Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

Filter by
Sorted by
Tagged with
2
votes
1answer
72 views

How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?

I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
2
votes
1answer
47 views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
0
votes
1answer
54 views

Decrypting a BitLockered USB drive [duplicate]

I have encrypted a USB drive with BitLocker and I have lost the password and the hash backup. I have tried to search for something to decrypt the drive but came short. I have imaged the USB drive and ...
0
votes
0answers
87 views

Why doesn't the PIN become part of the encryption key in bitlocker with TPM?

TPM is a fantastic addition to motherboards. But I have read here some bitlocker papers and they tell me that if you choose TPM + PIN protection, then the PIN does not become part of the key, it is ...
2
votes
1answer
114 views

How secure is BitLocker without TPM?

My laptop doesn't have TPM. If I enable BL PIN and someone steals my laptop and remove the drive, will they be able to read it's content on another computer? How am I vulnerable without TPM?
1
vote
0answers
43 views

TPM & Windows BitLocker: how does it work and is it secure?

When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
46
votes
4answers
13k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
1
vote
0answers
31 views

Is it possible to adjust the header size in eCryptfs?

If I understand it correctly, eCryptfs creates a file in the "lower" directory whose content is a header, plus the encryption of the file in the "upper" directory. But when I create an empty file in ...
0
votes
1answer
53 views

How I can encrypt Windows if I use a SSD and HDD?

I need to encrypt my Windows Disks with full disk encryption. Windows is already installed and all drives have data. My Drives/Disks: 1 SSD - C: drive 1 HDD - D: drive and I have a drive where Linux ...
0
votes
1answer
74 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
0
votes
0answers
29 views

Can KDF mitigate rekeying requirement for XTS?

In NIST-800-57-1 it is implied that a key derived from a KDF, is as good as a key derived from a real CSPRNG, in 8.2.4(2): If the keyderivation key is known by an adversary, he can generate any ...
0
votes
1answer
81 views

Unrecoverable information in HDD

A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (...
1
vote
1answer
119 views

LUKS - Too large detached header size when large offset

I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug I would like to achieve a very large LUKS offset without resulting in a very bulky detached header ...
0
votes
0answers
27 views

When using Encryption that produces random memory/storage can you randomly input memory/data that reads as known file types?

I refer to this question's answer, the second part mentioning the random data, and no headers or anything, including files that are recognizable. Reading the answer just made me think adding random ...
2
votes
1answer
90 views

Storing LUKS master key in SGX enclave

Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
1
vote
1answer
64 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
1
vote
1answer
108 views

What is a LUKS cipher-name “@”?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
0
votes
1answer
148 views

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
1
vote
1answer
72 views

Stealing Veracrypt or LUKS hash while system running?

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
1
vote
2answers
92 views

How to set up full disk file encryption?

I want to set up my company's laptops in a way that all files created on these laptops can only be read by these laptops. If it is copied to a USB then that file is only readable when plugging that ...
0
votes
1answer
113 views

Is it secure to set the encryption password the same as the root password? [duplicate]

When installing Manjaro Linux, it shows the following screen: What's the logic behind that?
0
votes
0answers
113 views

Possible to restore LUKS header from partition that uses the exact same password and keyfile?

I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
2
votes
1answer
92 views

How can I know if a USB drive is fully encrypted?

When a fully encryped USB drive is connected to a computer, the OS says this USB drive is not formatted. How can I verify that a USB drive is fully encrypted while still being formatted? Is there a ...
2
votes
0answers
52 views

How challenge response password recovery mechanism works with disk encryption?

For the sole purpose of learning, I am trying to figure out how disk encryption software is able to recover password of an encrypted disk using a challenge response mechanism. Th recovery process ...
3
votes
3answers
157 views

Should operating system passwords be complex if full disk encryption is used that has a complex passphrase?

If a device uses full disk encryption such as LUKS, BitLocker (with a pin), Veracrypt and others and boots using a complex password, what is the need for complex passwords to log into the operating ...
0
votes
1answer
486 views

Is Android encryption secure? [duplicate]

As far as I know Android (Pie) is encrypted by default with some hardware-based password. But how secure is this encryption? I am not talking about password compromise, but if somebody gets my phone,...
1
vote
1answer
195 views

Is an encrypted hard drive immune from malware if it is not mounted when using a LiveCD?

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD? The use case is that ...
2
votes
1answer
83 views

Strategies to protect SANs in branch offices in risky places

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
0
votes
1answer
101 views

Have I used LUKS properly?

