Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

Filter by
Sorted by
Tagged with
1 vote
0 answers
130 views

Is it possible to adjust the header size in eCryptfs?

If I understand it correctly, eCryptfs creates a file in the "lower" directory whose content is a header, plus the encryption of the file in the "upper" directory. But when I create an empty file in ...
Cyker's user avatar
  • 1,683
0 votes
1 answer
406 views

How I can encrypt Windows if I use a SSD and HDD?

I need to encrypt my Windows Disks with full disk encryption. Windows is already installed and all drives have data. My Drives/Disks: 1 SSD - C: drive 1 HDD - D: drive and I have a drive where Linux ...
user234080's user avatar
0 votes
0 answers
183 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
Luca's user avatar
  • 1
0 votes
1 answer
285 views

Unrecoverable information in HDD

A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (...
pobime7177's user avatar
3 votes
1 answer
717 views

LUKS - Too large detached header size when large offset

I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug I would like to achieve a very large LUKS offset without resulting in a very bulky detached header ...
adnev's user avatar
  • 31
0 votes
0 answers
94 views

When using Encryption that produces random memory/storage can you randomly input memory/data that reads as known file types?

I refer to this question's answer, the second part mentioning the random data, and no headers or anything, including files that are recognizable. Reading the answer just made me think adding random ...
Mizat's user avatar
  • 1
2 votes
1 answer
577 views

Storing LUKS master key in SGX enclave

Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
Michael Altfield's user avatar
1 vote
1 answer
456 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
Michael Altfield's user avatar
1 vote
1 answer
321 views

What is a LUKS cipher-name "@"?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
Michael Altfield's user avatar
2 votes
1 answer
4k views

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
Michael Altfield's user avatar
1 vote
1 answer
279 views

Stealing Veracrypt or LUKS hash while system running?

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
kat's user avatar
  • 411
2 votes
2 answers
198 views

How to set up full disk file encryption?

I want to set up my company's laptops in a way that all files created on these laptops can only be read by these laptops. If it is copied to a USB then that file is only readable when plugging that ...
Trung Nguyen's user avatar
0 votes
1 answer
756 views

Is it secure to set the encryption password the same as the root password? [duplicate]

When installing Manjaro Linux, it shows the following screen: What's the logic behind that?
Alberto Salvia Novella's user avatar
0 votes
0 answers
546 views

Possible to restore LUKS header from partition that uses the exact same password and keyfile?

I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
Anon User's user avatar
2 votes
1 answer
2k views

How can I know if a USB drive is fully encrypted?

When a fully encryped USB drive is connected to a computer, the OS says this USB drive is not formatted. How can I verify that a USB drive is fully encrypted while still being formatted? Is there a ...
user215422's user avatar
2 votes
0 answers
321 views

How challenge response password recovery mechanism works with disk encryption?

For the sole purpose of learning, I am trying to figure out how disk encryption software is able to recover password of an encrypted disk using a challenge response mechanism. Th recovery process ...
tigrou's user avatar
  • 133
4 votes
3 answers
311 views

Should operating system passwords be complex if full disk encryption is used that has a complex passphrase?

If a device uses full disk encryption such as LUKS, BitLocker (with a pin), Veracrypt and others and boots using a complex password, what is the need for complex passwords to log into the operating ...
Ryan's user avatar
  • 93
0 votes
1 answer
3k views

Is Android encryption secure? [duplicate]

As far as I know Android (Pie) is encrypted by default with some hardware-based password. But how secure is this encryption? I am not talking about password compromise, but if somebody gets my phone,...
user avatar
1 vote
1 answer
1k views

Is an encrypted hard drive immune from malware if it is not mounted when using a LiveCD?

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD? The use case is that ...
Ryan's user avatar
  • 93
2 votes
1 answer
146 views

Strategies to protect SANs in branch offices in risky places

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
Gordon Stewart's user avatar
0 votes
1 answer
197 views

Have I used LUKS properly?

I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD. I am using Linux Mint and LUKS. Could someone please ...
user5623335's user avatar
2 votes
0 answers
112 views

Disk encryption with automatic reboot and no-network [duplicate]

I am using crytsetup with LUKS to encrypt a data drive, separate to the system drive, under Ubuntu 16.04. The issue I am facing is that this system will also be required to automatically start itself ...
Tyler's user avatar
  • 21
2 votes
1 answer
187 views

What makes drive encryption safe?

Let's build a scene: I'm working on my laptop in the library, and while I'm gone to the toilet for 5 minutes, someone disassembled my laptop and took the hard drive. I encrypted it with VeraCrypt, so ...
Ömer Enes Özmen's user avatar
4 votes
1 answer
1k views

SSD Hardware Encryption versus Software Encryption

I was looking to purchase a new SSD and want to use it to store sensitive data, that I would not want people to steal or access. Have been trying to research it and only read bad things about ...
ApexLegend's user avatar
6 votes
0 answers
174 views

How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?

I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
Roy's user avatar
  • 61
1 vote
1 answer
184 views

I got my drive "bitlocker encrypted" by enterprise admins. Will this prevent me to share docs with my collaborators?

I admit I don't fully understand the level of encryption bitlocker does. I use Windows 10 and only have a C: drive which just got encrypted per the company policies. Will this hinder my ability to ...
Mark's user avatar
  • 13
20 votes
5 answers
5k views

How to use FDE without needing to share the encryption password

We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04. The UI is ...
Hari's user avatar
  • 311
2 votes
1 answer
165 views

Effect of FDE for data recovery

Assume that I fully encrypt an unused USB (FDE), then format it and copy plaintext files. If the files are deleted from USB by using a secure wipe, does FDE that was first applied decrease the ...
user215422's user avatar
2 votes
1 answer
383 views

RAID + IEEE1667 + TPM + UEFI

Windows Server using a IEEE-1667 drive allows hardware based encryption on the fly. What are our options when using two disks with a RAID controller, in order to achieve redundancy and parity (T10-...
Nikos Papandreou's user avatar
0 votes
0 answers
63 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
Alberto Salvia Novella's user avatar
2 votes
2 answers
190 views

Security risk of copying

I need to back up an encrypted drive, if the data gets corrupted I'd have another copy I don't have another drive that I trust not to have been compromised right now. My idea is to copy an encrypted ...
Tye's user avatar
  • 21
2 votes
1 answer
1k views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
Johnny Utahh's user avatar
26 votes
2 answers
5k views

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10....
user avatar
47 votes
9 answers
10k views

How to prevent a hosting company from accessing a VM's encryption keys?

I want to prevent potential theft of my web application (source code + database) by my local hosting company, that I don't fully trust for some reason (but have no other choice but to use as they give,...
BenMorel's user avatar
  • 909
0 votes
1 answer
1k views

What's a good encryption method available for external hdd's, ext4? [closed]

I've been reading about encryption methods and see things like 'ecryptfs', 'veracrypt', 'LUKS' that "military grade encryption" is basically 256-AES encryption. I have data on an external hdd - can'...
topencrypt's user avatar
0 votes
2 answers
2k views

Bitlocker/Filevault and VeraCrypt together?

I'm researching ways to make the most secure encryption for additional fixed drives to protect against unknown vulnerabilities, side channel attacks, etc. Basically, securing the data beyond just a ...
Matt's user avatar
  • 11
0 votes
1 answer
5k views

What is the purpose of the Volume Master Key in BitLocker?

From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive: Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and ...
Shuzheng's user avatar
  • 1,227
0 votes
3 answers
919 views

How sufficient are these steps to prevent deleted SSD files from being recovered?

I'm selling a 4-year-old Dell PC with Windows 10 and two SSDs and I want to be sure that nobody can recover anything from my personal deleted files. So far I've done the following. Completely ...
Joe's user avatar
  • 133
0 votes
0 answers
123 views

Non-obvious Mitigations for This DMA-Attack Demonstrated by F-Secure

Are there any non-obvious mitigations for the big DMA-attack revealed last year and demonstrated in this video by F-Secure? We know that Microsoft has published some material pertaining to DMA-...
Daniel's user avatar
  • 151
1 vote
1 answer
3k views

Are there any risks from cloning a LUKS encrypted partition?

I'm using an installation of Ubuntu server on disk, with some extra packages installed and configuration carried out, on disk as a kind of base image for repeatedly creating other systems. I clone ...
Arronical's user avatar
  • 167
2 votes
1 answer
4k views

How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same?

How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same? From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive: ...
Shuzheng's user avatar
  • 1,227
3 votes
3 answers
1k views

Should I upgrade old volumes to new cryptsetup encryption mode?

The old cryptsetup default is aes-cbc-essiv:sha256. The new one is aes-xts-plain64:sha256. I don't know that much about cryptography but I assume the standard was changed for a reason. Also there can ...
piotrek's user avatar
  • 289
2 votes
0 answers
100 views

Best luks setup disk [duplicate]

I want to encrypt my disk but I want to know what is the best configuration, I currently use ths: cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --key-file=- --hash whirlpool --iter-time ...
Gabriel Caltzontzi suarez's user avatar
6 votes
2 answers
13k views

How secure is full-disk encryption technology on LineageOS, or Android phones in general?

We're attempting to assess the information security on our mobile devices, and information seems rather varied on the question of encryption. Is the encryption technology employed by Android-based ...
user11272717's user avatar
1 vote
0 answers
372 views

Disk Encryption VS SQL TDE Encryption

I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption. My understanding is that disk encryption will prevent malicious users pulling out the disk ...
deltzy's user avatar
  • 237
3 votes
1 answer
902 views

Windows BitLocker- Is the drive Password the same as the Key used by AES to encrypt the drive?

I am using BitLocker on my Win10. I encryted my usb drive using my Windows BitLocker with a strong password. I know that Bitlocker uses AES-~256 bit key for encryption. My question what is the key ...
ZEE's user avatar
  • 167
2 votes
2 answers
2k views

Is it too late to encrypt my already used USB drive?

I've had my USB for quite a while now. It contains quite a lot of personal information on it. (I know, I'm stupid for not encrypting it before hand). Is it too late to encrypt my drive even if files ...
LtMuffin's user avatar
  • 452
0 votes
1 answer
294 views

On a mobile, does using a password instead of a PIN make encryption stronger?

On a mobile, does using a password instead of a PIN make encryption stronger? What key does the phone use for its encryption? Would it use the PIN itself?
Alberto Salvia Novella's user avatar
2 votes
2 answers
295 views

How is it possible that hardware-encrypted flash devices are safe?

I start with the fact that I understand how flash devices (pendrives) can be encrypted with software, for example Bitlocker. Simply, the encryption key is the password given during encryption and ...
Tom's user avatar
  • 21
2 votes
1 answer
894 views

Is suspend-to-ram really a meaningful risk for Full Disk Encryption?

Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
Samuel's user avatar
  • 21

1 2
3
4 5
13