Slashdot Mirror
Full Disk Encryption Hard For Law Enforcement To Crack
If you'd rather keep your data private, take heart: disk encryption is a lot harder to break than techno-thriller movies and TV shows make it out to be, to the chagrin of some branches of law enforcement.
MrSeb writes with word of a paper titled "The growing impact of full disk encryption on digital forensics" [abstract here to paywalled article] that illustrates just how difficult it is. According to the paper, co-authored by a member of US-CERT, "[T]here are three main problems with full disk encryption (FDE): First, evidence-gathering goons can turn off the computer (for transportation) without realizing it's encrypted, and thus can't get back at the data (unless the arrestee gives up his password, which he doesn't have to do); second, if the analysis team doesn't know that the disk is encrypted, it can waste hours trying to read something that's ultimately unreadable; and finally, in the case of hardware-level disk encryption, tampering with the device can trigger self-destruction of the data. The paper does go on to suggest some ways to ameliorate these issues, but ultimately the researchers aren't hopeful: 'Research is needed to develop new techniques and technology for breaking or bypassing full disk encryption.'"
I wish this was the case in the UK, any encryption keys have to be handed over when asked by the police or .Gov
well we [the industry] will be just happy selling encryption with the tagline: so secure - no one can break it - except your average McForensic dude with a software package you can torrent. See, secure!
CS majors know the time/space tradeoff, but they never get taught the 3rd, crucial, tradeoff of the set: comprehension!
http://imgs.xkcd.com/comics/security.png
Why are other peoples sig's always more witty ???
Comment removed based on user account deletion
(unless the arrestee gives up his password, which he doesn't have to do);
In the UK he does. And people have been punished for not handing it over.
I forgot where, but I had heard DDR3 RAM will last over an hour and still retain 99% of its data (although it'll be completely inverted after a certain time). I suspected something similar for DDR2 (which I have).
So how are we to know that this isn't anti-FUD?
"Yes, Citizen, your full disk encryption is just too much for us to crack. I guess you're in the clear."
load "linux",8,1
The encryption might be practically unbreakable but that doesn't help a lot. Around here police just break into homes to install hardware or software keyloggers. Sure, that may not be exactly legal for them to do, but they don't care because they know nothing will happen to them.
RAM can hold a copy of the last data held for a good 5 seconds if warm and up to +20mins of frozen,
so it could be chilled/frozen using compressed air, removed and placed into a reader that dumps the ram memory to disk.
Laters Sol "Have you found the secrets of the universe? Asked Zebade "I'm sure I left them here somewhere"
I mean ... what's the point of encryption that your foes, police or otherwise, can bypass?
"Who is the Journal of Quantum Physics going to believe?" --Stephen Hawking
Wow. Did a stick figure run over your dog or something?
You are in violation of the laws forbidding the manufacture, sale and possession of chilled prawnography.
Countries that respect and protect a right to free speech would not outlaw such a system, but unfortunately such countries are few and far between. Deniable encryption encryption works in theory, but in practice the existence of non-deniable encryption makes it hard for people to claim that they are innocent users of a deniable encryption system. While there are innocent uses of such a system (perhaps your business secrets are so valuable that being tortured for them is not beyond the realm of possibility) they are few and far between; deniable encryption is tool for protecting your data from a government, and for all their talk about China and Iran, most western governments are not interested in having citizens who can secure their communications and data from police investigations.
Palm trees and 8
While I currently do not run full disk encryption on my laptop and I have never done anything to warrant arrest, I have thought about full disk encryption. Especially in these days of a growing police state, it is not my job to make your job easier. If the news stories keep going the way they are, I suspect that within the year, I will simply migrate over with strong encryption and that will be that.
Because I do not like the increasingly adversarial and militarized role the police have been taking. I'm sure I'm not alone. While I do not wear tinfoil, the news events of late give me pause.
--
BMO - shiny side out.
Use biometrics instead of a password.
Your system unlocks via your foreign friend's iris, which you get via his smartphone's camera.
Now, when the police want to get access to your computer, they have to try to extradite your friend. You can't give them a password because there is no password. The only way to unlock your system is if your friend puts his eye up to his smartphone's camera and you put your smartphone up to your computer's iris scanner. They'd have to figure out a way to compel your friend, who lives in a country that may not have extradition treaty with your particular tyrannical hellhole.
Yeah, I know it's inconvenient, but it would be worth it to frustrate the monsters who have seized power.
