Still working to recover. Please don't edit quite yet.
Difference between revisions of "hard disk encryption"
(Added Category:Encryption) |
(Clean up page and put into alphabetical order) |
||
Line 1: | Line 1: | ||
− | See also: | + | See also: [[cryptography]] | [[Encrypting_Your|Encrypting Your...]] | [[Cryptography/Attacks]] | [[Undelete_Attack|Undelete Attack]] |
[[AKA]]: Volume Encryption | [[AKA]]: Volume Encryption | ||
Line 18: | Line 18: | ||
= Software = | = Software = | ||
+ | ===Windows=== | ||
− | + | # [http://www.jetico.com Bestcrypt] - proprietary program. Windows and Linux versions, very stable, doesn't appear to lose data over an extended period. Modules for all major encryption algorithms. Finland (not USA) origins. | |
− | + | # [http://www.scherrer.cc/crypt/ CrossCrypt] - [[free software|Free Software]], [[open source software|open-source]] implementation of [[AES]] and [[Twofish]] for Windows 2000/XP. Compatible with Linux AES/Twofish. Use either as a command-line based system, or download [http://www.sdean12.org/CrossCryptGUI.htm CrossCryptGUI], a [[GUI]] [[Front-End]] for it | |
− | + | # [http://www.cypherix.com/cryptainerle/index.htm Cyptainer LE] - easy-to-use, nag-free commercial software but with a size limit of 25 megs. | |
− | + | # [http://www.secureaction.com/cryptoexpert/std/ CryptoExpert 2004 PE] - A commercial disk encryption tool. A professional version also available. | |
− | + | # [http://www.dekart.com/products/file_disk_encryption/private_disk/ Dekart Private Disk] - [[AES]] encryption, flexible and easy to use - Shareware - 95/98/ME/NT/2000/XP. Allows securing hard disks and USB flash disks, runs from USB disk with no host PC installation. Provides innovative Disk Firewall mechanism - protecting access to the encrypted disk application by application. Disk firewall allows creating a white list of applications allowed to access the encrypted disk making sure that no trojans or any spyware will harm the secured data. | |
− | + | ||
− | # [http://www.jetico.com Bestcrypt] - proprietary program | + | |
− | + | ||
− | + | ||
− | + | ||
− | # [http://www.scherrer.cc/crypt/ CrossCrypt] - [[free software|Free Software]], [[open source software|open-source]] implementation of [[AES]] and [[Twofish]] for | + | |
− | # [http://www. | + | |
− | # [http://www. | + | |
− | # [http://www.dekart.com/products/file_disk_encryption/private_disk/ Dekart Private Disk] - [[AES]] encryption, flexible and easy to use - Shareware - 95/98/ME/NT/2000/XP. Allows securing hard disks and USB flash disks, runs from USB disk with no host PC installation. Provides innovative Disk Firewall mechanism - protecting access to the encrypted disk application by application. Disk firewall allows creating a white list of applications allowed to access the encrypted disk making sure that no trojans or any spyware will harm the secured data | + | |
− | + | ||
− | + | ||
− | + | ||
− | + | ||
# [http://www.drivecrypt.com/ DriveCrypt] - commercial software for Windows | # [http://www.drivecrypt.com/ DriveCrypt] - commercial software for Windows | ||
− | # [http://www. | + | # [http://www.woundedmoon.org/win32/e4m202a.html E4M] - Encryption for the Masses. [[Freeware]] product (no longer being developed) for Windows NT. |
+ | # [http://www.FreeOTFE.org/ FreeOTFE] - [[free software|Free]], [[open source software|open source]] encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Provides two-level [[deniable encryption|plausible deniability]] (including [http://www.freeotfe.org/docs/plausible_deniability.htm hidden volumes]). Supoprts backup of critical information needed to restore volumes. Additionally supports [[Linux]] Cryptoloop "losetup", dm-crypt and LUKS volumes. Includes ''many'' different cypher and hash algorithms, including [[AES]], [[Twofish]], [[Serpent]], [[Blowfish]], etc. Highly flexible and easy to use. Allows the use of optional PKCS#11 standard tokens (e.g. Aladdin eToken and smartcards) Supports both Windows 2K/XP/2003/Vista and Windows Mobile/PocketPC PDAs | ||
+ | # [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for Windows and Mac OS X. [http://www.pgpi.org/products/pgpdisk/ PGP v6.0.1] includes PGPDisk for free | ||
