What's Missing From File / Disk Encryption?

lockDrive asks: "Every month, we read a news about personal information leak. Most of the time, either a laptop or a hard disk that contains sensitive information is stolen from a government or corporate office, and the data are not encrypted. Recently, Department of Veterans Affairs had lost a laptop which contained confidential information for 26.5 million veterans. The data were not encrypted. There are many products that provide a solution to such a problem. Microsoft Encrypting File System (EFS), which comes with Windows 2000 and later, encrypts data in a file system and seems to have a decent key recovery system in Windows 2003 Server CA. Products like SecureDoc and DriveCrypt encrypt an entire disk. I have tried some of them and they are not that difficult to use. What is holding people who handle sensitive information (government, health-care, insurance ...) back from encrypting their data? Are the products still too hard to use? Are they concerned about performance loss? Are they not convinced with the security gain? Are they just not adopting the technology quickly? Is there anything missing in the technology?"

Comments

And along those lines

[Sycraft-fu]

How about corrupted data recovery? Say I have a document, and 15 bytes are damaged and unrecoverable. No problem, I still want it because it's important. If it's unencrypted, that is unproblematic. Whatever those 15 bytes were is damaged and I'll have to fix, the rest of it is there. What about the encryption? Can it handle decrypting partially damaged files, or will it fail?

Re:-truecrypt?

[Merlynnus]

Nonsense. I use Truecrypt, and have encrypted a whole drive. *Nothing* on it is unencrypted. It has no partition table. Any sort of analysis of it would show that it is complete indistinguishible from random noise. Taken out of the workstation that it currently resides in, it would be completely and utterly secure. And, unintelligible. Granted, it's not the boot drive, but so what?

I also wonder about "...and realize that there is an encrypted partion...". Again, so what? Unless you've chosen an insecure passphrase, or give up the passphrase through some manner of coersion with the strong encryption algorithms, it doesn't matter if someone realizes there might be more to the noise or not. And, if you're really worried about it, Truecrypt allows you to create truely hidden encrypted areas.

I suggest reading the fine manual that comes with Truecrypt and studying the bit about plausible deniability. And the bit about encrypting whole devices. *Then* come back and bring a informed opinion.

The fact of the matter is that the technical problems have been mostly addressed. The problem is that the wetware doesn't follow reasonable data security policies.

Re:-truecrypt?

[peacefinder]

Truecrypt has a clever dodge for this. They offer the ability to make a hidden encrypted volume. They do this by making an encrypted volume, and filling its blank space with random data. Yet inside of that random-filled blank space is another truecrypt container, which holds deniable data. If you don't know the key, you never see anything other than random padding in that blank space. See their page on it here.

Integrity of the inner volume seems quite fragile, due to the possibility of it being overwritten through the outer volume, but aside from that it seems like a good plan.

Re:Cooperation between Linux and Windows?

[jzono1]

Truecrypt does what you want.

http://truecrypt.sf.net/

Re:Cooperation between Linux and Windows?

[bored_engineer]

You only mention windows and Linux. Truecrypt supports those two operating systems. Future support for OSX is planned.

Re:Full disk encryption unavailable to some of us

[Anonymous Coward]

So true, that full disk encryption isn't available.....

Funnily enough, I think this was a well thought out post ...

To evoke evanglical apple fanboys, at any rate ..... here's some factual information for any others who might want to know about OS X encryption -

Most applications keep the data in the /Users/MyUser folder. FileVault creates an encrytped image that mounts using that directory as it's mountpoint, and all applications keep working data and saved files in it. your login password is your encryption key.

Note that there's also an applications directory inside of your user directory, if you want to be Ubersure that everything the app does, including itself, is encrypted on disk.

Also, with swapfile encrypting, the net effect is that all working and used data is encrypted.

Even standalone DMGs can be created that are encrytped with read/write access, so you can store applications inside encrypted DMGs if you ... for some obsecene reason, want to store them outside of the users's application folder and yet need it encrypted...

And yes, i realize i made some errors in my english, don't harp on it, it's a damn sight better then most japanese people's english.

Re:encryption is a speed bump.

[Nutria]

Out here in the real world, you're not going to crack correctly-applied encryption in your lifetime,

You'd better re-think that bold assertion...

http://en.wikipedia.org/wiki/Data_Encryption_Stand ard#Security_and_cryptanalysis

The feasibility of cracking DES quickly was demonstrated in 1998 when a custom DES-cracker was built by the Electronic Frontier Foundation (EFF), a cyberspace civil rights group, at the cost of approximately US$250,000 (see EFF DES cracker). ... The machine brute-forced a key in a little more than 2 days' search; at about the same time at least one attorney from the US Justice Department was announcing that DES was unbreakable.

But it's only DES, you say!!! So. It is a correctly-encrypted text, and it was cracked in 56 hours.

http://en.wikipedia.org/wiki/EFF_DES_cracker

Six months later, in response to RSA Security's DES Challenge III, in collaboration with Distributed.net, the EFF used Deep Crack to decrypt another DES-encrypted message, winning another $10,000. This time, the operation took less than a day -- 22 hours and 15 minutes.

Re:How about a distro w/ initial install support

[javifs]

It will be integrated in the latest version of the Debian installer, IIRC, it will be in 'etch beta 3'. Which should be available soon (check out the PartmanCrypto stuff in the wiki and the Debian Installer pages). Since Ubuntu uses a derived version from the installer, they will presumely pick this up once it is finished.

Here's an idea:

[Ayanami Rei]

Take a simple linux install disk that uses initrd of your choice and comes with cryptoloop.
Modify the initrd so it asks for a password before setting up the "real" root device on your harddrive.
Burn the install CD with the modified initrd. Install linux using this disk (so it installs onto the now-encrypted hard drive)
In order to use the system, you'll have to insert the install CD and use it as a boot CD everytime. But in this fashion no un-encrypted data is on any of your hard drives. To remove evidence that you can even access it, remove the CD when you're done using the computer, and store it in an inconspicous place.

If you prefer using windows, deal with linux to the point you can install QEMU or VMWare. Install Windows normally in the virtual environment and it is encrypted as well (including the swap file!).