Questions tagged [disk-encryption]
Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).
604
questions
1
vote
0
answers
12
views
LUKS: How many iterations are enough?
The luksFormat command accepts iteration time as a parameter, not iterations. That obviously leads to quite different number of iterations depending on the hardware doing the encryption. However if ...
- 395
0
votes
0
answers
45
views
Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data
When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
- 163
0
votes
0
answers
28
views
PCR to prevent TPM2 key unsealing in case of rogue DMA devices connected?
Security threat: physical theft of a laptop and a server that use TPM2 auto unlock FDE with LUKS. In both cases the TPM checks against some PCRs before unsealing the key. The laptop prompts for a TPM ...
- 63
0
votes
0
answers
20
views
Is specifying resume_offset for hybernation to LUKS-encrypted drive safe?
I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
- 23
1
vote
1
answer
151
views
What are the risks of reusing the same passphrase for FDE, user account, and password manager?
Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
- 123
0
votes
0
answers
86
views
Advice on encryption setup
I've been trying to get a reliable, and decently secure setup on a device for a little while now, and I feel like I may be overthinking some things but I am unsure.
Just to clear things up, this is ...
- 143
0
votes
1
answer
143
views
Does faulTPM defeat the LUKS-based FDE with a passphrase?
The recent faulTPM paper (https://arxiv.org/pdf/2304.14717v1.pdf) deals mostly with Bitlocker and only mentions LUKS to note the differences.
The authors state:
With a passphrase, however, the same ...
- 143
1
vote
2
answers
255
views
Full disk encryption with LUKS?
I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
- 11
1
vote
1
answer
146
views
How to protect files in use on a system powered on from physical theft or tampering?
I'm in the process of figuring out an encryption strategy for a personal Linux system.
My laptop is almost always on, or in sleep mode, except for longer travels.
My main threats are theft of my ...
- 11
1
vote
1
answer
67
views
AEAD: Authenticating a digest of my data instead the data itself
Relevant question for Python:
Stack Exchange: https://stackoverflow.com/questions/75739308/aead-authentication-with-huge-input-that-doesnt-fit-into-ram
Top Answers: https://topanswers.xyz/python?q=...
- 121
0
votes
0
answers
167
views
Can you require both a password and a smart card to unlock a bitlocker drive?
I seen you can associate a smart card when you encrypt the drive with bitlocker, but I am not sure if ...
You can unlock with a smart card as an alternative to your password that you set (not the ...
- 140
0
votes
0
answers
58
views
External and internal OS whole disk encryption using TPM 2.0 module for centos
I am new to disk encryption, I have gone through the encryption topic basic, need to do whole disk encryption using TPM2.0 on cent OS server along with some external HDD or ssd disk attached to the ...
1
vote
2
answers
887
views
Full disk encryption: Legacy boot mode (MBR) vs. EFI boot mode
FDE tools like VeraCrypt will encrypt the whole system drive when the machine uses legacy boot mode (MBR). But they will only encrypt the system partition if the machine uses EFI boot mode (the EFI ...
- 1,653
1
vote
3
answers
182
views
Understanding FDE: Is the encrypted Linux protected against a compromised boot volume?
I use this initramfs-based FDE on my headless server. My motivation is to secure my system against physical tampering.
I am aware that securing an untrusted hardware is not possible. This question is ...
- 113
15
votes
2
answers
8k
views
Erased encrypted HDD, then secure erased 10% of it before selling it - is it safe?
I have a 4TB mechanical hard drive that was encrypted before I ever wrote any file on it. I used a 25 character password with symbols.
Before I sold it, I unmounted the disk while it was still ...
- 321
1
vote
3
answers
207
views
Are there ways to detect plain dm-crypt encryption and what are the countermeasures against them?
Encryption with plain dm-crypt is often positioned as encryption that cannot be recognized. But is it really so? Are there ways to prove that the data is encrypted with plain dm-crypt? How to bypass ...
- 11
1
vote
1
answer
182
views
How to make a virtual machine forensics-proof - completely or to the maximum possible level?
I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access ...
- 121
0
votes
0
answers
563
views
Which of these filesystem encryption philosophies and methodologies are better for which purpose?
Currently on the "FLOSS market" there are multiple options for encrypting remote cloud storage following different security models and different philosophies. To name a few:
encfs (I guess ...
