Skip to main content

Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

Filter by
Sorted by
Tagged with
105 votes
10 answers
14k views

Prevention measures against laptop seizure at US borders

Since laptop and other electronic device seizures at US borders became legal without a warrant (including making copies of data), 7% of ACTE's business travelers reported being subject to a seizure as ...
Dan Dascalescu's user avatar
93 votes
2 answers
86k views

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
Jonnathan Soares's user avatar
89 votes
7 answers
24k views

What does Amazon's S3 Server-side encryption protect against?

Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of ...
Hank's user avatar
  • 993
78 votes
7 answers
91k views

Are there actually any advantages to Android full-disk encryption?

So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
scuzzy-delta's user avatar
  • 9,341
67 votes
4 answers
64k views

Is there a reason to use TrueCrypt over VeraCrypt?

I am looking to encrypt a few drives of mine, and my ONLY interest is security. It is OK if my VeraCrypt volumes are not compatible with TrueCrypt, and vice versa. There is a lot of talk about "...
Radmilla Mustafa's user avatar
51 votes
5 answers
13k views

Are there any reasonable TrueCrypt forks?

Unfortunately, TrueCrypt may have been discontinued yesterday. I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux. TrueCrypt ...
Michał Šrajer's user avatar
50 votes
5 answers
8k views

Is laptop "secure sleep" mode theoretically possible?

For laptops with full disk encryption or home folder encryption, one of the risks if it is stolen while in sleep mode is that the encryption key is stored in memory and can be read if an attacker ...
Peter Rankin's user avatar
48 votes
10 answers
23k views

Is full disk encryption on a server in a secure data center pointless?

I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...
user4755220's user avatar
48 votes
4 answers
16k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
php_nub_qq's user avatar
47 votes
9 answers
10k views

How to prevent a hosting company from accessing a VM's encryption keys?

I want to prevent potential theft of my web application (source code + database) by my local hosting company, that I don't fully trust for some reason (but have no other choice but to use as they give,...
BenMorel's user avatar
  • 909
44 votes
3 answers
17k views

How can Android encryption be so fast?

Android uses full-disk encryption to encrypt files and decrypt them at startup. What I don't understand is that decrypting multiple gigabytes of files must take a lot of time, if nothing else then ...
Aayush Mahajan's user avatar
43 votes
4 answers
44k views

Is it possible to tell if hard drive is encrypted?

Is it possible to tell if a hard drive is encrypted, regardless of what software was used, i.e., Truecrypt / VeraCrypt / Bitlocker for AES-256? Just the other day, I thought it could be possible to ...
cpx's user avatar
  • 597
42 votes
4 answers
4k views

How does Android L achieve strong encryption with a low entropy passphrase?

After upgrading to Android L on my Nexus 5, I was pleased to find that I can enable encryption using a pattern as the passphrase. However, it soon got me thinking. I'm guessing the encryption key is ...
tangrs's user avatar
  • 688
33 votes
5 answers
36k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
Martin's user avatar
  • 1,237
32 votes
5 answers
32k views

What does LUKS header contain?

What is contained inside the LUKS header? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
Martin Vegter's user avatar
29 votes
2 answers
59k views

Right way to use the TPM for full disk encryption

I'm currently setting up a BitLocker equivalent using a TPM and LUKS. I've got the basics right and I'm able to measure the boot process and seal the FDE key using the TPM. Every time the sensitive ...
André Borie's user avatar
  • 12.8k
28 votes
5 answers
9k views

Is a password-protected stolen laptop safe?

Let's assume I have a Windows 10 computer and my login password has an entropy of infinity. If I did not encrypt my entire hard-drive, does it matter how secure my password is? Is it possible for ...
MrJoe's user avatar
  • 809
28 votes
2 answers
6k views

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android. On OS X: to enable encryption current user must have a password protected account. After enabling the ...
user avatar
28 votes
5 answers
24k views

How secure is FileVault 2 while the computer is in sleep mode?

How secure is Apples disk encryption FileVault 2 when someone has physical or network access while the computer in sleep mode or is running a screen saver? Are there ways to circumvent FileVault 2 ...
chiborg's user avatar
  • 673
28 votes
3 answers
49k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
Peter's user avatar
  • 281
26 votes
4 answers
34k views

Multi-boot with full hard drive encryption and pre-boot authentication

How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication. I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
dabest1's user avatar
  • 363
26 votes
4 answers
4k views

Is a file shredder/secure erase necessary when you have full disk encryption turned on?

The password manager that I use has instructions to migrate to a new file format: Export existing passwords to a temporary text file Change password manager to new format Import passwords from ...
JonnyWizz's user avatar
  • 1,961
26 votes
2 answers
5k views

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10....
user avatar
25 votes
4 answers
6k views

Is it possible to boot an encrypted server remotely and securely?

Imagine you have a server that is at a location which is not trustworthy. People might have physical access to the machine who are not supposed to look at the data stored on it. In this scenario I ...
Chris's user avatar
  • 682
25 votes
3 answers
24k views

What happens when a TPM chip breaks or fails?

I read that a TPM (Trusted Platform Module) has some sort of burnt in key that it uses, along with the password you provide, to encrypt your data. The point is that you cannot decrypt your Hard Disk ...
Fresco's user avatar
  • 353
24 votes
6 answers
4k views

What are the good use cases for disk encryption?

