Slashdot Mirror

For years now, it has been possible to get hardware encryption for ATA drives that operates at above maximum ATA spec speed, i.e. it is totally transparent and does not cause any reduction in performance.

The cheap stuff only uses 3DES and they key is a USB thumb drive type device, not very secure. But you can get AES capable devices which use password hashes supplied by the BIOS. Something like this... http://www.enovatech.net/products/mx_info.htm

http://www.enovatech.net/

128-bit and 192-bit AES are available. Comes with 3 duplicate hardware keys. No performance degredation. Good key generation and database policies (they destroy it after making the keys).

They even have cards to handle multiple PATA or SATA RAID channels.

http://www.enovatech.net/

128-bit and 192-bit AES are available.

They even have cards to handle multiple PATA or SATA RAID channels.

This is the first level. Hard drive is encrypted from the word go.

This is the second level. Everything on the hard drive from boot onwards is encrypted in software.

This is the third level. Everything you need to store in encrypted containers you can quite easily. You can also encrypt files and then store them in encrypted containers to add a fourth level.

Using all of these, no hack will open the system to unauthorized use. You need the physical and software keys and the password. Without them there's no chance of recovery in this lifetime with any computer technology now or forseen within the next century that will break all of it without the entire resources of the planet being turned to the job for a period slightly in excess of the sun's remaining lifespan.

You can also get hardware encrypted external drives as well and use multiple layers of software encryption on them.

To address the main post, like who didn't know the best way to gain access to a system was to physically pwn it? I mean, really...

(It's just that with prudent countermeasures and the machines not being left on and requiring all authentication for decryption from start to finish, that point is moot.)

The manufacturer of the card is actually eNova at http://www.enovatech.net (See the X-Wall SE entry in Whats New, and Patent Pending Architecture in Technologies). They have a range of products including a notebook with this product installed.

While the ABIT 40bit DES version is good for simple security to keep people off the computer, for free its a nice add on. Enova has those nice 192bit Triple DES cards or Bay slots that look more upto the task.

I think if I was really paranoid, I'd setup something like the following.

Linux server running Rubberhose encrypted filesystem with Enova's 192bit triple DES secure bay kit.

Then on your PC using PGPDisk or Bestcrypt volume on a SMB share over IPSEC and maybe even with Stunnel. (Or multiple PC's in a client/server setup)

Then for backups, It seems you could do a simple dd to a tape drive. Too many encryption layers on the backup to restore without the proper settings and software. Should be pretty safe.

Pretty much all simple software thats easy to use, and wouldnt take too much setup. Just need a way to have the Enova's keys use timebased passphrases, and I'd feel it was secure enough.

On 1 single pc, rubberhose+bestcrypt would be my choice.

Actually, according to the chip mfg. eNova "Government-certified DES and TDES algorithms assure high level security." They also have make a PCI add on card for existing systems and a USB HD case for portable encryption.

Actually, according to the chip mfg. eNova "Government-certified DES and TDES algorithms assure high level security." They also have make a PCI add on card for existing systems and a USB HD case for portable encryption.

Actually, according to the chip mfg. eNova "Government-certified DES and TDES algorithms assure high level security." They also have make a PCI add on card for existing systems and a USB HD case for portable encryption.

Actually, according to the chip mfg. eNova "Government-certified DES and TDES algorithms assure high level security." They also have make a PCI add on card for existing systems and a USB HD case for portable encryption.

There's another nice product there as well:

http://www.enovatech.net/html/ps_mobile.htm

It's a mobile HD rack with the key/encryption hardware built-into it. Sounds reasonably secure too. From the site:

- Real-time hardware based encryption with 1-1Gigabit per second throughput and zero performance degradation
- NIST Certified DES 64-bit and TDES 128/192-bit encryption engine
- Automatic transparent operation encrypts entire hard drive bit-by-bit, including Boot Sector and OS
- Portable X-Wall Secure Key for BIOS level user authentication and access control
- Operating System and software independent ; does not require device drivers

Sounds like a nice product. With bandwidth in the gigabit range, it isn't going to be a problem on any mechanical storage device.

Regular DES is pretty weak though... Triple DES is reasonably secure though, assuming those are actually the key-lengths shown, and not just marketingspeak. If the price is right, I could see this type of gear becoming quite popular.

Law enforcement would hate it though. Assuming they couldn't get ahold of the key before it was destroyed, they'd be TSOL as far as getting anything out of the drive.

N.

actually, 64bit DES and 128/192 bit Triple DES, according to the chipset maker, Enova Technologies

Actually, it seems to do 64bit DES and 128/192 bit Triple DES according to the chipset's manfucaturer Enova Technologies.
Here's a drive bay adapter by same, which uses an external key, I can't tell about the motherboard, though.

Actually, it seems to do 64bit DES and 128/192 bit Triple DES according to the chipset's manfucaturer Enova Technologies.
Here's a drive bay adapter by same, which uses an external key, I can't tell about the motherboard, though.