Anarchopedia - User contributions [en]

OTFE

2009-01-01T15:30:47Z

SecurityReview: Redirect

#REDIRECT [[hard disk encryption]]

hard disk encryption

2009-01-01T15:30:36Z

SecurityReview: aka

See also: [[cryptography]] | [[Encrypting_Your|Encrypting Your...]] | [[Cryptography/Attacks]] | [[Undelete_Attack|Undelete Attack]]

AKA: Volume Encryption, transparent encryption, on-the-fly encryption (OTFE)

A secure container [[file]] on a disk, meant to hide [[information]] that, when opened with a [[password (computing)|password]], is treated as a separate disk (for instance the H:\ drive). This is preferable to normal file encryption as the operations of encryption and decryption are transparent to the user.

This [[software]] is popular on [[laptop]]s, which are often stolen and can carry sensitive financial information.

=How it works=

Hard Disk Encryption programs run a memory-resident program is in the background, acting as an interpreter between the container file and the rest of the computer. Without the memory resident program and password, the file is indistiguishable from [[Random|random]] [[Data|data]].

If the program is shut down, hard drive is removed suddenly, or system turned off, the volume is secure depending on the underlying [[filesystem]]. These days, filesystems support journaling and atomic writes hence this is of little concern.

Most implementations are vulnerable to dictionary attacks though. Also, if the source is not open, one is arguably more vulnerable because it is not known to the public how the program exactly works. It could be [[backdoor (computing)|backdoored]].

= Software =

===Windows===

# [http://www.jetico.com Bestcrypt] - proprietary program. Windows and Linux versions, very stable, doesn't appear to lose data over an extended period. Modules for all major encryption algorithms. Finland (not USA) origins.
# [http://www.scherrer.cc/crypt/ CrossCrypt] - [[free software|Free Software]], [[open source software|open-source]] implementation of [[AES]] and [[Twofish]] for Windows 2000/XP. Compatible with Linux AES/Twofish. Use either as a command-line based system, or download [http://www.sdean12.org/CrossCryptGUI.htm CrossCryptGUI], a [[GUI]] [[Front-End]] for it
# [http://www.cypherix.com/cryptainerle/index.htm Cyptainer LE] - easy-to-use, nag-free commercial software but with a size limit of 25 megs.
# [http://www.secureaction.com/cryptoexpert/std/ CryptoExpert 2004 PE] - A commercial disk encryption tool. A professional version also available.
# [http://www.dekart.com/products/file_disk_encryption/private_disk/ Dekart Private Disk] - [[AES]] encryption, flexible and easy to use - Shareware - 95/98/ME/NT/2000/XP. Allows securing hard disks and USB flash disks, runs from USB disk with no host PC installation. Provides innovative Disk Firewall mechanism - protecting access to the encrypted disk application by application. Disk firewall allows creating a white list of applications allowed to access the encrypted disk making sure that no trojans or any spyware will harm the secured data.
# [http://www.drivecrypt.com/ DriveCrypt] - commercial software for Windows
# [http://www.woundedmoon.org/win32/e4m202a.html E4M] - Encryption for the Masses. [[Freeware]] product (no longer being developed) for Windows NT.
# [http://www.FreeOTFE.org/ FreeOTFE] - [[free software|Free]], [[open source software|open source]] encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Provides two-level [[deniable encryption|plausible deniability]] (including [http://www.freeotfe.org/docs/plausible_deniability.htm hidden volumes]). Supoprts backup of critical information needed to restore volumes. Additionally supports [[Linux]] Cryptoloop "losetup", dm-crypt and LUKS volumes. Includes ''many'' different cypher and hash algorithms, including [[AES]], [[Twofish]], [[Serpent]], [[Blowfish]], etc. Highly flexible and easy to use. Allows the use of optional PKCS#11 standard tokens (e.g. Aladdin eToken and smartcards) Supports both Windows 2K/XP/2003/Vista and Windows Mobile/PocketPC PDAs
# [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for Windows and Mac OS X. [http://www.pgpi.org/products/pgpdisk/ PGP v6.0.1] includes PGPDisk for free
# [http://www.utimaco.us/products/easy/ SafeGuard Easy] - Commercial versions for Windows. Encrypts the entire disk with pre-boot authentication
# [http://www.utimaco.us/products/privatedisk/ SafeGuard PrivateDisk] - Commercial versions for Windows Personal and Enterprise Edition (with centralized management for enterprise customers)
# [http://www.scramdisk.clara.net/ Scramdisk] - free for Windows 9x but not the Windows NT
# [http://www.cs.auckland.ac.nz/~pgut001/sfs/ SFS] - Outdated, free, secure File System for DOS/Windows 3.1. Requires some configuration. Has not been updated since September of 1996.
# [http://www.truecrypt.org TrueCrypt] - [[free software|Free]], [[open source software|open source]], based on the now obsolete [http://www.woundedmoon.org/win32/e4m202a.html E4M]. Provides two-level [[deniable encryption|plausible deniability]] (including [http://www.truecrypt.org/hiddenvolume.php hidden volumes]). Encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Supports [[Microsoft Windows|Windows]] XP/2000/2003 and [[GNU/Linux]]. [[AES]], [[Twofish]] and [[Serpent]] and some combinations of them.
# [http://www.ritlabs.com/en/products/pd/ The Bat! Private Disk] - [[Shareware]], (appears to be the same or similar to Dekart Private Disk). [[AES]] on-the-fly encryption. Super fast, easy to use. Size Limit: 2[[/wiki/index.php?|GB]] for Windows 95/98/ME and up to 4[[/wiki/index.php?|TB]] for Windows NT/2000/XP.

===PDAs===

# [http://www.FreeOTFE.org/ FreeOTFE4PDA] - [[free software|Free]], [[open source software|open source]] creates encrypted file-hosted containers. Supports hidden volumes. Supoprts backup of critical information needed to restore volumes. Additionally supports [[Linux]] Cryptoloop "losetup", dm-crypt and LUKS volumes. A PC version available (FreeOTFE) which is fully compatible is also freely available

=== Mac OS ===

# [http://www.pgpi.org/products/pgpdisk/ PGP Disk 6.0.1] - Free for Windows and Mac OS 8+, taken from an old version of commercial [[PGP]].
# [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for Windows and Mac OS X

Note: Mac OS X version 10.3+ allows for integrated encryption of one's home directory.

=== For UNIX-like systems ===

# [http://www.jetico.com Bestcrypt] - proprietary program, see description under Windows version.
# [http://www.netbsd.org/guide/en/chap-cgd.html cgd] - cryptographic device driver for NetBSD. Unlike other implementations, not vulnerable to dictionary attacks. [http://www.imrryr.org/~elric/cgd/cgd.pdf Here] is a extensive [[PDF]] article concerning CGD by the authors.
# [http://www.kerneli.org CryptoAPI] The GNU/Linux Crypto [[API]]
# [http://www.crypto.com/software Crypto File System] (an encrypting [[File_system|file system]] for Unix-like OSs) -- The FS code dates back to 1989, and the crypto to 1992.
# [http://www.saout.de/misc/dm-crypt/ dm-crypt] - CryptoLoop's [http://kerneltrap.org/node/view/2433 successor]. For Linux.

# [http://arg0.net/users/vgough/encfs.html EncFS] - User-space encrypted filesystem implementation for Linux 2.4 & 2.6. It has some advantages over other implementations, namely the dynamic size. Other (dis)advantages are stated on the homepage as well as a comparison between EncFS and other encrypted filesystem implementations on site.
# [http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html/ GEOM Based Disk Encryption (gbde)] FreeBSD encryption - encrypts the sector payload using 128-bit AES in CBC mode. Each sector on the disk is encrypted with a different AES key. gbde transparently encrypts entire file systems. Mounts just like another drive. View the FreeBSD handbook for instructions.
# [http://loop-aes.sourceforge.net/ Loop-AES] - Uses [[AES]] to encrypt [[/wiki/index.php?|partitions]] under [[Linux|GNU/Linux]]. Fairly simple and effective. No real homepage, so try [http://sourceforge.net/projects/loop-aes http://sourceforge.net/projects/loop-aes]
# [http://www.mcdonald.org.uk/StegFS StegFS] - a [[Stenography|steganographic]] [[Filesystems|file system]] for [[Linux]]. More than just [[Encryption|encryption]], also allows one to hide (parts of) data. Be aware that only using StegFS doesn't provide a secure hiding, additional precautions should be taken; see the [[FAQ]] on the site. Currently for Linux 2.2 only.
# [http://www.tcfs.it TCFS] - Transparent Cryptographic File System is a transparent filesystem for both transparent local and transparent network encryption. It is supported by [[Linux]] 2.0/2.2, NetBSD and OpenBSD -- Has not been updated since late 2002.
# [http://www.truecrypt.org TrueCrypt] - see description under Windows version.
# [http://www.openbsd.org/cgi-bin/man.cgi?query=vnconfig&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html vnconfig] under OpenBSD to configure a [http://www.openbsd.org/cgi-bin/man.cgi?query=svnd&apropos=0&sektion=4&manpath=OpenBSD+Current&arch=i386&format=html svnd] (pseudo-drive) encrypted with [[Blowfish]].
# [http://vncrypt.sourceforge.net/ vncrypt] - FreeBSD container encryption - Uses AES-Rijndael encryption in CBC mode. Utilizes FreeBSDs vnode pseudo disk device support. Is available through the ports collection.

