Slashdot Mirror
Basics of Cryptographic Filesystems
mix_master_mike writes "Found a good article over at security focus: cryptographic filesystems: design and implementation. Nice piece on this level of security that isn't being used very effectively in the industry."
That will not get expensive. Swap space is usually only twice as big as your RAM, but if you've got way more RAM than you already need, you don't need it at all.
Just add the RAM and be done with it.
If tits were wings it'd be flying around.
Maybe its largely unused because servers etc which are the biggest use of "the industry" aswell as workstations are supposed to be physically secure anyways and when in use the crypto-filesystems would be running unencrypted.
Crypted filesystems have their uses but they arent as many as one would imagine. Laptops for instance should have it by default. That should be remedied. But as long as there arent crypto offloading chipsets by default it wont be widely used because of fear to loose speed. Also its not easy enough to use yet..
What if I yank out the powercord ? ;-)
How is the OS gonna cope with that, then I dissect your computer and connect your harddrive (including your swapspace) into my computer and find all the little pieces and nuggets of information that I need to fry your ass
The problem with encrypted filesystems is that, in order to decrypt them, you need some kind of large, ungainly key. Those keys are not justthe kind fo thing you memorize and type in when you boot up the system, so they have to be stored someshere. If they are stored on the disk, in an unencrypted partition, then you no longer are very secure... if they are stored on some kind of physical key, like a USB token, then you are safe if you turn the machine off and you head home, but unless you plan to paged to come into work and plug in your token every time the machine wants to swap Mozilla out of memory, you're probably going to be leaving it plugged in most of the time, and then you are back to leaving the key around for people to grab. And with all of this, you then have the issue of how to recover the system when your usb token burns out or the partition with your key gets corrupted.
Just add the RAM and be done with it.
Not that simple in practice. I'm not sure why but some OSes (Windows and MaxOS at least not sure about *nix) don't perform well without swap space even if you are not using all your physical memory.
While the idea of securing a whole filesystem by using cryptography is a great idea, I have reservations on how it will effect performance. Most secure algorithms tend to be rather slow in operation. Examples include DES, AES, RSA, etc. While this is not to bad when its just decrypting small files, it seems like this could quickly hurt performance with lots of commonly used small files and larger files.
I do understand that many computers sit around idle many times when having to access disk, but it still seems like this will hurt since I will now have to wait for loading and decrypting of the file into memory. Frankly although 2+ GHz of chip speed is nice, I still find times when my computer does not feel fast enough. (Compiling code, editing images, etc).
On the other hand, not everything has to be encrypted, just user files for instance. So it might be possible to find a decent middle ground. However, there still is that problem with the keys laying around on the disk or on usb devices.
Reserved Word.