Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

Filter by
Sorted by
Tagged with
11
votes
1answer
4k views

Why is it possible to bypass Android full disk encryption?

If you look up how to bypass the Android lock screen, there seems to be endless examples. plug the phone into your PC, use ADB (Android debugging tools), disable the lock screen forgot password ...
0
votes
2answers
57 views

Encryption of Long-term M-Discs - Good or Bad?

Some experts opine that long-term storage discs should not be encrypted because 30 years from now, there is a very high probability that the password will be lost. I think this is a very valid point. ...
0
votes
0answers
56 views

Can I completely wipe an SSD using encryption?

My system drive on my dekstop is a Sandisk SSD, with default encryption through Bitlocker not enabled. My PC doesn't have a TPM. I want to completely wipe the SSD data in order to make it ...
0
votes
0answers
7 views

How to encrypt a usb drive which already has data on it [migrated]

There is an external hard drive of almost 1Tb which has about 650Gb of data on it, the external HD is connected to computers via USB interface. As far as I'm aware, this external HD is for all intents ...
1
vote
0answers
41 views

Entered FDE password in GRUB by mistake

For several reasons (I have an external monitor, etc.) when I booted the laptop I typed the FDE (Full Disk Encryption on Linux, LUKS) without looking at the monitor, and I ended up typing the full ...
0
votes
0answers
42 views

Defending against key recovery from RAM attack

After reading an article from a forensics software company. I'm worried about attacks that may be able to recovery the OTFE(on-the-fly encryption) key of VeraCrypt from RAM. Thereat model: On Windows,...
1
vote
2answers
152 views

Is a BIOS password enough to prevent someone from hacking into my laptop if they have physical access?

Would my laptop be secure against physical access if I set up a bios password and full disk encryption ? If not then is there any way to secure your laptop from someone with physical access? How hard ...
1
vote
2answers
121 views

How is the Veracrypt decryption speed faster than simply duplicating the same data?

I'm thinking of installing Veracrypt and I read that it takes Veracrypt about 5 minutes to decrypt a 500 gig SSD. How is this possible? It takes me much longer to duplicate the same 500 gigs on my ...
1
vote
2answers
63 views

What is the name of the crypto system used by ICANN's DNS recovery system?

I once heard about a type of crypto system that behaves in the following way: I have x secret keys that work together to decrypt messages encrypted with a public key d. If I get at least n of the x ...
3
votes
3answers
298 views

How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?

I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
2
votes
1answer
85 views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
0
votes
1answer
64 views

Decrypting a BitLockered USB drive [duplicate]

I have encrypted a USB drive with BitLocker and I have lost the password and the hash backup. I have tried to search for something to decrypt the drive but came short. I have imaged the USB drive and ...
0
votes
0answers
92 views

Why doesn't the PIN become part of the encryption key in bitlocker with TPM?

TPM is a fantastic addition to motherboards. But I have read here some bitlocker papers and they tell me that if you choose TPM + PIN protection, then the PIN does not become part of the key, it is ...
2
votes
1answer
279 views

How secure is BitLocker without TPM?

My laptop doesn't have TPM. If I enable BL PIN and someone steals my laptop and remove the drive, will they be able to read it's content on another computer? How am I vulnerable without TPM?
1
vote
0answers
50 views

TPM & Windows BitLocker: how does it work and is it secure?

When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
46
votes
4answers
14k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
1
vote
0answers
32 views

Is it possible to adjust the header size in eCryptfs?

If I understand it correctly, eCryptfs creates a file in the "lower" directory whose content is a header, plus the encryption of the file in the "upper" directory. But when I create an empty file in ...
0
votes
1answer
63 views

How I can encrypt Windows if I use a SSD and HDD?

I need to encrypt my Windows Disks with full disk encryption. Windows is already installed and all drives have data. My Drives/Disks: 1 SSD - C: drive 1 HDD - D: drive and I have a drive where Linux ...
0
votes
1answer
74 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
0
votes
0answers
35 views

Can KDF mitigate rekeying requirement for XTS?

In NIST-800-57-1 it is implied that a key derived from a KDF, is as good as a key derived from a real CSPRNG, in 8.2.4(2): If the keyderivation key is known by an adversary, he can generate any ...
0
votes
1answer
96 views

Unrecoverable information in HDD

A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (...
1
vote
1answer
150 views

LUKS - Too large detached header size when large offset

I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug I would like to achieve a very large LUKS offset without resulting in a very bulky detached header ...
0
votes
0answers
27 views

When using Encryption that produces random memory/storage can you randomly input memory/data that reads as known file types?