=Notes about Windows security=

# '''Native Folder Encryption''': Although Windows XP Professional and possibly some versions of Windows 2000 provide folder encryption with [[New Technology File System|NTFS]] [[filesystem]]s, they should be considered only a very basic solution. The Window's native encryption is far easier to bypass than the software listed below.
# Hard Disk Encryption is '''not the only solution''' to data security in Windows:
## One of the most important parts is clearing the [[/wiki/index.php?|pagefile]] on shutdown to delete information you only thought was located in your encrypted volumes. [http://www.tech-recipes.com/modules.php?name=Recipes&rx_id=12 Editing your registry] is one option and [http://www.xp-antispy.org/ XP-antispy] is another. Doing so may slow the shutdown process but but will also improve overall system speed.
## Software for cleaning up Windows entirely such as [http://www.webroot.com/products/windowwasher/ Window Washer] or [http://www.google.com/Top/Computers/Software/Shareware/Windows/Security/Internet/Cache_Tools/?il=1 other items].

Also see [[file wipe]] for similar tools.

= Related =
# [[steganography]]
# [[file wipe]]

= Related Links =

# [[Open_Directory_Project|Open Directory Project]] - [http://directory.google.com/Top/Computers/Security/Products_and_Tools/Cryptography/Harddisk_Encryption/?il=1 Hard Disk Encryption]
# [http://www1.cs.columbia.edu/~ezk/research/ Several papers about CryptFS]. Dated from '92 till '03.
# [http://www.linux.org/docs/ldp/howto/Encrypted-Root-Filesystem-HOWTO/ Encrypted Root Filesystem HOWTO]: using strong encryption to secure your root filesystem on Linux.

{{infoanarchy|Hard_Disk_Encryption}}

[[Category:Computing]]
[[Category:Privacy]]
[[Category:Encryption]]

encrypting files

2009-01-01T15:29:58Z

SecurityReview: Fix header

See also: [[Security]] | [[Cryptography]] | [[File]] | [[HOWTOs]] | [[Encrypting Your|Encrypting Your ...]]

== Introduction ==

Many people today require encryption of their personal files for various reasons. Hopefully this node will show you some methods for encrypting and [[obfuscate|obfuscating]] your data to prevent theft, interception and spying.

=== Programs ===

Starting with a program that turns normal files into password-protected ones is the first step. Many programs from Microsoft Word to [[ZIP]]'s portable format use [http://www.stack.nl/~galactus/remailers/index-crack.html inadequate protection]. Advertising high-level encryption does not make a program secure.

* [[PGP]] is one of the most popular encryption programs - mainly due to it's ease of integration with Windows mail clients. Both a freeware version is available, though not for commercial use, and an [[open source]] clone: [[GPG]].
* [http://axcrypt.sourceforge.net/ AxCrypt] - [[open-source]] [[GPL]] program on [[SourceForge]] -- [[compression]] and double-click Edit/View for secure document storage on Windows 95/98/ME/NT/2K/XP, locally or remote using [[AES]].
* [http://mcrypt.hellug.gr/ Mcrypt] - A very simple [[Command Line Interface|command-line]] program with a wide variety of [[algorithms]] and the [[Open-Source|source code is available]]. Can be ported to [[Windows]] with [[Cygwin]]. Intended to be a replacement of the old UNIX "crypt" which used [[DES]], under the [[GPL]].
* [http://www.ashampoo.com/frontend/products/php/product.php?idstring=0104 Ashampoo Privacy Protector] commercial program creates [[extract|self-extracting]] encrypted files. CD burning capabilities. Available in English and German.
* [http://www.rarsoft.com WinRAR] - commercial Windows [[compression]] program - the latest versions use high-strength [[AES]] encryption.
* [http://www.iopus.com/secure-email.htm iOpus SEA tool] - Windows freeware that uses high-strength blowfish encryption to make self-extracting files.
* [http://www.dekart.com/products/file_disk_encryption/secrets_keeper/ Secrets Keeper] - 256-bit AES encryption for Windows Explorer and Microsoft Office including Microsoft Word, Excel and PowerPoint documents.
* [http://www.attachplus.com/ Attach Plus] - Windows shareware - Attach Plus allows you to modify, PDF or ZIP, 128-bit encrypt, and attach your files while you are ataching (or printing) to an existing OR new email message. Supports Outlook, Outlook Express, Goldmine, ACT, Groupwise and Eudora.
* [http://pkware.com PKWARE] - SecureZIP - [[AES-256]] encryption with either pass phrases or digital certificates to protect files on hard drive, laptop, CD's or removable storage as well as to protect email attachments.

=== On The Fly Encryption (OTFE) ===

Aka transparent encryption.

: See: [[Hard Disk Encryption]]

=== More security measures ===

* Recognize that your operating system probably leaves plain text copies of your encrypted data all over the place, but especially in temporary files.
* Note that, facing a well resourced attacker, it is very difficult to safely and securely delete data. (See http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html)
* Use of a [[steganography|steganographic]] file system (see http://www.mcdonald.org.uk/StegFS/)
* For the ultra-paranoid, maybe mention something about [[TEMPEST]] here (see http://www.eskimo.com/~joelm/tempest.html and http://cryptome.org/nsa-tempest.htm. (Though jya.com seems to be down at the moment, so some papers are currently inaccessible.))

{{infoanarchy|Encrypting_Your_Files|Encrypting Your Files}}
[[Category:Encryption]]

hard disk encryption

2009-01-01T15:28:56Z

SecurityReview: Clean up page and put into alphabetical order

See also: [[cryptography]] | [[Encrypting_Your|Encrypting Your...]] | [[Cryptography/Attacks]] | [[Undelete_Attack|Undelete Attack]]

[[AKA]]: Volume Encryption

A secure container [[file]] on a disk, meant to hide [[information]] that, when opened with a [[password (computing)|password]], is treated as a separate disk (for instance the H:\ drive). This is preferable to normal file encryption as the operations of encryption and decryption are transparent to the user.

This [[software]] is popular on [[laptop]]s, which are often stolen and can carry sensitive financial information.

=How it works=

Hard Disk Encryption programs run a memory-resident program is in the background, acting as an interpreter between the container file and the rest of the computer. Without the memory resident program and password, the file is indistiguishable from [[Random|random]] [[Data|data]].

If the program is shut down, hard drive is removed suddenly, or system turned off, the volume is secure depending on the underlying [[filesystem]]. These days, filesystems support journaling and atomic writes hence this is of little concern.

Most implementations are vulnerable to dictionary attacks though. Also, if the source is not open, one is arguably more vulnerable because it is not known to the public how the program exactly works. It could be [[backdoor (computing)|backdoored]].