- 1,544
0
votes
0
answers
119
views
Self-encrypting drive - eDrive vs ATA Security
Let's for a moment forget about the possible drawbacks of SEDs themselves. One of the upsides of SEDs is that the encryption key never leaves the drive but wouldn't using eDrive negate this advantage ...
0
votes
1
answer
193
views
Is it sufficient to put /var, /tmp/, and /home on their own encrypted partitions?
I want to encrypt my system, but I don't want the hassle of having to put in two passwords on boot; I just want to put in one password on login that would decrypt the other partitions. I have heard ...
- 143
0
votes
1
answer
691
views
NAS newbie: how to ensure that network storage is encrypted at rest (and ideally in transit and in use) for Windows, Linux, Mac
I'm looking to buy an ~8TB NAS* for my home office (I guess it's called a "private cloud").
I want to connect to it from Windows, Linux, Mac, Android, and iOS.
How can I ensure that the ...
- 315
0
votes
0
answers
329
views
Suspicious SSD corruption exactly at LUKS encryption header
I am helping with an interesting data recovery issue. The laptop was running Debian 11 Linux with LUKS full disk encryption on a Samsung 970 Evo Plus 2TB SSD for quite many months. Suddenly the LUKS ...
0
votes
0
answers
32
views
Is it possible to hack encrypted external HDD,if you have access to it? [duplicate]
If I lose my external HDD and somebody finds it and tries to hack, will he succeed?Is it possible to get data from encrypted disk by disassembling it and working with platters?
HDD is APFS AES 256 ...
0
votes
1
answer
483
views
Is it safe to store data on APFS 256 AES encrypted external HDD disk?
I'm using a MacBook and want to store confidential data (financial documents, passwords, private photos, etc.) on an external HDD disk.
How safe is setting up APFS AES 256 encryption with disk ...
0
votes
1
answer
77
views
Does an SSD store software-encrypted data in unencrypted form somewhere?
I use LUKS encryption on my entire drive. Do SSD drives ship with any storage areas which store unencrypted data, even though the data is saved encrypted on user-available SSD storage?
Maybe inside ...
- 23
1
vote
0
answers
125
views
How hard is it to modify UEFI nvram if the device is off and the UEFI is locked?
This assumes that:
Machine is powered off
No UEFI backdoors
No Reflashing the firmware
No clearing the NVRAM (The point is to modify/read a small amount of NVRAM, instead of resetting it)
Device ...
0
votes
1
answer
1k
views
NVMe Self Encrypting Drive - How to use ATA Security?
I own a Samsung 980 Pro which, according to its own specification, supports Class 0, TCG/Opal 2.0 and IEEE16667. Since it's an NVMe drive, I cannot use hdparm in order to set up class 0 encryption but ...
0
votes
0
answers
102
views
SED specification for USB sticks?
As I got from my preliminary research, there is an established standard TCG Opal 2.0 which defines in specification the principles of SED encryption thus enabling the interoperability between vendors.
...
- 282
1
vote
0
answers
35
views
Full disk encryption and data recovery capabilities [duplicate]
So I had linux mint with fde, had sensitive files on it, shut down my pc, and reinstalled a new linux mint OS with fde. What are the chances of data recovery from the first OS?
- 11
1
vote
1
answer
82
views
Flashdrive data confidentiality when disconnecting flashdrive from machine abruptly
Assuming I boot up a fully encrypted OS from a portable flash drive and do some tasks in this running OS; then abruptly disconnect this flash drive from my computer and a malicious actor gets their ...
- 13
1
vote
1
answer
294
views
Military-grade encryption on Blu-ray discs?
Another thread addresses the question of what can count as "military-grade encryption." In this case, I see that CyberLink Power2Go software boasts "advanced military-grade 256-bit ...
- 113
0
votes
2
answers
301
views
How does bitlocker work when unlocking a removable drive on another PC using a password?
Here's the scenario:
I have an external harddrive encrypted with bitlocker. I disconnect that drive from the PC that encrypted it, and connect it to a different PC.
Surprisingly, when I do this, all ...
- 125
0
votes
3
answers
688
views
How difficult is it to decrypt a disk encrypted with luksOpen?
I have encrypted a disk on my Ubuntu machine using
sudo cryptsetup luksOpen /dev/sdb1 sdb1
I'm wondering how difficult is it to decrypt this disk using bruteforce password guessing?
