4

Title says it all really.

I'm toying with the idea of storing some disk images in "the cloud", but am concerned about the possibility of an attacker manipulating cipertext to do evil things once it's decrypted, and so I'd like a system that authenticates the ciphertext and assures me it has not been tampered with.

I understand that this will require a (small?) amount of local, non-cloud storage, which is a cost I'm prepared to pay.

I haven't been able to find any off-the-shelf packages that do this (or maybe I just don't know how to do it with existing tools). Can anyone point me in the right direction?

I will have call to read disks from Linux and Windows (seperately, ie, windows images and linux images).

Improve this question
4
  • I'm not really clear what you are asking for. You are concerned that your cloud image might be tampered with? The answer depends on how you are accessing the information. Mounting the cloud image or replicating to a local machine and then mounting.
    – Julian Knight
    Apr 9, 2015 at 16:17
  • 1
    An example scenario is that I keep an encrypted disk image on a VPS, and the hosting provider is compromised, and an attacker can read and write the image. Then, I download the image, and mount it. However, an attacker has modified the image such that when I boot from the image, some kind of malware is loaded from the disk/partition boot sector prior to the OS being loaded. Does that help?
    – randomdude
    Apr 9, 2015 at 16:59
  • Are you looking for product recommendations? Or are you looking for information about how such a system could be designed, and what the challenges in designing such a system are? The former I cannot help with, the later I could say something about.
    – kasperd
    May 9, 2015 at 20:25
  • 1
    Ideally I was asking for product recommendations. I'd also be interested to hear how such a system could be designed, though.
    – randomdude
    May 10, 2015 at 20:45

4 Answers 4

Reset to default
3

From your example, I think the answer is pretty straightforward. I think there are several ways to do it depending on your preferred workflow but the simplest is probably...

When you update the image, take a hash of the image before uploading it. Then, when you download it, check the hash before use.

Of course, that is only reasonable if you don't update the image that often. Otherwise, you need to automate the workflow.

More specifics depend on what OS you are using the image on. The good news is that, since you have control of the hash, you probably don't need to worry too much about which hashing algorithm you use. Some have known flaws but I think that, in this case, that probably won't worry you too much.

You could go further and digitally sign the image and there are certainly tools that will do this for you. Have a look at some of the forensic disk copiers. Using such a tool will give you a very high degree of confidence that the data has not been altered.

Improve this answer
0

Well, If I seeing things right, you posed two questions:

  1. What options exist for authenticated full-disk encryption?
  2. How can I securely store disk images in the cloud?

Now to answer your questions:

  1. There's no such thing as authenticated full-disk encryption (FDE). FDE needs you to have random access to every single sector on the drive, so you'd have to authenticate every single sector, to keep somewhat nice performance. This would mean you'd reduce the amount of storage to the user by 10 to 50%, which is considered inacceptable, so there's no product out there doing this. All products rely on "poor-man's authentication" to ensure integrity, meaning if you alter some data, the block will be scrambled and the OS / the application would notice that and give an alert.
  2. If you need highly random access, you either have to write your own tool, providing you with the authentication you need (AES-GCM) (on blocklevel) or you have to live with poor-man's authentication.
    If you only need somewhat random access, you can split the image into chunks of 100-1000MB and encrypting and authenticating each of them (AES-GCM), so that you still have authentication, but you'd need much larger chunks to download (which is OK for backups I guess).
    I'm not aware of any products providing this functionality. However you can do this yourself, or you may can use ZFS file system with SHA-256 integrity checking and encryption, that should work.

I hope this helps you.

Improve this answer
0

Let me first gather your requirements and assumptions:

  1. Data storage appears in the system as a mountable disk
  2. All data on data storage is encrypted
  3. Synchronization with cloud is not needed frequently. Complete image upload/download is good enough

With this assumptions any virtual disk solution with encryption of stored data can meet your requirements. One of the most famous products here that runs both on Windows and Linux is TrueCrypt. Unfortunately it was discontinued recently but some forks are alive (e.g. Veracrypt)

There is also a native solution for Windows. You can use build-in VHD Containers + BitLocker encryption (link).

I'm not so familiar with native Linux solutions. You can look over encryption layer over file system EncFS (link). It encrypts files in folder that can be synced with cloud storage. Alternatively, there is some virtual disk approach using dm-crypt and LUKS (link).

Improve this answer
2
  • 1
    They don't authenticate the encrypted data, though. An attacker could modify the encrypted data, without knowing the decryption key, to create a specific payload in the disk image (so, for example, changing the VBR to something malicious).
    – randomdude
    Jul 7, 2015 at 3:09
  • -1, this is not secure without a MAC: en.wikipedia.org/wiki/Malleability_(cryptography)
    – Navin
    Dec 1, 2017 at 10:32
0

So it seems that BSD's GELI provides this - from the manpage:

Can optionally perform data authentication (integrity verifica-
       tion) utilizing one of the following algorithms: HMAC/MD5,
       HMAC/SHA1, HMAC/RIPEMD160, HMAC/SHA256, HMAC/SHA384 or
       HMAC/SHA512.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .