Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

Filter by
Sorted by
Tagged with
4
votes
1answer
15k views

Is there any way to crack a Bitlocker drive?

We have disk drive that encrypt with BitLocker. My key is lost, and we haven't any backup of the data. Is there any way to hack or crack and recover our data?
0
votes
0answers
85 views

Why doesn't the PIN become part of the encryption key in bitlocker with TPM?

TPM is a fantastic addition to motherboards. But I have read here some bitlocker papers and they tell me that if you choose TPM + PIN protection, then the PIN does not become part of the key, it is ...
2
votes
1answer
40 views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
1
vote
1answer
119 views

LUKS - Too large detached header size when large offset

I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug I would like to achieve a very large LUKS offset without resulting in a very bulky detached header ...
3
votes
1answer
246 views

Decrypting possibly compromised Veracrypt hard drive

I have a Veracrypt encrypted hard drive, a system drive encryption with the operating system. The laptop is possibly compromised, which is why I can't decrypt it directly on the laptop I don't know ...
0
votes
1answer
54 views

Decrypting a BitLockered USB drive [duplicate]

I have encrypted a USB drive with BitLocker and I have lost the password and the hash backup. I have tried to search for something to decrypt the drive but came short. I have imaged the USB drive and ...
46
votes
4answers
13k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
2
votes
1answer
109 views

How secure is BitLocker without TPM?

My laptop doesn't have TPM. If I enable BL PIN and someone steals my laptop and remove the drive, will they be able to read it's content on another computer? How am I vulnerable without TPM?
1
vote
0answers
43 views

TPM & Windows BitLocker: how does it work and is it secure?

When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
1
vote
0answers
31 views

Is it possible to adjust the header size in eCryptfs?

If I understand it correctly, eCryptfs creates a file in the "lower" directory whose content is a header, plus the encryption of the file in the "upper" directory. But when I create an empty file in ...
2
votes
3answers
204 views

Should I upgrade old volumes to new cryptsetup encryption mode?

The old cryptsetup default is aes-cbc-essiv:sha256. The new one is aes-xts-plain64:sha256. I don't know that much about cryptography but I assume the standard was changed for a reason. Also there can ...
2
votes
1answer
89 views

Storing LUKS master key in SGX enclave

Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
0
votes
1answer
53 views

How I can encrypt Windows if I use a SSD and HDD?

I need to encrypt my Windows Disks with full disk encryption. Windows is already installed and all drives have data. My Drives/Disks: 1 SSD - C: drive 1 HDD - D: drive and I have a drive where Linux ...
23
votes
3answers
28k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
0
votes
0answers
29 views

Can KDF mitigate rekeying requirement for XTS?

In NIST-800-57-1 it is implied that a key derived from a KDF, is as good as a key derived from a real CSPRNG, in 8.2.4(2): If the keyderivation key is known by an adversary, he can generate any ...
0
votes
1answer
74 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
3
votes
1answer
1k views

EncFS vs EFS advantages for Dropbox-seamless encryption

I am considering a solution for securing my private data in Dropbox. In spite of OneDrive, MEGA and AmazonCloud are also being considered but now I put my focus on Dropbox as the most feature-rich of ...
3
votes
2answers
656 views

Is a password or passphrase needed with a keyfile backup to decrypt

In my search for an encrypted NAS i have come across a few products that talk about backing up the encryption key and storing it in a safe location. My question is if this backed up keyfile is enough ...
0
votes
1answer
81 views

Unrecoverable information in HDD

A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (...
7
votes
1answer
2k views

Is using decrypt_derived more secure than a keyfile?

Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS. The /home partition needs only to be decrypted if / is unlocked and ...
1
vote
1answer
506 views

System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?

First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently. Here would be a good reference/guide on system encryption: https://www.howtogeek.com/...
1
vote
1answer
208 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
2
votes
1answer
69 views

RAID + IEEE1667 + TPM + UEFI

Windows Server using a IEEE-1667 drive allows hardware based encryption on the fly. What are our options when using two disks with a RAID controller, in order to achieve redundancy and parity (T10-...
0
votes
0answers
27 views

When using Encryption that produces random memory/storage can you randomly input memory/data that reads as known file types?

I refer to this question's answer, the second part mentioning the random data, and no headers or anything, including files that are recognizable. Reading the answer just made me think adding random ...
0
votes
1answer
143 views

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
1
vote
1answer
108 views

What is a LUKS cipher-name “@”?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
1
vote
1answer
64 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
21
votes
5answers
16k views

What does LUKS header contain?