= Software =

===Windows===

# [http://www.jetico.com Bestcrypt] - proprietary program. Windows and Linux versions, very stable, doesn't appear to lose data over an extended period. Modules for all major encryption algorithms. Finland (not USA) origins.
# [http://www.scherrer.cc/crypt/ CrossCrypt] - [[free software|Free Software]], [[open source software|open-source]] implementation of [[AES]] and [[Twofish]] for Windows 2000/XP. Compatible with Linux AES/Twofish. Use either as a command-line based system, or download [http://www.sdean12.org/CrossCryptGUI.htm CrossCryptGUI], a [[GUI]] [[Front-End]] for it
# [http://www.cypherix.com/cryptainerle/index.htm Cyptainer LE] - easy-to-use, nag-free commercial software but with a size limit of 25 megs.
# [http://www.secureaction.com/cryptoexpert/std/ CryptoExpert 2004 PE] - A commercial disk encryption tool. A professional version also available.
# [http://www.dekart.com/products/file_disk_encryption/private_disk/ Dekart Private Disk] - [[AES]] encryption, flexible and easy to use - Shareware - 95/98/ME/NT/2000/XP. Allows securing hard disks and USB flash disks, runs from USB disk with no host PC installation. Provides innovative Disk Firewall mechanism - protecting access to the encrypted disk application by application. Disk firewall allows creating a white list of applications allowed to access the encrypted disk making sure that no trojans or any spyware will harm the secured data.
# [http://www.drivecrypt.com/ DriveCrypt] - commercial software for Windows
# [http://www.woundedmoon.org/win32/e4m202a.html E4M] - Encryption for the Masses. [[Freeware]] product (no longer being developed) for Windows NT.
# [http://www.FreeOTFE.org/ FreeOTFE] - [[free software|Free]], [[open source software|open source]] encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Provides two-level [[deniable encryption|plausible deniability]] (including [http://www.freeotfe.org/docs/plausible_deniability.htm hidden volumes]). Supoprts backup of critical information needed to restore volumes. Additionally supports [[Linux]] Cryptoloop "losetup", dm-crypt and LUKS volumes. Includes ''many'' different cypher and hash algorithms, including [[AES]], [[Twofish]], [[Serpent]], [[Blowfish]], etc. Highly flexible and easy to use. Allows the use of optional PKCS#11 standard tokens (e.g. Aladdin eToken and smartcards) Supports both Windows 2K/XP/2003/Vista and Windows Mobile/PocketPC PDAs
# [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for Windows and Mac OS X. [http://www.pgpi.org/products/pgpdisk/ PGP v6.0.1] includes PGPDisk for free
# [http://www.utimaco.us/products/easy/ SafeGuard Easy] - Commercial versions for Windows. Encrypts the entire disk with pre-boot authentication
# [http://www.utimaco.us/products/privatedisk/ SafeGuard PrivateDisk] - Commercial versions for Windows Personal and Enterprise Edition (with centralized management for enterprise customers)
# [http://www.scramdisk.clara.net/ Scramdisk] - free for Windows 9x but not the Windows NT
# [http://www.cs.auckland.ac.nz/~pgut001/sfs/ SFS] - Outdated, free, secure File System for DOS/Windows 3.1. Requires some configuration. Has not been updated since September of 1996.
# [http://www.truecrypt.org TrueCrypt] - [[free software|Free]], [[open source software|open source]], based on the now obsolete [http://www.woundedmoon.org/win32/e4m202a.html E4M]. Provides two-level [[deniable encryption|plausible deniability]] (including [http://www.truecrypt.org/hiddenvolume.php hidden volumes]). Encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Supports [[Microsoft Windows|Windows]] XP/2000/2003 and [[GNU/Linux]]. [[AES]], [[Twofish]] and [[Serpent]] and some combinations of them.
# [http://www.ritlabs.com/en/products/pd/ The Bat! Private Disk] - [[Shareware]], (appears to be the same or similar to Dekart Private Disk). [[AES]] on-the-fly encryption. Super fast, easy to use. Size Limit: 2[[/wiki/index.php?|GB]] for Windows 95/98/ME and up to 4[[/wiki/index.php?|TB]] for Windows NT/2000/XP.

===PDAs===

# [http://www.FreeOTFE.org/ FreeOTFE4PDA] - [[free software|Free]], [[open source software|open source]] creates encrypted file-hosted containers. Supports hidden volumes. Supoprts backup of critical information needed to restore volumes. Additionally supports [[Linux]] Cryptoloop "losetup", dm-crypt and LUKS volumes. A PC version available (FreeOTFE) which is fully compatible is also freely available

=== Mac OS ===

# [http://www.pgpi.org/products/pgpdisk/ PGP Disk 6.0.1] - Free for Windows and Mac OS 8+, taken from an old version of commercial [[PGP]].
# [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for Windows and Mac OS X

Note: Mac OS X version 10.3+ allows for integrated encryption of one's home directory.

=== For UNIX-like systems ===

# [http://www.jetico.com Bestcrypt] - proprietary program, see description under Windows version.
# [http://www.netbsd.org/guide/en/chap-cgd.html cgd] - cryptographic device driver for NetBSD. Unlike other implementations, not vulnerable to dictionary attacks. [http://www.imrryr.org/~elric/cgd/cgd.pdf Here] is a extensive [[PDF]] article concerning CGD by the authors.
# [http://www.kerneli.org CryptoAPI] The GNU/Linux Crypto [[API]]
# [http://www.crypto.com/software Crypto File System] (an encrypting [[File_system|file system]] for Unix-like OSs) -- The FS code dates back to 1989, and the crypto to 1992.
# [http://www.saout.de/misc/dm-crypt/ dm-crypt] - CryptoLoop's [http://kerneltrap.org/node/view/2433 successor]. For Linux.

# [http://arg0.net/users/vgough/encfs.html EncFS] - User-space encrypted filesystem implementation for Linux 2.4 & 2.6. It has some advantages over other implementations, namely the dynamic size. Other (dis)advantages are stated on the homepage as well as a comparison between EncFS and other encrypted filesystem implementations on site.
# [http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html/ GEOM Based Disk Encryption (gbde)] FreeBSD encryption - encrypts the sector payload using 128-bit AES in CBC mode. Each sector on the disk is encrypted with a different AES key. gbde transparently encrypts entire file systems. Mounts just like another drive. View the FreeBSD handbook for instructions.
# [http://loop-aes.sourceforge.net/ Loop-AES] - Uses [[AES]] to encrypt [[/wiki/index.php?|partitions]] under [[Linux|GNU/Linux]]. Fairly simple and effective. No real homepage, so try [http://sourceforge.net/projects/loop-aes http://sourceforge.net/projects/loop-aes]
# [http://www.mcdonald.org.uk/StegFS StegFS] - a [[Stenography|steganographic]] [[Filesystems|file system]] for [[Linux]]. More than just [[Encryption|encryption]], also allows one to hide (parts of) data. Be aware that only using StegFS doesn't provide a secure hiding, additional precautions should be taken; see the [[FAQ]] on the site. Currently for Linux 2.2 only.
# [http://www.tcfs.it TCFS] - Transparent Cryptographic File System is a transparent filesystem for both transparent local and transparent network encryption. It is supported by [[Linux]] 2.0/2.2, NetBSD and OpenBSD -- Has not been updated since late 2002.
# [http://www.truecrypt.org TrueCrypt] - see description under Windows version.
# [http://www.openbsd.org/cgi-bin/man.cgi?query=vnconfig&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html vnconfig] under OpenBSD to configure a [http://www.openbsd.org/cgi-bin/man.cgi?query=svnd&apropos=0&sektion=4&manpath=OpenBSD+Current&arch=i386&format=html svnd] (pseudo-drive) encrypted with [[Blowfish]].
# [http://vncrypt.sourceforge.net/ vncrypt] - FreeBSD container encryption - Uses AES-Rijndael encryption in CBC mode. Utilizes FreeBSDs vnode pseudo disk device support. Is available through the ports collection.

=Notes about Windows security=

# '''Native Folder Encryption''': Although Windows XP Professional and possibly some versions of Windows 2000 provide folder encryption with [[New Technology File System|NTFS]] [[filesystem]]s, they should be considered only a very basic solution. The Window's native encryption is far easier to bypass than the software listed below.
# Hard Disk Encryption is '''not the only solution''' to data security in Windows:
## One of the most important parts is clearing the [[/wiki/index.php?|pagefile]] on shutdown to delete information you only thought was located in your encrypted volumes. [http://www.tech-recipes.com/modules.php?name=Recipes&rx_id=12 Editing your registry] is one option and [http://www.xp-antispy.org/ XP-antispy] is another. Doing so may slow the shutdown process but but will also improve overall system speed.
## Software for cleaning up Windows entirely such as [http://www.webroot.com/products/windowwasher/ Window Washer] or [http://www.google.com/Top/Computers/Software/Shareware/Windows/Security/Internet/Cache_Tools/?il=1 other items].

Also see [[file wipe]] for similar tools.

= Related =
# [[steganography]]
# [[file wipe]]

= Related Links =

# [[Open_Directory_Project|Open Directory Project]] - [http://directory.google.com/Top/Computers/Security/Products_and_Tools/Cryptography/Harddisk_Encryption/?il=1 Hard Disk Encryption]
# [http://www1.cs.columbia.edu/~ezk/research/ Several papers about CryptFS]. Dated from '92 till '03.
# [http://www.linux.org/docs/ldp/howto/Encrypted-Root-Filesystem-HOWTO/ Encrypted Root Filesystem HOWTO]: using strong encryption to secure your root filesystem on Linux.

