Questions tagged [disk-encryption]
Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).
609
questions
1
vote
0
answers
130
views
Is it possible to adjust the header size in eCryptfs?
If I understand it correctly, eCryptfs creates a file in the "lower" directory whose content is a header, plus the encryption of the file in the "upper" directory. But when I create an empty file in ...
0
votes
1
answer
406
views
How I can encrypt Windows if I use a SSD and HDD?
I need to encrypt my Windows Disks with full disk encryption. Windows is already installed and all drives have data.
My Drives/Disks:
1 SSD - C: drive
1 HDD - D: drive and I have a drive where Linux ...
0
votes
0
answers
183
views
How to secure an IoT device
Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)?
Fully disk encryption is of course an option, but is it ...
0
votes
1
answer
285
views
Unrecoverable information in HDD
A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (...
3
votes
1
answer
717
views
LUKS - Too large detached header size when large offset
I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug
I would like to achieve a very large LUKS offset without resulting in a very bulky detached header
...
0
votes
0
answers
94
views
When using Encryption that produces random memory/storage can you randomly input memory/data that reads as known file types?
I refer to this question's answer, the second part mentioning the random data, and no headers or anything, including files that are recognizable. Reading the answer just made me think adding random ...
2
votes
1
answer
577
views
Storing LUKS master key in SGX enclave
Is it possible to store the master decryption key for accessing a LUKS encrypted volume inside an SGX enclave so that the master key cannot be accessed by any user on the system, even the root user ...
1
vote
1
answer
456
views
Why is my LUKS header listed twice?
Why is the metadata in my LUKS header listed twice?
I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
1
vote
1
answer
321
views
What is a LUKS cipher-name "@"?
In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean?
The LUKS On-Disk Format Specification originally published by Clemens ...
2
votes
1
answer
4k
views
How to determine start and end bytes of LUKS header?
How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device?
I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
1
vote
1
answer
279
views
Stealing Veracrypt or LUKS hash while system running?
If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to ...
2
votes
2
answers
198
views
How to set up full disk file encryption?
I want to set up my company's laptops in a way that all files created on these laptops can only be read by these laptops. If it is copied to a USB then that file is only readable when plugging that ...
0
votes
1
answer
756
views
Is it secure to set the encryption password the same as the root password? [duplicate]
When installing Manjaro Linux, it shows the following screen:
What's the logic behind that?
0
votes
0
answers
546
views
Possible to restore LUKS header from partition that uses the exact same password and keyfile?
I was in Windows 10 and it told me I needed to Initialize Disk so I clicked it and now my LUKS header has been overwritten. I created my encrypted partitions in Linux with cryptsetup command. However, ...
2
votes
1
answer
2k
views
How can I know if a USB drive is fully encrypted?
When a fully encryped USB drive is connected to a computer, the OS says this USB drive is not formatted. How can I verify that a USB drive is fully encrypted while still being formatted? Is there a ...
2
votes
0
answers
321
views
How challenge response password recovery mechanism works with disk encryption?
For the sole purpose of learning, I am trying to figure out how disk encryption software is able to recover password of an encrypted disk using a challenge response mechanism.
Th recovery process ...
4
votes
3
answers
311
views
Should operating system passwords be complex if full disk encryption is used that has a complex passphrase?
If a device uses full disk encryption such as LUKS, BitLocker (with a pin), Veracrypt and others and boots using a complex password, what is the need for complex passwords to log into the operating ...
0
votes
1
answer
3k
views
Is Android encryption secure? [duplicate]
As far as I know Android (Pie) is encrypted by default with some hardware-based password. But how secure is this encryption?
I am not talking about password compromise, but if somebody gets my phone,...
1
vote
1
answer
1k
views
Is an encrypted hard drive immune from malware if it is not mounted when using a LiveCD?
As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?
The use case is that ...
2
votes
1
answer
146
views
Strategies to protect SANs in branch offices in risky places
A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
0
votes
1
answer
197
views
Have I used LUKS properly?
I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD.
I am using Linux Mint and LUKS. Could someone please ...
2
votes
0
answers
112
views
Disk encryption with automatic reboot and no-network [duplicate]
I am using crytsetup with LUKS to encrypt a data drive, separate to the system drive, under Ubuntu 16.04. The issue I am facing is that this system will also be required to automatically start itself ...
2
votes
1
answer
187
views
What makes drive encryption safe?
Let's build a scene: I'm working on my laptop in the library, and while I'm gone to the toilet for 5 minutes, someone disassembled my laptop and took the hard drive. I encrypted it with VeraCrypt, so ...
4
votes
1
answer
1k
views
SSD Hardware Encryption versus Software Encryption
I was looking to purchase a new SSD and want to use it to store sensitive data, that I would not want people to steal or access.
Have been trying to research it and only read bad things about ...
6
votes
0
answers
174
views
How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?
I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
1
vote
1
answer
184
views
I got my drive "bitlocker encrypted" by enterprise admins. Will this prevent me to share docs with my collaborators?
I admit I don't fully understand the level of encryption bitlocker does.
