Slashdot Mirror

← Back to Stories (view on slashdot.org)

How Does Win2k's Encrypted File System Really Work?

Posted by Cliff on from the digging-into-the-details dept.

cyberbrian asks: "At work, I administer Windows NT 4.0 and 2000 servers and I have been researching Win 2000's EFS (Encrypted File System) and I have detected some Very Odd Behavior. I am currently leaning towards using PGP Disk instead of EFS but I really want to know what is going on here. For instance, one of the tests I made is that I backed up an encrypted file and restored it to a FAT partition. The resulting file had zero bytes. For true encryption, shouldn't there be data in the file, but scrambled according to the encryption algorythem and key file? IMHO, Microsoft may not be using encryption at all, but instead perhaps the "encryption" is actually a hidden NTFS deny/allow permission that is tied to a certificate. Has anyone tested this by trying to decrypt a EFS file under Linux? Also, I would be very interested in any URLs people could point me to where this is explained in detail."

2 of 26 comments (clear)

  1. artstechnica EFS information by atomice · · Score: 4, Insightful

    This like on arstechnica has some information on Windows 2000 EFS:
    http://www.arstechnica.com/paedia/n/ntfs/ntfs5-3 .h tml
    To quote from the above article:
    "EFS uses a public key crypto scheme, which uses a public and private key. Encrypting a file will cause EFS to assign that file a randomly generated FEK (file encryption key). The user that encrypts this file does so with their public key, but to decrypt that file requires the usage of their private key to authenticate past the file's randomly generated FEK. DDFs (Data Decryption Fields) and DRFs (Data Recovery Fields) exist as NTFS attributes, storing a list of FEKs. Public and private keys are stored separately from the FEKs. "
    but also note this warning on www.sysinternals.com:
    "Even when you encrypt files with Win2K's Encrypting File System (EFS), a file's original unencrypted file data is left on the disk after a new encrypted version of the file is created."

  2. Funny how... by Anonymous Coward · · Score: 2, Insightful

    ...you can make a baseless disparaging comment (refuted by a quick search, BTW) about MS without any backing and be marked 'interesting' for it. Try posting TRUE negatives about Linux, and you're modded down.

    Loooooooooooove the moderation guys. Keep up the good work, pretty soon you'll silence all the reasonable voices.