{{infoanarchy|Hard_Disk_Encryption}}

[[Category:Computing]]
[[Category:Privacy]]
[[Category:Encryption]]

Category:Encryption

2009-01-01T15:27:50Z

SecurityReview: New page: Encryption related articles

Encryption related articles

encrypting network links

2009-01-01T15:27:21Z

SecurityReview: Added Category:Encryption

See also: [[Security]] | [[Cryptography]] | [[Network]] | [[HOWTOs]] | [[Encrypting_Your|Encrypting Your ...]]

=== Methods ===

# [[CIPE]] - '''C'''rypto '''IP''' '''E'''ncapsulation
# [[IPsec]] - IPsec is a set of extensions to the [[IP]] protocol family. It provides cryptographic security services
# [[SRP]] - Secure Remote Password
# [[SSH]] - Secure shell protocol (and [[OpenSSH]])
# [[SSL]] - Secure Socket Layer
# [[Stunnel]] - Allows one to encrypt arbitrary TCP connections inside SSL.
# [[VTun]] - Creates Virtual Tunnels over [[TCP/IP]] networks with traffic shaping, compression, and encryption.
# [[VPN]] - Transparrently encrypts between [[Node|nodes]] that have VPN software installed.

=== Software ===

# [http://rstunnel.sourceforge.net rstunnel] | [http://sourceforge.net/projects/rstunnel/ Sourceforge Page] | [http://www.gnu.org/directory/all/rstunnel.html GNU Page] - '</pre html2wiki>''rstunnel' provides secure port forwarding by transfering data between 2 networks through an encrypted tunnel. It both sets up the tunnel and make sure it remains open.''
# [http://yavipin.sourceforge.net/ yavipin] | [http://sourceforge.net/projects/yavipin Sourceforge Page] | [http://www.gnu.org/directory/all/yavipin.html GNU Page] - ''Yavipind is a secure tunnel (2 peers securely forwarding packets toward each other). It forwards any kind of packet (IPv4, IPv6, or other) sent over the virtual point-to-point device (e.g., tun0). It runs in Linux userspace (no need to recompile the kernel). Yavipin is virtual, so you can apply any tool designed for the network device. packet overhead is small (26 bytes) and packets can be compressed using gzip. The tunnel can be established over NAT since all packets in a tunnel are sent over a single UDP/IPv4 connection. If one peer becomes unreachable, it is detected; if a peer deliberately stops, it immediately notifies the other peer. Packages are encrytpted with blowfish. The program has strict anti-replay rules and no packet can be accepted twice. Traffic older than a given delay (default 10 min) can't be decrypted since the keys are periodically renewed and securely erased.''
<hr />

Filesystems:
# [http://www1.cs.columbia.edu/~ezk/research/fist File System Translator]
# [http://lufs.sourceforge.net Linux Userland Filesystem]
# [http://www.math.ualberta.ca/imaging/snfs Secure NFS and NIS via SSH Tunnel]
# [http://www.fs.net Self-certifying File System]
# [http://shfs.sourceforge.net SHell FileSystem]
# [http://www.tcfs.it Transparent Cryptographic File System]

{{infoanarchy2|Encrypting_Your_Network_Links}}
[[Category:Encryption]]

encrypting mail

2009-01-01T15:27:16Z

SecurityReview: Added Category:Encryption

See also: [[Security]] | [[Cryptography]] | [[E-mail]] | [[HOWTOs]] | [[Encrypting Your|Encrypting Your ...]]

Adds [[privacy]] to [[e-mail]] which is often easily [[eavesdropping|eavesdropped]] ... [http://www.goingware.com/encryption/ more].

Note: this howto currently leans towards [[Windows]] users.

=== Send a ZIP or RAR file ===

The fastest way to [[Cryptography|encrypt]] your mail is to [[ZIP]] a separate text file, add a password, and send the file as an attachment. While there are more than one standard of password-protection on zip files, the absolute easiest way is to use the same ZIP program that your recipient uses.

Negatively, you must have a shared password, which may be possible to be overheard or guessed. Other encryption systems do not have this problem but are often more complicated for the average user. In the absense of other security methods, this is ideal.

Check your software help guide for information on how to add a password-protection but find out what software your recipient uses (such as "WinZIP" or "PKZip" products as they add [http://news.com.com/2100-1046_3-5062423.html?tag=fd_ots incompatible] security. Although different ZIP programs have different ways of doing this, most have an option for "portability" that is almost universally accepted.

Many ZIP utlities are now incorporating strong encryption [[AES]] standards as implemented by WinZip, into their programs. [[RAR]] also uses this strong encryption by default and often provides better compression but is not as ubiqious as ZIP.

==== Strong Encryption ====

AES encryption is much stronger, but less compatible with older zip utlities than the original Zip 2.0 encryption standard. [[AES]] (both 128 bit and 256 bit strength) encryption provides government-strength security to zip and is suitable for securing important documents (generally requiring an 8+ character) password is used. ZIP 2.0 encryption will keep casual [[attacks]] at bay, but only AES 128 or AES 256 should be relied upon for sending crucial data.

A recent trend in using AES encryption is software that manages the passwords to automate the encryption/decryption of zip files. For example, MessageLock is a [[plug-in]] for [[Outlook]] that stores passwords and encrypts/decrypts zip file attachments, and also uses zip AES encryption to secure the contents of email messages.

Again, true security of [[symmetric-key]] AES encryption requires a secure means of sharing a password. However it is generally much more simple.

Zip and RAR Programs that incorporate AES encryption:

* Winzip, (trial) www.winzip.com
* TugZip (free) www.tugzip.com
* WinRar (trial) www.winrar.com
* MessageLock for Outlook (trial) www.encryptomatic.com

=== Use Pretty Good Privacy - Remotely ===

One system allowing users to talk securely without ever meeting is Pretty Good Privacy, or [[PGP]].

The fastest way to get started is with a Web Mail service such as those listed below. This provides a great starting point understanding and use of [[PGP]].

* [http://www.hushmail.com/ HushMail] - Free and PGP compatible. HushMail has been in the business for several years now and provides the users with both free and premium accounts. Their for-pay services also include file storage, support for custom domain names, instant messaging, spam filters and more. Features include a Disclosed Source Front End. From the HushMail Corporation.
* [http://www.lokmail.com/ Lokmail] - Non-free - Features standards-compliant PGP service except older RSA keys. From LOKMAIL, Inc.
* [http://s-mail.com/ s-mail] Another PGP-compatible commercial service

Negatively, these services sometimes can take too much time on a slow connection (encrypted transmissions require more data) and occasionally go offline for maintenance.

=== Use Pretty Good Privacy - Locally ===

Programs that work [[local|locally]] using PGP are available to download and use with any normal [[e-mail clients|e-mail client]].

Use normal [[E-mail Clients]] with downloaded encryption software:

* [[PGP]] and [[GPG]] - also compatible programs for the PGP system of encryption. Visit the [[PGP]] page for more information. Some packages integrate easily with [[Mozilla]], [[Eudora]] and/or [[Outlook]].

:* [http://wolfram.org/writing/howto/gpg.html GPG on Windows]
:* [http://www.winpt.org/ WinPT] includes "GPG Relay," a simple and easy to use tool for use with any e-mail client.
:* [[Mozilla Mail/News]] with the [http://enigmail.mozdev.org Enigmail] GPG [[plugin]] allows for a free and useful PGP solution. [[Cross-platform]] and fully [[open-source]].

* [[S/MIME]] - Common for business customers and very similar to PGP, S/MIME is popular for its simplicity. This is easy to use for most [[E-Mail Clients]] and almost totally transparrent to the user. But it puts the burden on the [[admin]] and requires some setup time. The downside is that it would require all clients have POP/IMAP capability (not just webmail).

=== Send A Self-Decrypting File ===

Many software packages allow users to send an executable file that automatically self-decrypts upon entry of a password. This is even easier than sending a [[ZIP]] file, needing no extra software, but requires that the person using it [[trust|trusts]] the sender, as [[virus|viruses]] can be delivered this way. However, many e-mail services will not allow sending exe files over e-mail.

If you are absolutely certain that your computer is uninfected by a virus - either because you do not run strange programs, have up-to-date [[anti-virus]] software, or because you are tech-savvy enough to avoid them, this is a good option. However, some users never run executable files received through e-mail.