+ | # [http://www.utimaco.us/products/easy/ SafeGuard Easy] - Commercial versions for Windows. Encrypts the entire disk with pre-boot authentication | ||
+ | # [http://www.utimaco.us/products/privatedisk/ SafeGuard PrivateDisk] - Commercial versions for Windows Personal and Enterprise Edition (with centralized management for enterprise customers) | ||
+ | # [http://www.scramdisk.clara.net/ Scramdisk] - free for Windows 9x but not the Windows NT | ||
+ | # [http://www.cs.auckland.ac.nz/~pgut001/sfs/ SFS] - Outdated, free, secure File System for DOS/Windows 3.1. Requires some configuration. Has not been updated since September of 1996. | ||
+ | # [http://www.truecrypt.org TrueCrypt] - [[free software|Free]], [[open source software|open source]], based on the now obsolete [http://www.woundedmoon.org/win32/e4m202a.html E4M]. Provides two-level [[deniable encryption|plausible deniability]] (including [http://www.truecrypt.org/hiddenvolume.php hidden volumes]). Encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Supports [[Microsoft Windows|Windows]] XP/2000/2003 and [[GNU/Linux]]. [[AES]], [[Twofish]] and [[Serpent]] and some combinations of them. | ||
+ | # [http://www.ritlabs.com/en/products/pd/ The Bat! Private Disk] - [[Shareware]], (appears to be the same or similar to Dekart Private Disk). [[AES]] on-the-fly encryption. Super fast, easy to use. Size Limit: 2[[/wiki/index.php?|GB]] for Windows 95/98/ME and up to 4[[/wiki/index.php?|TB]] for Windows NT/2000/XP. | ||
− | + | ===PDAs=== | |
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | # [http://www.FreeOTFE.org/ FreeOTFE4PDA] - [[free software|Free]], [[open source software|open source]] creates encrypted file-hosted containers. Supports hidden volumes. Supoprts backup of critical information needed to restore volumes. Additionally supports [[Linux]] Cryptoloop "losetup", dm-crypt and LUKS volumes. A PC version available (FreeOTFE) which is fully compatible is also freely available | |
− | # | + | |
− | + | ||
− | + | === Mac OS === | |
+ | # [http://www.pgpi.org/products/pgpdisk/ PGP Disk 6.0.1] - Free for Windows and Mac OS 8+, taken from an old version of commercial [[PGP]]. | ||
+ | # [http://pgp.com/products/personal/index.html PGP Disk 8.0] - commercial version for Windows and Mac OS X | ||
− | + | Note: Mac OS X version 10.3+ allows for integrated encryption of one's home directory. | |
− | |||
− | |||
+ | === For UNIX-like systems === | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
# [http://www.jetico.com Bestcrypt] - proprietary program, see description under Windows version. | # [http://www.jetico.com Bestcrypt] - proprietary program, see description under Windows version. | ||
+ | # [http://www.netbsd.org/guide/en/chap-cgd.html cgd] - cryptographic device driver for NetBSD. Unlike other implementations, not vulnerable to dictionary attacks. [http://www.imrryr.org/~elric/cgd/cgd.pdf Here] is a extensive [[PDF]] article concerning CGD by the authors. | ||
# [http://www.kerneli.org CryptoAPI] The GNU/Linux Crypto [[API]] | # [http://www.kerneli.org CryptoAPI] The GNU/Linux Crypto [[API]] | ||
− | # [http://www. | + | # [http://www.crypto.com/software Crypto File System] (an encrypting [[File_system|file system]] for Unix-like OSs) -- The FS code dates back to 1989, and the crypto to 1992. |
− | # [http://www. | + | # [http://www.saout.de/misc/dm-crypt/ dm-crypt] - CryptoLoop's [http://kerneltrap.org/node/view/2433 successor]. For Linux. |
+ | |||
# [http://arg0.net/users/vgough/encfs.html EncFS] - User-space encrypted filesystem implementation for Linux 2.4 & 2.6. It has some advantages over other implementations, namely the dynamic size. Other (dis)advantages are stated on the homepage as well as a comparison between EncFS and other encrypted filesystem implementations on site. | # [http://arg0.net/users/vgough/encfs.html EncFS] - User-space encrypted filesystem implementation for Linux 2.4 & 2.6. It has some advantages over other implementations, namely the dynamic size. Other (dis)advantages are stated on the homepage as well as a comparison between EncFS and other encrypted filesystem implementations on site. | ||
+ | # [http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html/ GEOM Based Disk Encryption (gbde)] FreeBSD encryption - encrypts the sector payload using 128-bit AES in CBC mode. Each sector on the disk is encrypted with a different AES key. gbde transparently encrypts entire file systems. Mounts just like another drive. View the FreeBSD handbook for instructions. | ||