I refer to this question's answer, the second part mentioning the random data, and no headers or anything, including files that are recognizable. Reading the answer just made me think adding random ...
2
votes
1answer
121 views

Storing LUKS master key in SGX enclave

Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
1
vote
1answer
74 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
1
vote
1answer
118 views

What is a LUKS cipher-name “@”?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
1
vote
1answer
376 views

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
1
vote
1answer
80 views

Stealing Veracrypt or LUKS hash while system running?

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
1
vote
2answers
93 views

How to set up full disk file encryption?

I want to set up my company's laptops in a way that all files created on these laptops can only be read by these laptops. If it is copied to a USB then that file is only readable when plugging that ...
0
votes
1answer
121 views

Is it secure to set the encryption password the same as the root password? [duplicate]

When installing Manjaro Linux, it shows the following screen: What's the logic behind that?
0
votes
0answers
142 views

Possible to restore LUKS header from partition that uses the exact same password and keyfile?

I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
2
votes
1answer
109 views

How can I know if a USB drive is fully encrypted?

When a fully encryped USB drive is connected to a computer, the OS says this USB drive is not formatted. How can I verify that a USB drive is fully encrypted while still being formatted? Is there a ...
2
votes
0answers
55 views

How challenge response password recovery mechanism works with disk encryption?

For the sole purpose of learning, I am trying to figure out how disk encryption software is able to recover password of an encrypted disk using a challenge response mechanism. Th recovery process ...
3
votes
3answers
164 views

Should operating system passwords be complex if full disk encryption is used that has a complex passphrase?

If a device uses full disk encryption such as LUKS, BitLocker (with a pin), Veracrypt and others and boots using a complex password, what is the need for complex passwords to log into the operating ...
0
votes
1answer
740 views

Is Android encryption secure? [duplicate]

As far as I know Android (Pie) is encrypted by default with some hardware-based password. But how secure is this encryption? I am not talking about password compromise, but if somebody gets my phone,...
1
vote
1answer
206 views

Is an encrypted hard drive immune from malware if it is not mounted when using a LiveCD?

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD? The use case is that ...
2
votes
1answer
87 views

Strategies to protect SANs in branch offices in risky places

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
0
votes
1answer
102 views

Have I used LUKS properly?

I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD. I am using Linux Mint and LUKS. Could someone please ...
2
votes
0answers
70 views

Disk encryption with automatic reboot and no-network [duplicate]

I am using crytsetup with LUKS to encrypt a data drive, separate to the system drive, under Ubuntu 16.04. The issue I am facing is that this system will also be required to automatically start itself ...
0
votes
0answers
55 views

Hashed password vs key, full-disk encryption

In the case of FDE, I understand that the user defined password is ran through a hashing algorithm such as SHA-512 (often with a random SALT and a high iteration count to act as a countermeasure for ...
0
votes
0answers
66 views

Implementing encryption at rest on a remote virtual file system

Imagine I had a virtual file system that I am using to store some data (similar to an FTP). I am trying to figure out a scheme where I can implement encryption at rest for the files local to the file ...
2
votes
1answer
93 views

What makes drive encryption safe?

Let's build a scene: I'm working on my laptop in the library, and while I'm gone to the toilet for 5 minutes, someone disassembled my laptop and took the hard drive. I encrypted it with VeraCrypt, so ...
1
vote
1answer
474 views

SSD Hardware Encryption versus Software Encryption

I was looking to purchase a new SSD and want to use it to store sensitive data, that I would not want people to steal or access. Have been trying to research it and only read bad things about ...
4
votes
0answers
81 views

How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?

I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
1
vote
1answer
98 views

I got my drive “bitlocker encrypted” by enterprise admins. Will this prevent me to share docs with my collaborators?

I admit I don't fully understand the level of encryption bitlocker does. I use Windows 10 and only have a C: drive which just got encrypted per the company policies. Will this hinder my ability to ...
20
votes
5answers
4k views

How to use FDE without needing to share the encryption password

We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04. The UI is ...
2
votes
1answer
82 views

Effect of FDE for data recovery

Assume that I fully encrypt an unused USB (FDE), then format it and copy plaintext files. If the files are deleted from USB by using a secure wipe, does FDE that was first applied decrease the ...
0
votes
0answers
24 views

Encrypted Container for Azure WebApps

I am considering moving an application - which currently sits on a Bitlocker-encrypted Windows Server - to a Microsoft Azure WebApps Linux Container. As far as I understand, encryption of the ...
2
votes
1answer
74 views

RAID + IEEE1667 + TPM + UEFI

Windows Server using a IEEE-1667 drive allows hardware based encryption on the fly. What are our options when using two disks with a RAID controller, in order to achieve redundancy and parity (T10-...
0
votes
0answers
41 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...

1
2 3 4 5
11