Some software that uses self-decryption include:

* [http://www.kryptel.com/index.php Iron Key] freeware (note: this program uses the weak [[DES]] [[algorithm]])
* [http://www.softmode.com/ Softmode] [http://www.tucows.com/preview/308264.html Vigilant] commercial software
* Many [[RAR]] and [[ZIP]] products can be configured to allow self-decompressing archives that also include their encryption options turned-on.

----

For Administrators: server based e-mail encryption

* [[STARTTLS]] - hooks into mail servers, not mail clients)
** [http://www.aet.tu-cottbus.de/personen/jaenicke/pfixtls/ Postfix]
** [http://www.esat.kuleuven.ac.be/~vermeule/qmail/tls.patch qmail]
** [http://www.citi.umich.edu/u/provos/sendmail.html Sendmail]
** [http://www.exim.org/exim-html-4.20/doc/html/spec_toc.html#TOC34 Exim]
* [[S/MIME]]
** Webopedia: [http://www.webopedia.com/TERM/S/S_MIME.html S/MIME]

=== Related ===

* [http://www.cryptomail.org/ Cryptomail] - Free. CryptoMail.org provides you with free, encrypted, anonymous email. Unfortunately its security features are only available to those individuals who use the cryptomail service. Sending outside of their network is insecure. The source code for the system available under an open source license (GPL), which make it possible for anyone to set their own secure web mail. Features include an [[Open Source]] Back+Front End. From the CryptoMail Organization. A non-profit organization.
* [http://www.parisien.org/products.htm VGP] - (no relation to PGP) - Free and very simple software for e-mail encryption. Users are encouraged to edit in a different window than the provided editor as the "Undo" function is buggy.
* http://www.dekart.com - [https://inside.dekart.com/digital_id/ Free Digital ID] - (no relation to PGP) - Free digital certificate. Signing a document, verifying its authenticity, decrypting or encrypting it can be easily done using modern cryptographic methods based on the pair of cryptographic keys. '''Note:''' In testing, the service does not appear to work. Since this ID is installed using Internet Explorer and not a simple cert file, it may contain [[adware]]/[[spyware]]. There was no mention in the User Agreement of such items.

{{infoanarchy|Encrypting_Your_Mail|Encrypting Your Mail}}
[[Category:Encryption]]

encrypting files

2009-01-01T15:26:56Z

SecurityReview: Added Category:Encryption

See also: [[Security]] | [[Cryptography]] | [[File]] | [[HOWTOs]] | [[Encrypting Your|Encrypting Your ...]]

== Introduction ==

Many people today require encryption of their personal files for various reasons. Hopefully this node will show you some methods for encrypting and [[obfuscate|obfuscating]] your data to prevent theft, interception and spying.

=== Programs ===

Starting with a program that turns normal files into password-protected ones is the first step. Many programs from Microsoft Word to [[ZIP]]'s portable format use [http://www.stack.nl/~galactus/remailers/index-crack.html inadequate protection]. Advertising high-level encryption does not make a program secure.

* [[PGP]] is one of the most popular encryption programs - mainly due to it's ease of integration with Windows mail clients. Both a freeware version is available, though not for commercial use, and an [[open source]] clone: [[GPG]].
* [http://axcrypt.sourceforge.net/ AxCrypt] - [[open-source]] [[GPL]] program on [[SourceForge]] -- [[compression]] and double-click Edit/View for secure document storage on Windows 95/98/ME/NT/2K/XP, locally or remote using [[AES]].
* [http://www.dekart.com/products/file_disk_encryption/private_disk/ Dekart Private Disk] - commercial software, can run directly from a [[USB]] flash or other removable device without installing it on each computer. "Will let you securely work with your encrypted files on removable media on any computer, in any location." Not [[cross-platform]]; [[Windows]]-only.
* [http://mcrypt.hellug.gr/ Mcrypt] - A very simple [[Command Line Interface|command-line]] program with a wide variety of [[algorithms]] and the [[Open-Source|source code is available]]. Can be ported to [[Windows]] with [[Cygwin]]. Intended to be a replacement of the old UNIX "crypt" which used [[DES]], under the [[GPL]].
* [http://www.ashampoo.com/frontend/products/php/product.php?idstring=0104 Ashampoo Privacy Protector] commercial program creates [[extract|self-extracting]] encrypted files. CD burning capabilities. Available in English and German.
* [http://www.rarsoft.com WinRAR] - commercial Windows [[compression]] program - the latest versions use high-strength [[AES]] encryption.
* [http://www.iopus.com/secure-email.htm iOpus SEA tool] - Windows freeware that uses high-strength blowfish encryption to make self-extracting files.
* [http://www.dekart.com/products/file_disk_encryption/secrets_keeper/ Secrets Keeper] - 256-bit AES encryption for Windows Explorer and Microsoft Office including Microsoft Word, Excel and PowerPoint documents.
* [http://www.attachplus.com/ Attach Plus] - Windows shareware - Attach Plus allows you to modify, PDF or ZIP, 128-bit encrypt, and attach your files while you are ataching (or printing) to an existing OR new email message. Supports Outlook, Outlook Express, Goldmine, ACT, Groupwise and Eudora.
* [http://pkware.com PKWARE] - SecureZIP - [[AES-256]] encryption with either pass phrases or digital certificates to protect files on hard drive, laptop, CD's or removable storage as well as to protect email attachments.

=== Both open and save files encrypted ===

: See: [[Hard Disk Encryption]]

=== More security measures ===

* Recognize that your operating system probably leaves plain text copies of your encrypted data all over the place, but especially in temporary files.
* Note that, facing a well resourced attacker, it is very difficult to safely and securely delete data. (See http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html)
* Use of a [[steganography|steganographic]] file system (see http://www.mcdonald.org.uk/StegFS/)
* For the ultra-paranoid, maybe mention something about [[TEMPEST]] here (see http://www.eskimo.com/~joelm/tempest.html and http://cryptome.org/nsa-tempest.htm. (Though jya.com seems to be down at the moment, so some papers are currently inaccessible.))

{{infoanarchy|Encrypting_Your_Files|Encrypting Your Files}}
[[Category:Encryption]]

encrypting file sharing

2009-01-01T15:26:51Z

SecurityReview: Added Category:Encryption

See also: [[Security]] | [[Cryptography]] | [[File sharing]] | [[HOWTOs]] | [[Encrypting Your|Encrypting Your ...]]

Software or methods for more-[[security|secure]]/[[anonymous]] [[file sharing]]. If exchanging files with known parties over an ordinary file sharing network, see [[Encrypting Your Files]].

'''Note''': No action other than abstaining from any sort of file sharing is a true defence. Programs that promote [[anonymous|anonymity]] may not be 100% effective and programs with encryption are often not carefully audited and may be insecure. In avoiding audits by the [[RIAA/Safeguard|RIAA]], anonymity is more important than encryption.

=== P2P-enabled Software ===

* [[ENTROPY]] - Similar in design to Freenet (at least from the user's perspective), but written in [[C]] instead of [[Java]].
* [[Filetopia]] - a fairly large user base with strong [[traffic]] [[encryption]]. Semi-[[centralized]].
* [[FolderShare]] - commercial Windows client allowing secure file-access with provided client or a Web browser. Also locally-based (only individuals who you add). Communicates with [[centralized]] server for file listing.
* [[Freenet]] - a popular [[anonymous]] and [[secure]] information sharing P2P network using [[Java]]. Can be opened with a prefered browser, among other clients.
* [[GNUnet]] - reputation-based network. [[GPL]], part of [[GNU]] project.
* [[MUTE]] - for [[Windows]], [[OS X]], and [[Linux]], easy search-and-download that seeks to protect the privacy of its users. Developed from [[Konspire]]'s code. [[GPL]]
* [[PRIVARIA]] - for [[Windows]] - more locally-based file sharing and [[Groupware]] tools
* [[Tesla]] - A freeware, decentralized, file sharing program with IRC-style chat features and multi-source downloading.
* [[WASTE]] - a focus on small groups of file sharing members, similar to [[IM|Instant Messaging]]. [[Groupware]] meets [[social networking]] meets [[IM]]. No centralized server, although users can create [[supernodes]].

'''Similar but not quite:'''

* [[Konspire]] - development was moved from an anonymity/security-aim towards a subject-based download system

=== Adding encryption layers to P2P ===

* [[Encrypting Your Files]] - exchange encrypted files. This can be useless if your recipient doesn't know the password or cannot determine it.
* [[Encrypting Your Network Links]] - exchange files over an encrypted network. This may not work for [[hive]]-type downloads, since it is unlikely all clients would use the same type of network-layer encryption.