I use Windows 10 and only have a C: drive which just got encrypted per the company policies.
Will this hinder my ability to ...
20
votes
5
answers
5k
views
How to use FDE without needing to share the encryption password
We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04.
The UI is ...
2
votes
1
answer
165
views
Effect of FDE for data recovery
Assume that I fully encrypt an unused USB (FDE), then format it and copy plaintext files. If the files are deleted from USB by using a secure wipe, does FDE that was first applied decrease the ...
2
votes
1
answer
383
views
RAID + IEEE1667 + TPM + UEFI
Windows Server using a IEEE-1667 drive allows hardware based encryption on the fly.
What are our options when using two disks with a RAID controller, in order to achieve redundancy and parity (T10-...
0
votes
0
answers
63
views
How long shall a password be to resist a botnet brute force? [duplicate]
Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
2
votes
2
answers
190
views
Security risk of copying
I need to back up an encrypted drive, if the data gets corrupted I'd have another copy
I don't have another drive that I trust not to have been compromised right now.
My idea is to copy an encrypted ...
2
votes
1
answer
1k
views
Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?
Our team's goal
We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
26
votes
2
answers
5k
views
Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?
Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10....
47
votes
9
answers
10k
views
How to prevent a hosting company from accessing a VM's encryption keys?
I want to prevent potential theft of my web application (source code + database) by my local hosting company, that I don't fully trust for some reason (but have no other choice but to use as they give,...
0
votes
1
answer
1k
views
What's a good encryption method available for external hdd's, ext4? [closed]
I've been reading about encryption methods and see things like 'ecryptfs', 'veracrypt', 'LUKS' that "military grade encryption" is basically 256-AES encryption.
I have data on an external hdd - can'...
0
votes
2
answers
2k
views
Bitlocker/Filevault and VeraCrypt together?
I'm researching ways to make the most secure encryption for additional fixed drives to protect against unknown vulnerabilities, side channel attacks, etc.
Basically, securing the data beyond just a ...
0
votes
1
answer
5k
views
What is the purpose of the Volume Master Key in BitLocker?
From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive:
Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and ...
0
votes
3
answers
919
views
How sufficient are these steps to prevent deleted SSD files from being recovered?
I'm selling a 4-year-old Dell PC with Windows 10 and two SSDs and I want to be sure that nobody can recover anything from my personal deleted files. So far I've done the following.
Completely ...
0
votes
0
answers
123
views
Non-obvious Mitigations for This DMA-Attack Demonstrated by F-Secure
Are there any non-obvious mitigations for the big DMA-attack revealed last year and demonstrated in this video by F-Secure?
We know that Microsoft has published some material pertaining to DMA-...
1
vote
1
answer
3k
views
Are there any risks from cloning a LUKS encrypted partition?
I'm using an installation of Ubuntu server on disk, with some extra packages installed and configuration carried out, on disk as a kind of base image for repeatedly creating other systems. I clone ...
2
votes
1
answer
4k
views
How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same?
How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same?
From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive:
...
3
votes
3
answers
1k
views
Should I upgrade old volumes to new cryptsetup encryption mode?
The old cryptsetup default is aes-cbc-essiv:sha256. The new one is aes-xts-plain64:sha256. I don't know that much about cryptography but I assume the standard was changed for a reason.
Also there can ...
2
votes
0
answers
100
views
Best luks setup disk [duplicate]
I want to encrypt my disk but I want to know what is the best configuration, I currently use ths:
cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --key-file=- --hash whirlpool --iter-time ...
6
votes
2
answers
13k
views
How secure is full-disk encryption technology on LineageOS, or Android phones in general?
We're attempting to assess the information security on our mobile devices, and information seems rather varied on the question of encryption. Is the encryption technology employed by Android-based ...
1
vote
0
answers
372
views
Disk Encryption VS SQL TDE Encryption
I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption.
My understanding is that disk encryption will prevent malicious users pulling out the disk ...
3
votes
1
answer
902
views
Windows BitLocker- Is the drive Password the same as the Key used by AES to encrypt the drive?
I am using BitLocker on my Win10. I encryted my usb drive using my Windows BitLocker with a strong password.
I know that Bitlocker uses AES-~256 bit key for encryption. My question what is the key ...
2
votes
2
answers
2k
views
Is it too late to encrypt my already used USB drive?
I've had my USB for quite a while now. It contains quite a lot of personal information on it. (I know, I'm stupid for not encrypting it before hand).
Is it too late to encrypt my drive even if files ...
0
votes
1
answer
294
views
On a mobile, does using a password instead of a PIN make encryption stronger?
On a mobile, does using a password instead of a PIN make encryption stronger?
What key does the phone use for its encryption? Would it use the PIN itself?
2
votes
2
answers
295
views
How is it possible that hardware-encrypted flash devices are safe?
I start with the fact that I understand how flash devices (pendrives) can be encrypted with software, for example Bitlocker. Simply, the encryption key is the password given during encryption and ...
2
votes
1
answer
894
views
Is suspend-to-ram really a meaningful risk for Full Disk Encryption?
Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...