# [http://loop-aes.sourceforge.net/ Loop-AES] - Uses [[AES]] to encrypt [[/wiki/index.php?|partitions]] under [[Linux|GNU/Linux]]. Fairly simple and effective. No real homepage, so try [http://sourceforge.net/projects/loop-aes http://sourceforge.net/projects/loop-aes] | # [http://loop-aes.sourceforge.net/ Loop-AES] - Uses [[AES]] to encrypt [[/wiki/index.php?|partitions]] under [[Linux|GNU/Linux]]. Fairly simple and effective. No real homepage, so try [http://sourceforge.net/projects/loop-aes http://sourceforge.net/projects/loop-aes] | ||
− | # [http://www. | + | # [http://www.mcdonald.org.uk/StegFS StegFS] - a [[Stenography|steganographic]] [[Filesystems|file system]] for [[Linux]]. More than just [[Encryption|encryption]], also allows one to hide (parts of) data. Be aware that only using StegFS doesn't provide a secure hiding, additional precautions should be taken; see the [[FAQ]] on the site. Currently for Linux 2.2 only. |
− | # [http://www. | + | # [http://www.tcfs.it TCFS] - Transparent Cryptographic File System is a transparent filesystem for both transparent local and transparent network encryption. It is supported by [[Linux]] 2.0/2.2, NetBSD and OpenBSD -- Has not been updated since late 2002. |
+ | # [http://www.truecrypt.org TrueCrypt] - see description under Windows version. | ||
+ | # [http://www.openbsd.org/cgi-bin/man.cgi?query=vnconfig&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html vnconfig] under OpenBSD to configure a [http://www.openbsd.org/cgi-bin/man.cgi?query=svnd&apropos=0&sektion=4&manpath=OpenBSD+Current&arch=i386&format=html svnd] (pseudo-drive) encrypted with [[Blowfish]]. | ||
# [http://vncrypt.sourceforge.net/ vncrypt] - FreeBSD container encryption - Uses AES-Rijndael encryption in CBC mode. Utilizes FreeBSDs vnode pseudo disk device support. Is available through the ports collection. | # [http://vncrypt.sourceforge.net/ vncrypt] - FreeBSD container encryption - Uses AES-Rijndael encryption in CBC mode. Utilizes FreeBSDs vnode pseudo disk device support. Is available through the ports collection. | ||
− | # [ | + | |
− | # [http://www. | + | |
+ | =Notes about Windows security= | ||
+ | |||
+ | # '''Native Folder Encryption''': Although Windows XP Professional and possibly some versions of Windows 2000 provide folder encryption with [[New Technology File System|NTFS]] [[filesystem]]s, they should be considered only a very basic solution. The Window's native encryption is far easier to bypass than the software listed below. | ||
+ | # Hard Disk Encryption is '''not the only solution''' to data security in Windows: | ||
+ | ## One of the most important parts is clearing the [[/wiki/index.php?|pagefile]] on shutdown to delete information you only thought was located in your encrypted volumes. [http://www.tech-recipes.com/modules.php?name=Recipes&rx_id=12 Editing your registry] is one option and [http://www.xp-antispy.org/ XP-antispy] is another. Doing so may slow the shutdown process but but will also improve overall system speed. | ||
+ | ## Software for cleaning up Windows entirely such as [http://www.webroot.com/products/windowwasher/ Window Washer] or [http://www.google.com/Top/Computers/Software/Shareware/Windows/Security/Internet/Cache_Tools/?il=1 other items]. | ||
+ | |||
+ | Also see [[file wipe]] for similar tools. | ||
Revision as of 15:28, 1 January 2009
See also: cryptography | Encrypting Your... | Cryptography/Attacks | Undelete Attack
AKA: Volume Encryption
A secure container file on a disk, meant to hide information that, when opened with a password, is treated as a separate disk (for instance the H:\ drive). This is preferable to normal file encryption as the operations of encryption and decryption are transparent to the user.