=== Related ===

* [http://www.shirky.com/writings/riaa_encryption.html RIAA makes encryption more ubiquious] (from [[Slashdot]] [http://slashdot.org/article.pl?sid=03/12/18/1354254 article]).
* [http://www.technewsworld.com/story/34052.html P2P Fights back]

{{infoanarchy|Encrypting_Your_File_Sharing|Encrypting Your File Sharing}}
[[Category:Encryption]]

encrypting chat

2009-01-01T15:26:31Z

SecurityReview: Added Category:Encryption

See also: [[Security]] | [[Cryptography]] | [[Chat]] | [[HOWTOs]] | [[Encrypting_Your|Encrypting Your ...]]

Add [[Privacy|privacy]] to your chat by making the connection difficult for on-lookers to find or understand.

=== Software ===

: See: [[Encrypted_Chat_Clients|Encrypted Chat Clients]].

=== Why? ===

One of the most easily [[Eavesdropping|eavesdropped]] types of communication on the Internet is that of [[Text|text]]-based chat. A variety of [http://www.google.com/search?q=instant+message+spy IM spy tools] are readily available to watch your [[ICQ]], [[MSN_Messenger|MSN Messenger]], and [[Yahoo_Messenger|Yahoo Messenger]] chat sessions by your family, employer, or government.

Other options include a tool like [http://www.parisien.org/products.htm VPG] that can allow the cut-and-paste of freshly-encrypted information from VPG to the chat window. This can be tedious but is compatable with every network. Similarly named [[PGP]] often has prohibitively large message blocks for exchange over chat networks (generally limited to only 200 characters or so.

{{infoanarchy2|Encrypting_Your_Chat}}
[[Category:Encryption]]

hard disk encryption

2009-01-01T15:26:23Z

SecurityReview: Added Category:Encryption

See also: [[security]] | [[cryptography]] | [[Encrypting_Your|Encrypting Your...]] | [[Cryptography/Attacks]] | [[Undelete_Attack|Undelete Attack]]

[[AKA]]: Volume Encryption

A secure container [[file]] on a disk, meant to hide [[information]] that, when opened with a [[password (computing)|password]], is treated as a separate disk (for instance the H:\ drive). This is preferable to normal file encryption as the operations of encryption and decryption are transparent to the user.

This [[software]] is popular on [[laptop]]s, which are often stolen and can carry sensitive financial information.

=How it works=

Hard Disk Encryption programs run a memory-resident program is in the background, acting as an interpreter between the container file and the rest of the computer. Without the memory resident program and password, the file is indistiguishable from [[Random|random]] [[Data|data]].

If the program is shut down, hard drive is removed suddenly, or system turned off, the volume is secure depending on the underlying [[filesystem]]. These days, filesystems support journaling and atomic writes hence this is of little concern.

Most implementations are vulnerable to dictionary attacks though. Also, if the source is not open, one is arguably more vulnerable because it is not known to the public how the program exactly works. It could be [[backdoor (computing)|backdoored]].

= Software =

===[[Microsoft Windows|Windows]]===

Recommended:
# [[TrueCrypt]] [http://www.truecrypt.org] - Excellent software. [[free software|Free]], [[open source software|open source]], based on [http://www.woundedmoon.org/win32/e4m202a.html E4M]. Provides two-level [[deniable encryption|plausible deniability]] (including [http://www.truecrypt.org/hiddenvolume.php hidden volumes]). Encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Supports [[Microsoft Windows|Windows]] XP/2000/2003 and [[GNU/Linux]]. [[AES]]-256, [[Triple DES|Triple DES]], [[Twofish]], [[Serpent]], [[Blowfish]]-448, [[CAST]]5, and cascades of multiple [[algorithm]]s (e.g. AES + Twofish). Fast, reliable, and stable. [[infoAnarchy|iA]] testing shows this software to be the best free, open source program so far.
# [http://www.cypherix.com/cryptainerle/index.htm Cyptainer LE] - easy-to-use, nag-free commercial software but with a size limit of 25 megs. Negatively, runs as a system service even when not enabled. Advanced users with administrative access may wish to set to the system service to "Manual" under "Control Panel - Administrative Tools - Services".
# [http://www.jetico.com Bestcrypt] - proprietary program similar to Truecrypt. Windows and Linux versions, very stable, doesn't appear to lose data over an extended period. Modules for all major encryption algorithms. [[Finland]] (not USA) origins.
# [http://www.utimaco.us/products/easy/ SafeGuard Easy] - Commercial versions for [[Windows]]. Encrypts the entire disk with pre-boot authentication
# [http://www.utimaco.us/products/privatedisk/ SafeGuard PrivateDisk] - Commercial versions for [[Windows]] Personal and Enterprise Edition (with centralized management for enterprise customers)
# [http://www.pgpi.org/products/pgpdisk/ PGP Disk 6.0.1] - A free but problematic program for [[Windows]] and [[Macintosh]] OS 8 and 9, taken from an old version of commercial [[PGP]]. Must install on an [[New Technology File System|NTFS]]-only format disk or may restrict users to the [[File Alocation Table|583d FAT]] file system and require short file names ([[FAT32]] will not work). If so, use [[file compression|zip]] files to avoid losing long file names.
# [http://www.scherrer.cc/crypt/ CrossCrypt] - [[free software|Free Software]], [[open source software|open-source]] implementation of [[AES]] and [[Twofish]] for [[Windows 2000|Windows 2000]]/[[Windows XP|XP]]. Compatible with Linux AES/Twofish. Requires some command-line interaction or download of a [[GUI]] [[Front-End]]: [http://www.sdean12.org/CrossCryptGUI.htm CrossCryptGUI]
# [http://www.freeotfe.org/ FreeOTFE] - [[Free_Software|Free Software]] similar to TrueCrypt, encrypts partitions, devices ([[USB]] memory sticks, etc.) or creates encrypted file-hosted containers. Supports "hidden" volumes. Supoprts backup of critical information needed to restore volumes. [[Linux]] compatibility (both Cryptoloop "losetup", and dm-crypt). Tested under Windows 2K/XP (should work with Windows 2003). Currently in [[Beta]].
# [http://www.woundedmoon.org/win32/e4m202a.html E4M] - Encryption for the Masses. [[Freeware]] product (no longer being developed) for [[Windows]] NT.
# [http://www.dekart.com/products/file_disk_encryption/private_disk/ Dekart Private Disk] - [[AES]] encryption, flexible and easy to use - Shareware - 95/98/ME/NT/2000/XP. Allows securing hard disks and USB flash disks, runs from USB disk with no host PC installation. Provides innovative Disk Firewall mechanism - protecting access to the encrypted disk application by application. Disk firewall allows creating a white list of applications allowed to access the encrypted disk making sure that no trojans or any spyware will harm the secured data. [http://www.dekart.com/howto/howto_disk_encryption/disk_firewall/ Encrypted Disk Firewall - additional protection of confidential information]
# [http://www.ritlabs.com/en/products/pd/ The Bat! Private Disk] - [[Shareware]], (appears to be the same or similar to Dekart Private Disk). [[AES]] on-the-fly encryption. Super fast, easy to use. Size Limit: 2[[/wiki/index.php?|GB]] for Windows 95/98/ME and up to 4[[/wiki/index.php?|TB]] for Windows NT/2000/XP. A Google search showed that this software has not been reviewed by any outside shareware service.
# [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for [[Windows]] and [[OS_X|OS X]]
# [http://www.scramdisk.clara.net/ Scramdisk] (free for [[Windows_9x|Windows 9x]] but not the [[Windows_NT|Windows NT]] series ([[Windows_2000|2000]], [[Windows_XP|XP]], etc).
# [http://www.cs.auckland.ac.nz/~pgut001/sfs/ SFS] - Outdated, free, secure File System for [[DOS]]/[[Windows]]. Requires some configuration. Has not been updated since September of 1996.
# [http://www.drivecrypt.com/ DriveCrypt] - commercial software for Windows
# [http://www.secureaction.com/cryptoexpert/std/ CryptoExpert 2004 PE] - A highly-rated commercial disk encryption tool. A professional version also available.