Of course, by that point they'd probably just use rendition to send you someplace where you'll be tortured, just for making them have to work for a living. US or UK, I don't think there's any line they won't cross. Not any more. There's no longer a pretense to anything like personal rights. Unless your name ends in "Inc." you just don't have rights any more.
You are welcome on my lawn.
For the full report, Google
filetype:pdf "The growing impact of full disk encryption on digital forensics"
Don't mess with The Phone Company. Piss them off and you'll be using two tin cans and a piece of string.
Encrypted drives do not, obviously, use the password to decode the files. They use the password to decode a key and use that to encode the files.
So I always thought it would be interested to have a computer that, on startup, wipes that part of the disk with 0s, sticking a copy somewhere else on the drive. (Which is not a security risk, because the other parts of the drives are, obviously, encrypted with that key, and you can't open box with a box cutter inside it.)
And during safe shutdown, it puts it back. Or have a program you have to run to put it back, then shutdown.
For safety purposes, you give a copy of the key to someone else for safekeeping. Bonus points if they're out of the country.
Then you leave your computer on, and the screen locked, at all times. Bonus points if you rig it to an alarm where if someone breaks in, it cuts the power. (Also have it do the same if someone inserts firewire or USB while the screen is locked.)
Now it doesn't matter how much you're ordered to comply with the police. They come in, cut the power to your computer, make a disk image...and you'll tell them the damn password all they want, but you are rather at a loss as to how they think that will work, considering the part of the drive with the key stored is has apparently been filled with 0s. (You'll need a lawyer able to explain that what they are asking cannot work.)
Now, like I said, you can lie and pretend you don't know what's going on...or you can wait until they get a court order to have you decrypt, and then tell them what's going on. By which point your friend has hopefully already destroyed the key.
And the joke is, even if you explain everything that happened, this is entirely legal. You have not destroyed any evidence, because the key was already missing from the unencrypted part of the drive when the warrant showed up. (Unlike some of the automated 'destroy data' traps that people try to come up with.) And you have cooperated fully, you literally cannot get to the data. And your friend didn't destroy evidence, because the search warrant was for your stuff, he can delete of his own files he wants until he is told otherwise.
If corporations are people, aren't stockholders guilty of slavery?
You want to do someone in, and have access to their computer, a USB program that creates an encrypted partition would be enough to do one in. Proving one's innocence would probably be near impossible.
Within 10-20 years after that any conventional (e.g. what most PCs today are capable of) encryption other than one-time-pads or the like will be breakable.
Uh, no. Quantum computers can brute-force conventional encryption in about the square root of the time taken by a conventional computer. Doubling the key size is much easier than building a quantum computer of a usable capability.
This is precisely why AES has a 256-bit key option when conventional computers could never break a 128-bit key anyway. AES256 is about as difficult to brute-force with a quantum computer as AES128 is with a conventional computer.
"Research is needed to develop new techniques and technology for breaking or bypassing full disk encryption."
And, if they somehow manage that, research will be needed to develop new techniques and technology for creating even stronger encryption.
Filthy, filthy copyrapists!
Except modern drive recovery can restore the blanked out sector.
Uh, no.
It has never, despite it being 'common wisdom', been possible to recover overwritten sectors on a hard drive.
No one has ever demonstrated it in the entire history of hard drives.
It was a theoretical attack a long time ago, on pre-IDE 'MFM' hard drives.But we moved off that sort of drive in 1986.
And even then, it didn't work. It was a theory that said with a very poorly build hard drive, it might be possible to recover some data. Like I said, no one's ever actually shown this.
And with IDE, we moved to RLL encoding which means, statistically, you couldn't get anything. With an MFM encoded drives, if you got 50% of the data with 50% accuracy, you had 25% of the data and might possibly come up with something, although, like I said, no one ever has managed this.
But with RLL encoded drives, if you got 50% of the data with 50% accuracy, you have nothing. It is not really possible to get a partial byte.
No that anyone has ever demonstrated reading anything from a ' The idea that you need to do anything more than overwrite a sector to make it unreadable is one of those zombie lies that simply cannot die.
The only way to recover a lost sector is if it was going bad at some point, so the hard drive made a copy of it and remapped that sector to the copy. Which means the original might still be there. (OTOH, the original was going bad, so who knows if it's still readable.) The odds of this happening are astronomical.
If corporations are people, aren't stockholders guilty of slavery?