This software is popular on laptops, which are often stolen and can carry sensitive financial information.
Contents
How it works
Hard Disk Encryption programs run a memory-resident program is in the background, acting as an interpreter between the container file and the rest of the computer. Without the memory resident program and password, the file is indistiguishable from random data.
If the program is shut down, hard drive is removed suddenly, or system turned off, the volume is secure depending on the underlying filesystem. These days, filesystems support journaling and atomic writes hence this is of little concern.
Most implementations are vulnerable to dictionary attacks though. Also, if the source is not open, one is arguably more vulnerable because it is not known to the public how the program exactly works. It could be backdoored.
Software
Windows
- Bestcrypt - proprietary program. Windows and Linux versions, very stable, doesn't appear to lose data over an extended period. Modules for all major encryption algorithms. Finland (not USA) origins.
- CrossCrypt - Free Software, open-source implementation of AES and Twofish for Windows 2000/XP. Compatible with Linux AES/Twofish. Use either as a command-line based system, or download CrossCryptGUI, a GUI Front-End for it
- Cyptainer LE - easy-to-use, nag-free commercial software but with a size limit of 25 megs.
- CryptoExpert 2004 PE - A commercial disk encryption tool. A professional version also available.
- Dekart Private Disk - AES encryption, flexible and easy to use - Shareware - 95/98/ME/NT/2000/XP. Allows securing hard disks and USB flash disks, runs from USB disk with no host PC installation. Provides innovative Disk Firewall mechanism - protecting access to the encrypted disk application by application. Disk firewall allows creating a white list of applications allowed to access the encrypted disk making sure that no trojans or any spyware will harm the secured data.
- DriveCrypt - commercial software for Windows
- E4M - Encryption for the Masses. Freeware product (no longer being developed) for Windows NT.
- FreeOTFE - Free, open source encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Provides two-level plausible deniability (including hidden volumes). Supoprts backup of critical information needed to restore volumes. Additionally supports Linux Cryptoloop "losetup", dm-crypt and LUKS volumes. Includes many different cypher and hash algorithms, including AES, Twofish, Serpent, Blowfish, etc. Highly flexible and easy to use. Allows the use of optional PKCS#11 standard tokens (e.g. Aladdin eToken and smartcards) Supports both Windows 2K/XP/2003/Vista and Windows Mobile/PocketPC PDAs
- PGP Disk 8.0 - commercial version for Windows and Mac OS X. PGP v6.0.1 includes PGPDisk for free
- SafeGuard Easy - Commercial versions for Windows. Encrypts the entire disk with pre-boot authentication
- SafeGuard PrivateDisk - Commercial versions for Windows Personal and Enterprise Edition (with centralized management for enterprise customers)
- Scramdisk - free for Windows 9x but not the Windows NT
- SFS - Outdated, free, secure File System for DOS/Windows 3.1. Requires some configuration. Has not been updated since September of 1996.