'''
: '''Notes about Windows security:'''
:
# '''Native Folder Encryption''': Although [[Windows XP]] Professional and possibly some versions of [[Windows 2000]] provide folder encryption with [[New Technology File System|NTFS]] [[filesystem]]s, they should be considered only a very basic solution. The Window's native encryption is far easier to bypass than the software listed below. (See: [[Windows XP]].)
# Hard Disk Encryption is '''not the only solution''' to data security in Windows:

:
# One of the most important parts is clearing the [[/wiki/index.php?|pagefile]] on shutdown to delete information you only thought was located in your encrypted volumes. [http://www.tech-recipes.com/modules.php?name=Recipes&rx_id=12 Editing your registry] is one option and [http://www.xp-antispy.org/ XP-antispy] is another. Doing so may slow the shutdown process but but will also improve overall system speed.
# Software for cleaning up Windows entirely such as [http://www.webroot.com/products/windowwasher/ Window Washer] or [http://www.google.com/Top/Computers/Software/Shareware/Windows/Security/Internet/Cache_Tools/?il=1 other items].

# Also see [[file wipe]] for similar tools.

=== [[Mac OS]] ===

# [http://www.pgpi.org/products/pgpdisk/ PGP Disk 6.0.1] - Free for [[Windows]] and Mac OS 8+, taken from an old version of commercial [[PGP]].
# [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for [[Windows]] and [[OS_X|OS X]]

Note: [[S X]] version 10.3+ allows for integrated encryption of one's home directory.

=== For [[UNIX]]-like systems ===

# [http://www.truecrypt.org TrueCrypt] - Free, open-source, based on [http://www.woundedmoon.org/win32/e4m202a.html E4M]. Provides two-level [[Deniable_Encryption|plausible deniability]] (including [http://www.truecrypt.org/hiddenvolume.php hidden volumes]). Encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Supports [[Windows]] XP/2000/2003 and [[Linux]]. [[AES]]-256, [[Triple_DES|Triple DES]], [[Twofish]], [[/wiki/index.php?|Serpent]], [[Blowfish]]-448, [[/wiki/index.php?|CAST]]5, and cascades of multiple [[Algorithm|algorithms]] (e.g. AES + Twofish). Fast, reliable, and stable. iA testing shows this software to be the best [[Free|free]], [[Open_source|open source]] program so far.
# [http://www.crypto.com/software Crypto File System] (an encrypting [[File_system|file system]] for Unix-like OSs) -- The FS code dates back to 1989, and the crypto to 1992.
# [http://www.jetico.com Bestcrypt] - proprietary program, see description under Windows version.
# [http://www.kerneli.org CryptoAPI] The GNU/Linux Crypto [[API]]
# [http://www.mcdonald.org.uk/StegFS StegFS] - a [[Stenography|steganographic]] [[Filesystems|file system]] for [[Linux]]. More than just [[Encryption|encryption]], also allows one to hide (parts of) data. Be aware that only using StegFS doesn't provide a secure hiding, additional precautions should be taken; see the [[FAQ]] on the site. Currently for Linux 2.2 only.
# [http://www.tcfs.it TCFS] - Transparent Cryptographic File System is a [[Transparent|transparent]] filesystem for both transparent local and transparent network encryption. It is supported by [[Linux]] 2.0/2.2, [[NetBSD]] and [[OpenBSD]] -- Has not been updated since late 2002.
# [http://arg0.net/users/vgough/encfs.html EncFS] - User-space encrypted filesystem implementation for Linux 2.4 & 2.6. It has some advantages over other implementations, namely the dynamic size. Other (dis)advantages are stated on the homepage as well as a comparison between EncFS and other encrypted filesystem implementations on site.
# [http://loop-aes.sourceforge.net/ Loop-AES] - Uses [[AES]] to encrypt [[/wiki/index.php?|partitions]] under [[Linux|GNU/Linux]]. Fairly simple and effective. No real homepage, so try [http://sourceforge.net/projects/loop-aes http://sourceforge.net/projects/loop-aes]
# [http://www.saout.de/misc/dm-crypt/ dm-crypt] - CryptoLoop's [http://kerneltrap.org/node/view/2433 successor]. For Linux.
# [http://www.netbsd.org/guide/en/chap-cgd.html cgd] - cryptographic device driver for NetBSD. Unlike other implementations, not vulnerable to dictionary attacks. [http://www.imrryr.org/~elric/cgd/cgd.pdf Here] is a extensive [[PDF]] article concerning CGD by the authors.
# [http://vncrypt.sourceforge.net/ vncrypt] - FreeBSD container encryption - Uses AES-Rijndael encryption in CBC mode. Utilizes FreeBSDs vnode pseudo disk device support. Is available through the ports collection.
# [http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html/ GEOM Based Disk Encryption (gbde)] FreeBSD encryption - encrypts the sector payload using 128-bit AES in CBC mode. Each sector on the disk is encrypted with a different AES key. gbde transparently encrypts entire file systems. Mounts just like another drive. View the FreeBSD handbook for instructions.
# [http://www.openbsd.org/cgi-bin/man.cgi?query=vnconfig&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html vnconfig] under [[OpenBSD]] to configure a [http://www.openbsd.org/cgi-bin/man.cgi?query=svnd&apropos=0&sektion=4&manpath=OpenBSD+Current&arch=i386&format=html svnd] (pseudo-drive) encrypted with [[Blowfish]].

= Related =
# [[steganography]]
# [[file wipe]]

= Related Links =

# [[Open_Directory_Project|Open Directory Project]] - [http://directory.google.com/Top/Computers/Security/Products_and_Tools/Cryptography/Harddisk_Encryption/?il=1 Hard Disk Encryption]
# [http://www1.cs.columbia.edu/~ezk/research/ Several papers about CryptFS]. Dated from '92 till '03.
# [http://www.linux.org/docs/ldp/howto/Encrypted-Root-Filesystem-HOWTO/ Encrypted Root Filesystem HOWTO]: using strong encryption to secure your root filesystem on Linux.

{{infoanarchy|Hard_Disk_Encryption}}

[[Category:Computing]]
[[Category:Privacy]]
[[Category:Encryption]]

encrypting your...

2009-01-01T15:26:10Z

SecurityReview: Added Category:Encryption

{{merge|encryption}}

See also: [[Security]] | [[Cryptography]]

Encrypting Your ...

A series of articles concerning basic methods for adding [[encryption]] to your online experience.

* [[Encrypting Your Chat]]
* [[Hard_Disk_Encryption|Encrypting Your Disk or Partition]]
* [[Encrypting Your File Sharing]]
* [[Encrypting Your Files]]
* [[Encrypting Your Mail]]
* [[Encrypting Your Network Links]]
* [[Encrypting Your Money]]

==== Related ====

* [[Anonymous Web Surfing]]
* [[Eavesdropping]]
* [[File Wipe]]
* [[Sniff]]

{{infoanarchy|Encrypting_Your|Encrypting Your}}
[[Category:Encryption]]

cryptography

2009-01-01T15:25:38Z

SecurityReview: Added Category:Encryption

'''Cryptography''' is a way to encode the information, so that it can be decoded only by the intended person.

The science of allowing a user to radically change [[information]] in order to conceal the content from third parties. Like any system of security, this science includes the process of searching for its own weaknesses. It is the substitution of [[Character Set|characters or symbols]] to create an [[Modify|altered]] message that can be reversed to its original form later. Information which has been cryptographically processed is "encrypted". Encryption is now very common, allowing [[user|users]] to [[trust]] their [[computer]] [[communication|communications]] that are, on the [[Internet]], very exposed. There are [http://www.goingware.com/encryption/ many reasons] to use encryption.

Origin: The Ancient Greek ''kryptein'', meaning "to hide", and ''graphein'', meaning "to write" ([http://www.perseus.tufts.edu/cgi-bin/ptext?doc=Perseus%3Atext%3A1999.04.0057%3Aentry%3D%2360247 source] [http://www.perseus.tufts.edu/cgi-bin/ptext?doc=Perseus%3Atext%3A1999.04.0057%3Aentry%3D%2322826 source]).

== Properties ==

* Encrypted signals may be detected but not understood. Concealing the very existence of the cryptography is [[obscurity]].

* Any attempt to discern the encrypted information is considered an attack (discussed below).

* The word, phrase, characters, or other authentication method that reverses the encryption is called the "[[key]]." There can be multiple types of keys involved in this process.

* {{ll|Digital signatures}} are not the same as cryptography but have similar applications (discussed below).

* Encryption is often combined with [[compression]]. Attacks on encryption often center upon searching for patterns in an encrypted documents and compression helps limit these. Compression tries to make sure there is only one instance of a given type of data, thus reducing recognizable patterns. Thus, finding possible clues about the key becomes much harder.

* Cryptographers are individuals who are very good at [[mathematics]] and this type of science of [[secret]] [[text|writing]]. They are also often software [[developers]].

Strong cryptography often has legal restraints because of its history in military use. For example, some places (like the USA) considered the export of cryptographic materials to be the same as the export of military weaponry (munitions), and laid heavy restriction on such activity. In recent years, this has been relaxed due to foreign commercial competition.

== Attacks ==

* '''[[cryptography attacks|Available methods to reveal encrypted information]]'''

=== Computer methods to foil attacks ===

Here are three major computer-based methods used to foil attacks. All have advantages and disadvantages.

* [[symmetric-key cryptosystem|Symmetric-Key Cryptosystem]]
* [[public-key cryptosystem|Public-Key Cryptosystem]]
* [[one-time pad cryptosystem|One-Time Pad Cryptosystem]]

=== Libraries ===

For most cryptography, some type of [[Mathematics|math]] is involved. Libraries contain mathematical systems, or [[cipher|ciphers]], that mathematically change information to appear as random garbage.

Of [[Symmetric-Key Cryptosystem|symmetrical]] [[algorithm|algorithms]], there are many including:

: '''Very strong'''

** [[Twofish]] - a losing [[AES]] competition candidate
** [[AES]] - the winner of AES competition, formerly knwon as Rijndael
** [[3DES]] - used in [[SSL]], very slow in software
** [[RC6]] - another losing AES candidate

: '''Strong'''
** [[Blowfish]]
** [[RC4]] - used in [[SSL]]. Contrary to most others on this page a [[stream cipher]]

: '''Weak'''

** [[DES]] - used in most older security programs, strong algorithm but keysize two small. Usually slow in software, very fast in hardware.
** [[A5]] - as used in GSM cell phones

One must weight his choice of algorithm based on his performance need and likely attack, however the strongest choices like AES have very fast implementations both in hardware and software.

Public-key [[algorithm|algorithms]] include:

* [[RSA]] Used for encryption and signature
* [[DSA]] Used for signature only
* [[Diffie-Hellman]] Used for key-exchange
* [[ECC]]

{{ll|Digital signatures}} are used to prove [[authentication|authenticity]] (you get a strong certitude that the one who generated the message also have the secret key) and [[integrity]] (that nothing has been changed in transmission).

=== Key size ===

Different libraries allow for varying levels of [[complexity]], affecting speed and security. A small bit size can make an algorithm faster but more easily broken. A large [[bit]] size can make it slow but much more difficult to break. Also, the higher the bit size, the larger the processed file size will be so a balance is often chosen between strength and convenience.

Note that [[key (computing)|keys]] that are twice as large in number are not merely twice as difficult to crack. 128-bit keys, for instance, are literally one trillion, trillion (1^10^10) times harder to [[crack]] with [[Brute Force]] than 40-bit keys.

==== Symmetric-Key Cryptosystem key size ====

: 128-bit keys are usually sufficient for RC4 and 3DES and are commonly used in Web transactions. Despite 128 bit being very adequate, many Symmetric-Key Cryptosystems now use 256-bit keys by default, regardless of algorithm.

: Many 40-bit RC4 and 3DES keys must be avoided as they are not secure. They can be broken by a dedicated [[Brute Force]] [[attack]] over the course of a few weeks with a desktop computer.

==== Public-Key Cryptosystem key size ====

: 1024-bit [[RSA]] keys approximately as difficult to crack as a symmetric 128-bit key. [[ECC]] keys can be as secure and considerably shorter than RSA keys. Some public-key programs are available that use exceedingly large key sizes as high as 8192 or 16384 but are, as mentioned above, inconvenient, making the encrypted transmission unnecessarily large.

Key sizes are often chosen as power of two numbers (e.g.  64 (2^6), 128 (2^7), 256 (2^8)) as they can be implemented more efficiently.

==== Non-math Weaknesses ====

Good cryptography is not necessarily the use of smart people or great math. Good cryptography is made up of a program that provides end-to-end security by:

* Encouraging the use of difficult-to-guess, lengthy passwords
* Preventing the caching of secure information in an operating system's swap file where it is vulnerable and then using a [[File Wipe]] for files that have been encrypted to prevent them from being retrieved after deletion
* Testing and careful review to ensure software has no failures
* Protecting against [[Key-Logging Attack]] software

==== Openness and Cryptography ====

Many systems of cryptography and its software development are fully available to the public. [[Trust]] is established in these systems because a [[Closed-Source|closed]] system created by someone else often calls the system into immediate doubt. Questions such as: does this person had my security needs in mind? Do they have other motives?

This process of making the details of a system public is called [[open-source]] and is preferable to many security experts because its methods are available to [[peer]]-review and research. For instance, almost all of the encryption library algorithms up for review were open-source at the selection of the Advanced Encryption Standard ([[AES]]) by the National Institute of Standards and Technology ([http://www.nist.gov/ NIST]).

=== Legal Methods to foil attacks ===

Circumventing encryption is illegal under the US [[DMCA]] law. It is assumed, however, that most methods of attack are both covert and remote, and cannot actually be enforced. Still, it is an important method to discourage public revelation of encrypted documents, often making evidence gained through decryption inadmissible in court.

A law protecting your encrypted material would seem like a good thing but it really is not, stifling security research and creating ridiculous content-protection laws ala the continuous extension of the [[Mickey Mouse Release Day]]. Most academic and consumer advocates are very against the [[DMCA]].

==== Cryptography and [[DRM]] ====

* Digital Rights Management ([[DRM]]) uses cryptography to make it difficult to copy and [[Digital Signatures]] to verify its authenticity.

== Other Software, Cryptographic Libraries ==

* [[OpenSSL]] | ([http://www.openssl.org homepage]) | very widespread library implementing [[SSL]]/[[TLS]] but it's libcrypto component is also used by many projects like [[OpenSSH]] and [[mixmaster]].
* [http://botan.randombit.net/ Botan] | [http://www.gnu.org/directory/all/botan.html GNU Homepage] - ''Botan (formerly OpenCL) is a library of cryptographic algorithms. It includes a wide selection of block and stream ciphers, public key algorithms, hash functions, and message authentication codes, plus a high level filter-based interface. The home page has a list of supported algorithms.''
* [http://ccrypt.sourceforge.net/ ccrypt] | [http://sourceforge.net/projects/ccrypt/ Sourceforge Page] | [http://www.gnu.org/directory/all/ccrypt.html GNU Page] - '''ccrypt''' is a utility for encrypting and decrypting files and streams. It was designed to replace the standard Unix 'crypt' utility, which is notorious for using a very weak encryption algorithm. use the [[AES]] algorithm.
* [http://kremlinencrypt.com/crypto/algorithms.html Cryptographic Algorithms] - Listing of types

== Types ==

* [[Pretty Good Privacy|PGP]] and [[GPG]]
* [[OpenSSH]] | [[SSH]]
* [[SSL]] | [[S/MIME]]
* [[VPN]]

== Related ==

* [[privacy]] | [[identity]]
* [[key pair]] | [[public key]] | [[private key]] | [[certificate]]
* [[signature (computing)]] | [[fingerprint (computing)]]
* [[password]]

* [[obscurity]] | [[steganography]]
* [[file wipe]]

* [[cypherpunk]]

== News ==

* [http://www.computerworld.com ComputerWorld] - [http://www.computerworld.com/securitytopics/security/encryption/news/ Crypto News]

==See also==
* [[security]]
* encryption your: [[encrypting e-mail|mail]], [[encrypting files|files]], [[encrypting network links|network links]], [[encrypting chat|chat]], [[encrypting file sharing|file sharing]]

== Links ==

* [http://www.securityfocus.com/ SecurityFocus] - [http://online.securityfocus.com/infocus/1181 Introduction to Encryption]
* [http://www.goingware.com/encryption/ Why You Should Use Encryption]
* [http://www.offshore.com.ai/security/ Vince Cate's Cryptorebel/Cypherpunk Page]
* Bruce Sterling's [http://www.counterpane.com/applied.html Applied Cryptography]
* [http://random.mat.sbg.ac.at/links/crypto.html Cryptography and Random Numbers]
* [http://www.itmanagersjournal.com/software/04/06/21/196233.shtml How to use cryptography in computer security] - Basics and myths.

{{infoanarchy|Cryptography}}
[[Category:Encryption]]

User:SecurityReview

2009-01-01T15:23:01Z

SecurityReview: New page: .