2

I need to set up full disk encryption on my linux laptop.

Questions:

  1. Does an encryption key on a USB pendrive protect against rubber-hose cryptanalysis?
  2. Is it true that the key on a pendrive is riskier than a password because someone can steal the USB key and access data without the need for the password?

My threat model is someone stealing my laptop rather than the FBI, government.

0

2 Answers 2

1

"rubber-hose cryptanalysis" implies that the password or key is known. So, by definition, if the key is not known, then storing the key protects against rubber-hose cryptanalysis.

A key stored on a pendrive exposes the risk of the key being physically stolen, yes, but whether it is "riskier" depends on what threats you are worried about. A stored key usually means that the password is very, very strong, stronger than one that someone could remember, and would be more secure than a remembered password. So, it really depends on what risks you want to mitigate.

1

Does an encryption key on a USB pendrive protect against rubber-hose cryptanalysis?

It changes the question from "What is your password?" to "Where is the USB pendrive with the key?". Depending on what security controls are protecting the pendrive, that might make a big difference or none at all.

Is it true that the key on a pendrive is riskier than a password because someone can steal the USB key and access data without the need for the password?

Really depends where and how you store the USB pendrive. If it's in the laptop case then that's probably less secure than a password would have been. If it's in a bank vault then that's probably a lot more secure. But equally, if the password is "Password1" or written on a post-it note stuck to your laptop, that's very different to it being a strong and unique one.

The use of a USB pendrive also introduces other risks (such as losing the pendrive or it failing - which would lock you out of your laptop), so you need to think about how you would manage those risks as well.


But to be honest, if your threat model is untargeted theft then there's probably not really a lot of difference between them. An opportunistic thief is unlikely to care about your data - they're just going to sell the laptop on. So as long as it has some encryption you're probably fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .