Slashdot Mirror
Basics of Cryptographic Filesystems
mix_master_mike writes "Found a good article over at security focus: cryptographic filesystems: design and implementation. Nice piece on this level of security that isn't being used very effectively in the industry."
Maybe its largely unused because servers etc which are the biggest use of "the industry" aswell as workstations are supposed to be physically secure anyways and when in use the crypto-filesystems would be running unencrypted.
Crypted filesystems have their uses but they arent as many as one would imagine. Laptops for instance should have it by default. That should be remedied. But as long as there arent crypto offloading chipsets by default it wont be widely used because of fear to loose speed. Also its not easy enough to use yet..
What if I yank out the powercord ? ;-)
How is the OS gonna cope with that, then I dissect your computer and connect your harddrive (including your swapspace) into my computer and find all the little pieces and nuggets of information that I need to fry your ass
The problem with encrypted filesystems is that, in order to decrypt them, you need some kind of large, ungainly key. Those keys are not justthe kind fo thing you memorize and type in when you boot up the system, so they have to be stored someshere. If they are stored on the disk, in an unencrypted partition, then you no longer are very secure... if they are stored on some kind of physical key, like a USB token, then you are safe if you turn the machine off and you head home, but unless you plan to paged to come into work and plug in your token every time the machine wants to swap Mozilla out of memory, you're probably going to be leaving it plugged in most of the time, and then you are back to leaving the key around for people to grab. And with all of this, you then have the issue of how to recover the system when your usb token burns out or the partition with your key gets corrupted.
Motherboard chipsets need to include crypto accelerators. If that was done, all the filesystem encryption/decryption stuff can be done in hardware, and therefore it shouldn't really slow the system at all. If combined with some intelligent caching, it could probably be faster than the harddrive access we have now. Anyone know of a motherboard chipset that does crypto acceleration?