seem to be that "everyone knows about hidden partitions", and that "if your adversary suspects there's more data, they can just keep rubber hosing you". That might be true in the most severe countries, but in places even a little more civilised I would expect them to need some indication that there's encrypted data present - they might be able to throw you in prison for refusing to give up keys to evidently encrypted data, but I doubt they can lock you up for refusing to give up further keys that may or may not exist, on the grounds that there could be more data, but with no evidence to support the claim that any does.

Edit:


tl;dr

Does a hidden partition provide plausible deniability in the face of an adversary that requires at least some justification for punishment? I believe it does, but have seen claims that it doesn't.

closed as unclear what you're asking by Steffen Ullrich, Bacon Brad, Tobi Nary, AJ Henderson, Steve Aug 30 '17 at 15:49

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • "..I would expect them to need some indication that there's encrypted data present..." - I think this is more a legal question, i.e. what rights you have or miss in various parts of the world to hide your data and what will happen to you if you refuse to cooperate like THEY want you. Therefore I'm voting to close this question as off-topic. – Steffen Ullrich Aug 29 '17 at 18:15
  • I've read it 5 times and I missing what the question is entirely. Are you asking if you should use a hidden partition? If it is a legal right? Does it work? It is really unclear what you are asking. – Bacon Brad Aug 29 '17 at 18:19
  • Another claim i've seen made: "if the size of your revealed partition doesn't match the capacity of your drive, it's a giveaway" At least for Truecrypt I thought that the outer partition does match the container size - the hidden partition is a subset of it, not an external part. Is this true for LUKS/dm-crypt? – Bob Aug 29 '17 at 18:24
  • @Steffen, i think closing the topic is a little closed minded. Call it context of the question, if you like. If you wish to claim that the investigator doesn't need any evidence to support the claim that there's more data, that's fine. To me it doesn't sound like it realistically represents all cases, though. I'd like to hear the opinions of others. – Bob Aug 29 '17 at 18:29
  • @BaconBrad - the question is, under the situation i've described, would a hidden partition successfully hide your data? It looks to me like a hidden partition is a perfect way to hide encrypted data from an adversary - perhaps the UK Gov't - that can't justify punishing you without some justification. Even if refusing to decrypt data is justification, a hidden partition would be safe. But i've seen many comments saying plausible deniability doesn't stand. – Bob Aug 29 '17 at 18:34
2

Assuming I understand the question correctly, you are asking if have an encrypted hidden partition on your device would be a good strategy for information hiding when the attacker is restricted by the bounds of the law, which can force you to decrypt the information, but only if they find it.

To me, this sounds like security through obscurity. It is the equivalent of having the information in a hidden folder with an innocuous name. If discovered they can force you to decrypt it so the encrypted part of it is entirely irrelevant. All they need to do it discover it.

Security through obscurity is a bad idea if you are looking for a truly secure way to store your information, but it would obviously make it take more effort to find the information. However, with security you must always assume as close to the worst as practical, so you would need to assume that they find it, but without a better option it may be better than nothing.

Note: In regards to the plausible deniability portion of your question, this sounds like a legal question about whether this would be considered intent to hinder the investigation (or whatever the legal terminology would be) and is outside the scope of this site.

  • It's an enlightening way to summarise it. I had the impression that plausible deniability was more than just security through obscurity, but what you say sounds right. In that light I suppose the question becomes "how readily can a hidden partition be shown to exist", but this is a technical question that depends on the rest of your setup and how much effort the government is willing to spend on it. – Bob Aug 29 '17 at 20:38
0

The legal questions are out of scope, but I'll take a shot at the technical.

"Deniability" like any other security question depends on your threat model. What is your adversary after, and what are they willing and capable of doing to get it. This will also inform the specifics of your technical control (e.g. which software you use to create your hidden partition).

The basic problem is as follows:

Either the hidden partition shows up as space "Reserved" by your encrypted, non-secret drive, in which case it reveals its presence indirectly, or it really is treated as "empty" space, which means it could get overwritten legitimately by the OS. So if your non-secret, encrypted drive is a 'dummy' it won't overwrite your hidden secret stuff, but all the file time stamps will show you haven't been actively using it, hence, it isn't your "real" working system. Or, you do use it, and run the risk of over-writing your hidden "free space."

You have to choose one or the other.

But going back to threat models, if, as in your example, you are picked up for some other violation and made to decrypt your computer as part of an investigation, you have to figure out how intensely your computer would be scrutinized. If they are looking for evidence of a computer crime they have reason to believe (from other sources) is on your device, plausible deniability probably won't work.

But if they are searching for evidence of a non-computer crime (e.g. emails in a divorce case about cheating spouse) then your hidden drive would probably go un-noticed.

So, as always, "it depends".

  • Thanks for the input Jesse. Maybe the question is more legal than i'd realised - how 'plausible' would a gov't find it that, in the event that your decrypted drive reveals nothing incriminating, there isn't a hidden partition. Is the inability to prove the existance of such a partition sufficient to protect you? I guess you're right, it depends on how much reason they have to suspect one. Perhaps this question was more suitable for lawyers.stackexchange.com – Bob Aug 29 '17 at 20:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.