----- Original Message ----- From: "Adam Back" <[EMAIL PROTECTED]>
> Joseph Ashwood wrote: > > Actually I was referring to changing the data portion of the block > > from {data} to {IV, data} > > Yes I gathered, but this what I was referring to when I said not > possible. The OSes have 512Kbytes ingrained into them. I think you'd > have a hard time changing it. If you _could_ change that magic > number, that'd be a big win and make the security easy: just pick a > new CPRNG generated IV everytime you encrypt a block. (CPRNG based on > SHA1 or RC4 is pretty fast, or less cryptographic could be > sufficient depending on threat model). >From what I've seen of a few OSs there really isn't that much binding to 512 Kbytes in the OS per se, but the file system depends on it completely. Regardless the logic place IMO to change this is at the disk level, if the drive manufacturers can be convinced to produce drives that offer 512K+16 byte sectors. Once that initial break happens, all the OSs will play catchup to support the drive, that will break the hardwiring and give us our extra space. Of course convincing the hardware vendors to do this without a substantial hardware reason will be extremely difficult. On our side though is that I know that hard disks store more than just the data, they also store a checksum, and some sector reassignment information (SCSI drives are especially good at this, IDE does it under the hood if at all), I'm sure there's other information, if this could be expanded by 16 bytes, that'd supply the necessary room. Again convincing the vendors to supply this would be a difficult task, and would require the addition of functionality to the hard drive to either decrypt on the fly, or hand the key over to the driver. > > Yeah the defragmentation would have to be smart, it can't simply copy the > > di[s]k block (with the disk block based IV) to a new location. > > Well with the sector level encryption, the encryption is below the > defragmentation so file chunks get decrypted and re-encrypted as > they're defragmented. > > With the file system level stuff the offset is likley logical (file > offset etc) rather than absolute so you don't mind if the physical > address changes. (eg. loopback in a file, or file system APIs on > windows). That's true, I was thinking more as something that will for now run in software and in the future gets pushed down to the hardware and we can use a smartcard/USBKey/whatever comes out next to feed it the key. A meta-filesystem would be useful as a short term measure, but it still keeps all the keys in system memory where programs can access them, if we can maintain the option of moving it to hardware later on, I think that would be a better solution (although also a harder one). I feel like I'm missing something that'll be obvious once I've found it. Hmm, maybe there is a halfway decent solution (although not at all along the same lines). For some reason I was just remembering SAN networks, it's a fairly known problem to design and build secure file system protocols (although they don't get used much). So it might actually be a simpler concept to build a storage area network using whatever extra hardened OSs we need, with only the BIOS being available without a smartcard, put the smart card in, the smartcard itself decrypts/encrypts sector keys (or maybe some larger grouping), the SAN host decrypts the rest. Pull out the smartcard, the host can detect that, flush all caches and shut itself off. This has some of the same problems, but at least we're not going to have to design a hard drive, and since it's a remote file system I believe most OSs assume very little about sector sizes. Of course as far as I'm concerned this should still be just a stopgap measure until we can move that entire SAN host inside the client computer. Now for the biggest question, how do we get Joe Public to actually use this correctly (take the smart card with them, or even not choose weak passwords)? Joe