What is contained inside the LUKS header? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
1
vote
2answers
398 views

Preventing LUKS key dump

Is it possible to prevent a root user (user space) from running dmsetup table --showkeys to dump the LUKS master key? I know of the TRESOR patch which essentially prevents the key from persisting in ...
1
vote
1answer
71 views

Stealing Veracrypt or LUKS hash while system running?

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
1
vote
2answers
92 views

How to set up full disk file encryption?

I want to set up my company's laptops in a way that all files created on these laptops can only be read by these laptops. If it is copied to a USB then that file is only readable when plugging that ...
0
votes
1answer
113 views

Is it secure to set the encryption password the same as the root password? [duplicate]

When installing Manjaro Linux, it shows the following screen: What's the logic behind that?
0
votes
0answers
113 views

Possible to restore LUKS header from partition that uses the exact same password and keyfile?

I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
72
votes
7answers
20k views

What does Amazon's S3 Server-side encryption protect against?

Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of ...
2
votes
1answer
92 views

How can I know if a USB drive is fully encrypted?

When a fully encryped USB drive is connected to a computer, the OS says this USB drive is not formatted. How can I verify that a USB drive is fully encrypted while still being formatted? Is there a ...
2
votes
0answers
52 views

How challenge response password recovery mechanism works with disk encryption?

For the sole purpose of learning, I am trying to figure out how disk encryption software is able to recover password of an encrypted disk using a challenge response mechanism. Th recovery process ...
3
votes
3answers
157 views

Should operating system passwords be complex if full disk encryption is used that has a complex passphrase?

If a device uses full disk encryption such as LUKS, BitLocker (with a pin), Veracrypt and others and boots using a complex password, what is the need for complex passwords to log into the operating ...
0
votes
1answer
476 views

Is Android encryption secure? [duplicate]

As far as I know Android (Pie) is encrypted by default with some hardware-based password. But how secure is this encryption? I am not talking about password compromise, but if somebody gets my phone,...
1
vote
1answer
195 views

Is an encrypted hard drive immune from malware if it is not mounted when using a LiveCD?

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD? The use case is that ...
2
votes
2answers
4k views

Is LUKS effective?

I ask this because encrypting an hard drive using LUKS takes a few seconds while encrypting the same drive using Bitlocker takes several hours. Does that mean LUKS encryption is weaker?
2
votes
1answer
83 views

Strategies to protect SANs in branch offices in risky places

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
2
votes
1answer
352 views

Two factor authentication and plausible deniability for disk encryption

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there ...
0
votes
1answer
101 views

Have I used LUKS properly?

I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD. I am using Linux Mint and LUKS. Could someone please ...
2
votes
0answers
69 views

Disk encryption with automatic reboot and no-network [duplicate]

I am using crytsetup with LUKS to encrypt a data drive, separate to the system drive, under Ubuntu 16.04. The issue I am facing is that this system will also be required to automatically start itself ...
0
votes
0answers
51 views

Hashed password vs key, full-disk encryption

In the case of FDE, I understand that the user defined password is ran through a hashing algorithm such as SHA-512 (often with a random SALT and a high iteration count to act as a countermeasure for ...
3
votes
2answers
9k views

Encrypting Tails USB Boot Disk (Live)

To use tails, I have always used a DVD, because of the fact I know it will not be tampered with, at least within reason. However there are endless reasons why a USB boot option would be faster, and in ...
0
votes
0answers
58 views

Implementing encryption at rest on a remote virtual file system

Imagine I had a virtual file system that I am using to store some data (similar to an FTP). I am trying to figure out a scheme where I can implement encryption at rest for the files local to the file ...
2
votes
1answer
87 views

What makes drive encryption safe?

Let's build a scene: I'm working on my laptop in the library, and while I'm gone to the toilet for 5 minutes, someone disassembled my laptop and took the hard drive. I encrypted it with VeraCrypt, so ...
1
vote
1answer
338 views

SSD Hardware Encryption versus Software Encryption

I was looking to purchase a new SSD and want to use it to store sensitive data, that I would not want people to steal or access. Have been trying to research it and only read bad things about ...
4
votes
0answers
79 views

How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?

I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...

1
2 3 4 5
11