- TrueCrypt - Free, open source, based on the now obsolete E4M. Provides two-level plausible deniability (including hidden volumes). Encrypts partitions, devices (USB memory sticks, etc.) or creates encrypted file-hosted containers. Supports Windows XP/2000/2003 and GNU/Linux. AES, Twofish and Serpent and some combinations of them.
- The Bat! Private Disk - Shareware, (appears to be the same or similar to Dekart Private Disk). AES on-the-fly encryption. Super fast, easy to use. Size Limit: 2GB for Windows 95/98/ME and up to 4TB for Windows NT/2000/XP.
PDAs
- FreeOTFE4PDA - Free, open source creates encrypted file-hosted containers. Supports hidden volumes. Supoprts backup of critical information needed to restore volumes. Additionally supports Linux Cryptoloop "losetup", dm-crypt and LUKS volumes. A PC version available (FreeOTFE) which is fully compatible is also freely available
Mac OS
- PGP Disk 6.0.1 - Free for Windows and Mac OS 8+, taken from an old version of commercial PGP.
- PGP Disk 8.0 - commercial version for Windows and Mac OS X
Note: Mac OS X version 10.3+ allows for integrated encryption of one's home directory.
For UNIX-like systems
- Bestcrypt - proprietary program, see description under Windows version.
- cgd - cryptographic device driver for NetBSD. Unlike other implementations, not vulnerable to dictionary attacks. Here is a extensive PDF article concerning CGD by the authors.
- CryptoAPI The GNU/Linux Crypto API
- Crypto File System (an encrypting file system for Unix-like OSs) -- The FS code dates back to 1989, and the crypto to 1992.
- dm-crypt - CryptoLoop's successor. For Linux.
- EncFS - User-space encrypted filesystem implementation for Linux 2.4 & 2.6. It has some advantages over other implementations, namely the dynamic size. Other (dis)advantages are stated on the homepage as well as a comparison between EncFS and other encrypted filesystem implementations on site.
- GEOM Based Disk Encryption (gbde) FreeBSD encryption - encrypts the sector payload using 128-bit AES in CBC mode. Each sector on the disk is encrypted with a different AES key. gbde transparently encrypts entire file systems. Mounts just like another drive. View the FreeBSD handbook for instructions.
- Loop-AES - Uses AES to encrypt partitions under GNU/Linux. Fairly simple and effective. No real homepage, so try http://sourceforge.net/projects/loop-aes
- StegFS - a steganographic file system for Linux. More than just encryption, also allows one to hide (parts of) data. Be aware that only using StegFS doesn't provide a secure hiding, additional precautions should be taken; see the FAQ on the site. Currently for Linux 2.2 only.
- TCFS - Transparent Cryptographic File System is a transparent filesystem for both transparent local and transparent network encryption. It is supported by Linux 2.0/2.2, NetBSD and OpenBSD -- Has not been updated since late 2002.
- TrueCrypt - see description under Windows version.
- vnconfig under OpenBSD to configure a svnd (pseudo-drive) encrypted with Blowfish.
- vncrypt - FreeBSD container encryption - Uses AES-Rijndael encryption in CBC mode. Utilizes FreeBSDs vnode pseudo disk device support. Is available through the ports collection.
Notes about Windows security
- Native Folder Encryption: Although Windows XP Professional and possibly some versions of Windows 2000 provide folder encryption with NTFS filesystems, they should be considered only a very basic solution. The Window's native encryption is far easier to bypass than the software listed below.
- Hard Disk Encryption is not the only solution to data security in Windows:
- One of the most important parts is clearing the pagefile on shutdown to delete information you only thought was located in your encrypted volumes. Editing your registry is one option and XP-antispy is another. Doing so may slow the shutdown process but but will also improve overall system speed.
- Software for cleaning up Windows entirely such as Window Washer or other items.
Also see file wipe for similar tools.
Related
Related Links
- Open Directory Project - Hard Disk Encryption
- Several papers about CryptFS. Dated from '92 till '03.
- Encrypted Root Filesystem HOWTO: using strong encryption to secure your root filesystem on Linux.
This article is based on a public domain infoAnarchy article: Hard_Disk_Encryption | iA |