Full Disclosure mailing list archives
RE: harddisk encryption
From: <Glenn_Everhart () bankone com>
Date: Tue, 15 Feb 2005 11:39:42 -0500
Comments on hard drive encryptors: 1. If the encryptor encrypts your boot disk, it has to be involved early in the boot process and may be broken by anything that changes the system boot sequence. On the whole such a product would likely need two different drivers, one of which would change BIOS behavior, and the other of which would change runtime OS behavior, and they must be in synch with one another. This is fine until you decide to change operating systems, at which point the boot may change and make your old data suddenly disappear. Things on the other hand are easier if the encrypting disk product only encrypts data devices (including virtual disks) since only one driver need be used. 2. In the event of disk crash or emergency, unless a tool is provided to allow you to access the encrypted disk from somewhere else, anything which causes an OS to become non bootable may be unfixable. You would not normally want such a tool online, but when you need it, you REALLY need it. 3. If a product says it can encrypt local disks but not network ones, you may want to know what exactly is going on. Something that exists just above the hardware control layer would be expected to produce disk structures which would share across networks normally when the encryption keys had been entered. If some OS layers cannot see the disk as a normal disk, some programs may also be affected. 4. An interesting question to ask of such a package is whether the data in any disk block is a cipher depending only on a fixed key and the original data. If so, and the same key is used for every block, there are attacks which can be used to compromise such a system without having to decrypt it all. If on the other hand something else is an input, you need to know what else is used and how it is used and how key scheduling is done, to make any estimate of how strong the cipher really is. (Now mind: most of the attackers will not be cryptanalysts, and thus even a cipher that cryptanalysts laugh at has value in discouraging curious system admins, PHBs, or others who may be able to get privileged access to a box but lack knowledge or time to crack the cipher. A vendor or author who acknowledges this is not vending snake oil...just admitting limitations of some methods.) The Ultimaco literature suggests that many users may have different passwords to access a computer disk protected by its package. If I were buying it in bulk I would certainly want to know more about how the key management is done to allow this. Over the long term, leakage of some sensitive data onto swap files is often a very minor exposure compared to what is protected with an encrypted virtual disk, and its continued function generally is easier to maintain than anything that has to deal with both boot and runtime OS environments...and not much different in training requirements. Remember too there are in Windows some registry controls that allow the swap file to be wiped on shutdown. -----Original Message----- From: full-disclosure-bounces () lists netsys com [mailto:full-disclosure-bounces () lists netsys com]On Behalf Of Lentila de Vultur Sent: Tuesday, February 15, 2005 10:05 AM To: full-disclosure () lists netsys com Subject: [Full-disclosure] harddisk encryption hi, sorry for my late answer and for breaking the thread. below you can find the original post: <> i'm evaluating a software that performs harddisk encryption for deploying in my company. the software in question is utimaco safeguard easy v4.10 (www.utimaco.com) running on w2k. i am interested in communitty's oppinion about this product. has anyone performed a detailed analysis of it? i googled around but i couldn't find much information, except that the version 3.20 sr1 has earned an eal3 certification from the german federal agency for it security. </> thank you for all your answers and suggestions on and off the list. what i like at safeguard easy are the possibility to encrypt full harddisks, not only files or partitions, and the boot authentication. Frank Knobbe suggested encryption plus hard disk from pc guardian - I asked for an evaluation copy. google suggested also drive crypt plus pack - www.securstar.com. imho, the main disadvantage of pgpdisk and alike compared with full-encryption tools is that valuable data can remain unencrypted in the swap file or in temporary files outside the container. When using full harddisk encryption tools no extra user interaction is required, everything is done transparently. there is no need for user training. -- this e-mail is certified content-free. Lassen Sie Ihren Gedanken freien Lauf... z.B. per FreeSMS GMX bietet bis zu 100 FreeSMS/Monat: http://www.gmx.net/de/go/mail _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ********************************************************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you ********************************************************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- harddisk encryption Lentila de Vultur (Feb 15)
- Re: harddisk encryption Bill Miller (Feb 15)
- <Possible follow-ups>
- RE: harddisk encryption Glenn_Everhart (Feb 15)
- RE: harddisk encryption Lentila de Vultur (Feb 16)
- Harddisk encryption Dyke, Tim (Feb 15)
- Re: Harddisk encryption Valdis . Kletnieks (Feb 15)