What does the ...
- 383
0
votes
1
answer
43
views
Saving signed file on an encrypted drive using symmetric encryption
When using asymmetric encryption, signing and encryption are the same, but opposite, operations.
Say I have my drive encrypted with asymmetric encryption.
If I save a signed file to that drive, using ...
- 5
0
votes
1
answer
640
views
Using Yubico YubiKey 5 NFC for local data encryption
I'm interested in buying a Yubikey but want to know if you can use a Yubikey to generate a symmetric key for file encryption on selected files on a PC. Or if you need some sort of extension like HMAC-...
- 3
0
votes
1
answer
1k
views
Does full disk encryption securely remove data?
I was just catching up on best practices for securely erasing data from a Mac. At one point I remember reading:
For SSD drives it is no longer recommended to fully write ones/zeroes/random bits on the ...
- 1,715
3
votes
0
answers
2k
views
When using VirtualBox, is it better to use the VirtualBox encryption or the OS disk encryption?
VirtualBox has an option to encrypt the drive of a VM.
When I installed Debian or Ubuntu, I have the option to say that I want the full disk encrypted.
I'm thinking that both do pretty much the same ...
- 987
0
votes
4
answers
907
views
Can TPM2 disk encryption protect data after full server theft?
I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft.
If we assume that TPM2 ...
- 614
1
vote
0
answers
104
views
Cold boot attack on NAS
I'm familiar with the concept of cold boot attacks on laptop and desktop computers, where the goal is to find hidden encryption keys in the memory. I also think it's done on certain mobile phones. I ...
- 26
1
vote
1
answer
193
views
How exactly does Windows Bitlocker work?
I wonder how Windows Bitlocker and other similar software works.
I know they differ in terms of security level as some software does not fully encrypt locked files, but I'm speaking of unauthorized ...
- 113
1
vote
1
answer
345
views
What are the pros and cons of encryption software from the hard disk manufacturer?
I usually use Veracrypt (and in the past Truecrypt) to secure my external hard drive. I've always been taught to stick to such open-source software for my disk encryption needs, since it can be ...
- 203
1
vote
1
answer
189
views
Does Re-Encryption make our data more secure?
We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also.
iPhone and recent Androids are all encrypted. We know that changing the password will ...
- 111
12
votes
4
answers
8k
views
Is looking for plain text strings on an encrypted disk a good test?
I have a dual boot PC, where the Win10 (uncompressed) partition is encrypted with BitLocker. I was curious about making this test (and also encryption took quite a short time in my opinion), so while ...
- 239
0
votes
1
answer
111
views
Why would FDE miss slack space, swap files and memory?
I'm reviewing a ISO27001 Gap Analysis workbook and under Control A.11.2.7 someone has left the note:
If full disk encryption (FDE) is used on a device is there a policy
in place to ensure the ...
- 103
4
votes
2
answers
658
views
How does Windows password protect my data?
As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
1
vote
1
answer
135
views
Why is it advisable to capture a disk image before shutting down? [closed]
I am currently studying windows forensics and I have found that it would be advisable to image the drive while it is powered on and live. If you power it off, you likely will not be able to recover ...
2
votes
1
answer
2k
views
Are there any Linux distributions with enabled TPM2 and full disk encryption setups
I have been searching the web to find a Linux distribution, preferrably a rolling release one as I'm otherwise hooked on the concepts in Arch Linux, with automated steps to setup full disk encryption (...
- 121
1
vote
1
answer
613
views
At-rest encryption. Use SFTP log-in credentials to unlock/decrypt encrypted drive or folder on an Ubuntu Linux server
I have a simple file server running on a small Ubuntu machine that facilitates file sharing and 2 way folder syncing between my and my girlfriend's 4 computers through SFTP over a private network.
The ...
- 13
0
votes
2
answers
287
views
How to securely encrypt my computer and protect it from thieves and others
I did enabled Bitlocker encryption on my Windows 10 Pro Laptop. but it has TPM 2.0 chip installed and Because of that it DOES NOT actually Protecting me as someone JUST NEED TO CRACK 1 PASSWORD (...
0
votes
1
answer
160
views
Taking encrypted devices across borders
I am moving to a country where the government can compel you to reveal passwords for your devices at the border, rendering the full disk encryption on my linux laptop useless.
Other than uploading ...