I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD. I am using Linux Mint and LUKS. Could someone please ...
2
votes
0answers
70 views

Disk encryption with automatic reboot and no-network [duplicate]

I am using crytsetup with LUKS to encrypt a data drive, separate to the system drive, under Ubuntu 16.04. The issue I am facing is that this system will also be required to automatically start itself ...
0
votes
0answers
51 views

Hashed password vs key, full-disk encryption

In the case of FDE, I understand that the user defined password is ran through a hashing algorithm such as SHA-512 (often with a random SALT and a high iteration count to act as a countermeasure for ...
0
votes
0answers
59 views

Implementing encryption at rest on a remote virtual file system

Imagine I had a virtual file system that I am using to store some data (similar to an FTP). I am trying to figure out a scheme where I can implement encryption at rest for the files local to the file ...
2
votes
1answer
87 views

What makes drive encryption safe?

Let's build a scene: I'm working on my laptop in the library, and while I'm gone to the toilet for 5 minutes, someone disassembled my laptop and took the hard drive. I encrypted it with VeraCrypt, so ...
1
vote
1answer
345 views

SSD Hardware Encryption versus Software Encryption

I was looking to purchase a new SSD and want to use it to store sensitive data, that I would not want people to steal or access. Have been trying to research it and only read bad things about ...
4
votes
0answers
79 views

How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?

I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
1
vote
1answer
98 views

I got my drive “bitlocker encrypted” by enterprise admins. Will this prevent me to share docs with my collaborators?

I admit I don't fully understand the level of encryption bitlocker does. I use Windows 10 and only have a C: drive which just got encrypted per the company policies. Will this hinder my ability to ...
20
votes
5answers
4k views

How to use FDE without needing to share the encryption password

We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04. The UI is ...
2
votes
1answer
78 views

Effect of FDE for data recovery

Assume that I fully encrypt an unused USB (FDE), then format it and copy plaintext files. If the files are deleted from USB by using a secure wipe, does FDE that was first applied decrease the ...
0
votes
0answers
24 views

Encrypted Container for Azure WebApps

I am considering moving an application - which currently sits on a Bitlocker-encrypted Windows Server - to a Microsoft Azure WebApps Linux Container. As far as I understand, encryption of the ...
2
votes
1answer
69 views

RAID + IEEE1667 + TPM + UEFI

Windows Server using a IEEE-1667 drive allows hardware based encryption on the fly. What are our options when using two disks with a RAID controller, in order to achieve redundancy and parity (T10-...
0
votes
0answers
42 views

Self encrypting drive without ATA password

Kind of new to this area so correct me if I am wrong. Based on my reading self encrypting drive will encrypt and decrypt all data in your disk and this process is totally transparent to the user. ...
0
votes
0answers
38 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
2
votes
2answers
121 views

Security risk of copying

I need to back up an encrypted drive, if the data gets corrupted I'd have another copy I don't have another drive that I trust not to have been compromised right now. My idea is to copy an encrypted ...
2
votes
0answers
390 views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
16
votes
2answers
1k views

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10....
46
votes
8answers
10k views

How to prevent a hosting company from accessing a VM's encryption keys?

I want to prevent potential theft of my web application (source code + database) by my local hosting company, that I don't fully trust for some reason (but have no other choice but to use as they give,...
0
votes
1answer
187 views

What's a good encryption method available for external hdd's, ext4? [closed]

I've been reading about encryption methods and see things like 'ecryptfs', 'veracrypt', 'LUKS' that "military grade encryption" is basically 256-AES encryption. I have data on an external hdd - can'...
0
votes
2answers
379 views

Bitlocker/Filevault and VeraCrypt together?

I'm researching ways to make the most secure encryption for additional fixed drives to protect against unknown vulnerabilities, side channel attacks, etc. Basically, securing the data beyond just a ...
0
votes
3answers
174 views

How sufficient are these steps to prevent deleted SSD files from being recovered?

I'm selling a 4-year-old Dell PC with Windows 10 and two SSDs and I want to be sure that nobody can recover anything from my personal deleted files. So far I've done the following. Completely ...
0
votes
0answers
46 views

Non-obvious Mitigations for This DMA-Attack Demonstrated by F-Secure

Are there any non-obvious mitigations for the big DMA-attack revealed last year and demonstrated in this video by F-Secure? We know that Microsoft has published some material pertaining to DMA-...

1
2 3 4 5
11