I've been researching disk/file system encryption, and on the surface it seems like a good idea for a lot of things. But as I dig further, the security it offers seems more mirage like than real. ...
user1971's user avatar
  • 783
23 votes
3 answers
16k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
neitsab's user avatar
  • 343
22 votes
1 answer
2k views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
twisted_pear's user avatar
21 votes
6 answers
8k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
Lighty's user avatar
  • 2,398
21 votes
2 answers
40k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
Michal Koczwara's user avatar
20 votes
3 answers
14k views

Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?

I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family's PCs. I understand that LUKS security will be partially dependent on ...
zpangwin's user avatar
  • 331
20 votes
5 answers
5k views

How to use FDE without needing to share the encryption password

We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04. The UI is ...
Hari's user avatar
  • 311
20 votes
2 answers
44k views

Ubuntu LVM Encryption

I recently installed Kubuntu and I noticed the option for having an encrypted LVM. The behavior suggests it's full disk encryption since I need to put in a password before I can boot. This article and ...
Four_0h_Three's user avatar
19 votes
3 answers
3k views

Are passwords in memory?

I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok! Q: If I open this text file then it goes into the memory. So ...
LanceBaynes's user avatar
  • 6,279
18 votes
2 answers
4k views

What is the threat model for AWS EBS volumes encryption?

AWS provides the ability to encrypt EBS volumes, the value of which I am wondering about. In the "Overview of Security Processes (October 2016)" whitepaper, page 24, they say: Encryption of ...
Greendrake's user avatar
17 votes
2 answers
15k views

BitLocker Drive Encryption NOT secure from drive mapping on network

I have a USB drive encrypted with BitLocker Drive Encryption. Each time I insert the drive in my USB port it works as expected, requires me to enter the password. Maybe I have the BitLocker Drive ...
Rose's user avatar
  • 405
16 votes
5 answers
20k views

VeraCrypt/TruCrypt - I can't understand why you'd want to create a "hidden" volume...?

I can't think of a reason as to why you'd want to create a hidden volume in VeraCrypt. It says because "you may be asked to hand the information," but why would I need to hand it over? Nobody has any ...
Jack's user avatar
  • 421
16 votes
3 answers
4k views

Breaching security of a notebook with full disc encryption when screen is locked

I am using full disc encryption on my portable computer (running Ubuntu). The setup requires me to enter a password during the boot sequence to access fully encrypted hard drive. There is no ...
grepe's user avatar
  • 262
15 votes
2 answers
8k views

Erased encrypted HDD, then secure erased 10% of it before selling it - is it safe?

I have a 4TB mechanical hard drive that was encrypted before I ever wrote any file on it. I used a 25 character password with symbols. Before I sold it, I unmounted the disk while it was still ...
alexx0186's user avatar
  • 321
15 votes
5 answers
3k views

Should a full disk encrypted hard drive on a live system be considered encryption at rest?

If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
Eric G's user avatar
  • 9,781
15 votes
5 answers
3k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
Clay Freeman's user avatar
15 votes
2 answers
1k views

When do shared disks "leak" data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
makerofthings7's user avatar
14 votes
9 answers
4k views

Is there any asymmetrically encrypted file system?

Is there a file system providing a directory where everybody can write, but only the directory owner can read the files? In theory it could be done by encrypting using the public key while writing, ...
maaartinus's user avatar
14 votes
4 answers
19k views

Unlock hard drive vs full-disk encryption

When I turn my notebook on, it asks me for the password to unlock the BIOS and than it asks me for the password to unlock the hard drive. How different is this 'password to unlock the hard drive' ...
Strapakowsky's user avatar
  • 3,089
13 votes
1 answer
14k views

XTS vs AES-CBC with ESSIV for file-based filesystem encryption

In a blog post I recently read called "You Don't Want XTS," the author explains some of the pitfalls of using XTS to encrypt filesystems. Specifically, he recommends against ever sharing encrypted ...
Naftuli Kay's user avatar
  • 6,793
13 votes
3 answers
12k views

Encrypting the /boot partition in a Linux system can protect from an Evil Maid Attack?

If the boot partition is encrypted (and the passphrase to unlock the device must be entered in GRUB before the boot sequence starts) is the system considerable safe from an Evil Maid Attack?
TheMoltenJack's user avatar
13 votes
3 answers
12k views

LUKS, how to make strongest possible and reasonable passphrase?

Let us say I have a volume encrypted under LUKS with a 512-bit key. That would mean there are 2 ^ 512 possible values which the key may be. Now I need a passphrase which is at least as resistant to ...
Radmilla Mustafa's user avatar
13 votes
1 answer
35k views

VeraCrypt PIM feature - Is it really necessary?

I am looking to encrypt my OS hard drive, and VeraCrypt caught my eye as a real good option. I tried to encrypt my drive with it, and the resulting encrypted system, takes around a minute to decrypt. ...
Yoav R.'s user avatar
  • 249
12 votes
4 answers
8k views

Is looking for plain text strings on an encrypted disk a good test?

I have a dual boot PC, where the Win10 (uncompressed) partition is encrypted with BitLocker. I was curious about making this test (and also encryption took quite a short time in my opinion), so while ...
golimar's user avatar
  • 239
12 votes
2 answers
9k views

How to encrypt data on the server?

I have some data on the server (running Linux) which needs to be encrypted (company policy). This data is being served by an application running on this machine. Now I consider a few possibilities: 1)...
Janek's user avatar
  • 223

1
2 3 4 5
13