Can you keep a secret? This encrypted drive can...
http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2006/10/30/BUGU2M1ETT1.DTLtype=printable http://www.theglobeandmail.com/servlet/story/RTGAM.20061030.wharddrive1029/BNStory/Front/?page=rssid=RTGAM.20061030.wharddrive1029 http://www.infoworld.com/article/06/10/30/HNseagateagain_1.html -- Saqib Ali, CISSP, ISSAP http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: Can you keep a secret? This encrypted drive can...
I compile a lot of software on my laptop, and I *certainly notice* the difference between my office laptop (no encryption) and my travel laptop (with FDE). The laptops are exactly the same, with the same image loaded. The only difference is the FDE software that is installed on the travel laptop. That is why I did an analysis of various FDE solutions to find the best one for my needs. The key thing I was interested was that it must be AES 256, reasonably fast, inexpensive, and offer key recovery in case of password loss. The final outcome of the analysis is available @ http://www.xml-dev.com/blog/index.php?action=viewtopicid=250 Compusec is great for home / personal use. It is cheap i.e. $0.00 (Free), and does not slow down the computer as much as the other products. But that is because it only support 128 bit AES, which is a major drawback as most enterprise settings require at least 256 bit AES. Compusec also has a great online support forum where you can get your questions answered by Compusec employees and other experienced users. I ended up purchasing both Utimaco and Pointsec. They are excellent products. They both support AES 256. The downside is that they are little bit expensive (Pointsec:$170 ; Utimaco:$200) and slow. The best thing is they both offer great password / encryption key recovery capabilities. You can create a recovery disk with both products. They also offer password recovery using Challenge / Response sequence, where the IT Helpdesk can perform a Challenge/Response sequence with the user to help them recover the password or reset it to a new one. Off course Challenge/Response password recovery is the NOT most secure, especially if the user is remote, but you have the option to disable it on the laptop if you want. - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: Can you keep a secret? This encrypted drive can...
Hello Alexander, My guess is that slow compilation is a result of access time misconfiguration: if a filesystem has access time enabled, then each time a file is read, the file system updates access time on disk. A solution is to set noatime option on the filesystem used for compilation. This is a good info. Do you how this can be done on windows? P.S. Probably of interest for disk benchmarker: disk performance depends on which cylinders are used, so if one has two partitions (one near the center and another one near the outer edge of the disk) performance on these partitions can be different. Good point. That is why I made sure that I had only 1 partition, and i used the fasted drive in the market available for laptops. :-) saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
NIST releases a security guide for managers
http://csrc.nist.gov/publications/nistpubs/800-100/sp800-100.pdf This guide is specifically written for top level security/info management (CSOs, CIOs etc). It addresses the requirements of various security policies and laws, such as Clinger-Cohen Act (CCA) and FISMA. -- Saqib Ali, CISSP, ISSAP http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
1 in 3 US residents are potential identity theft victim?
not really. however Privacy Rights Clearinghouse reports that 100,000,000 personal records have ended up in criminal hands since 2005. See: http://www.privacyrights.org/ar/chrondatabreaches.htm That does not mean 100 million people have become victims of identity theft. And there is no reason to believe that these records have ended someone's hand who plans to abuse them. But with US population of 295,734,134 (CIA numbers) there is good chance that one of friend is a potential identity theft victim. saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
How important is FIPS 140-2 Level 1 cert?
Hello All, I would like to know how much weight people usually give to the FIPS 140-2 Level 1 certification. If two products have exactly same feature set, but one is FIPS 140-2 Level 1 certified but cost twice. Would you go for it, considering the Level 1 is the lowest. saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: How important is FIPS 140-2 Level 1 cert?
Assuming that the two products use Internet protocols (as compared to proprietary protocols): I don't understand this statement. What do you mean by internet protocol vs proprietary protocol??? And also we are looking at FDE solutions, so there are no internet protocols involved in that. no. Probably the only thing that could differentiate the two is if the cheaper one has a crappy random number generator, the more expensive one will have a good one. well I think FIPS 140-2 Level 1 ensures more than just a good PRNG. Even if a public crypto (e.g. AES) is used in a product, there are many mistakes that can be made during the implementation. And FIPS 140-2 Level 1 is expected to catch these egregious mistakes. saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Fwd: [FDE] Largest Ever Single FDE implementation
-- Forwarded message -- From: Bryan Glancey [EMAIL PROTECTED] Date: Dec 27, 2006 7:47 AM For everyone on this list's interest. The US Government is currently conducting the largest single side-by-side comparison and competition for the selection of a Full Disk Encryption product. This implementation will end up being the largest single implementation ever, and all of the information regarding the competition is in the public domain. The winner (s) will deploy MILLIONS of seats in the US federal government space. You can read about the competition, which will come to a close in the next 90 days at: http://www.fbo.gov/spg/USAF/AFMC/ESC/FA8771-07-R-0001/Attachments.html Regards; Bryan Glancey saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: (Short) Intro and question
I think you are looking for the m of n solution, or commonly known as shared secret which can be implemented using shamir's or blakley's scheme. you can find a open source implementation of shamir's scheme @ http://point-at-infinity.org// or more info check out the wikipedia entry: http://en.wikipedia.org/wiki/Secret_sharing saqib http://www.full-disk-encryption.net On 1/6/07, Allen [EMAIL PROTECTED] wrote: Hi everyone, I'm Allen Schaaf and I'm primarily an information security analyst - I try to look at things like a total stranger and ask all the dumb questions hoping to stumble on one or two that hadn't been asked before that will reveal a potential risk. I'm currently consulting at a very large HMO and finding that there are lots of questions that have not been asked so I'm having fun. One of the questions that I have been raising is trust and how to ensure that that it is not misplaced or eroded over time. Which leads me to my question for the list: I can see easily how to do split key for 2 out of x for key recovery, but I can't seem to find a reference to the 3 out of x problem. In case I have not been clear enough, it is commonly known that it is harder to get collusion when three people need to act together than when there are just two. For most encryption 2 out x is just fine, but some things need a higher level of security than 2 out of x can provide. Thanks for any tips, ideas, solutions, or pointers. Allen Schaaf Information Security Analyst Certified Network Security Analyst and Intrusion Forensics Investigator - CEH, CHFI Certified EC-Council Instructor - CEI Security is lot like democracy - everyone's for it but few understand that you have to work at it constantly. - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED] -- Saqib Ali, CISSP, ISSAP http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
It's a Presidential Mandate, Feds use it. How come you are not using FDE?
An article on how to use freely available Full Disk Encryption (FDE) products to protect the secrecy of the data on your laptops. FDE solutions helps to prevent data leaks in case the laptop is stolen or goes missing. The article includes a brief intro, benefits, drawbacks, some tips, and a complete list of FDE solutions in the market. http://www.full-disk-encryption.net/intro.php - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: It's a Presidential Mandate, Feds use it. How come you are not using FDE?
Dr. Bellovin, In most situations, disk encryption is useless and probably harmful. It's useless because you're still relying on the OS to prevent access to the cleartext through the file system, and if the OS can do that it can do that with an unencrypted disk. I am not sure I understand this. With FDE, the HDD is unlocked by a pre-boot kernel (linux). It is not the function of the resident OS to unlock the drive. It's harmful because you can lose a key. (Your web page does address that, but I'm perplexed -- what is challenge/response authentication for key recovery?) Challenge/Response password recovery, as I understand, is a very simplified implementation of Secret Sharing. It allows for 2 parties, in this case the IT HelpDesk and the User, to collaborate and recover a Secret. 1) Upon forgetting the password, the user calls the Help Desk. 2) The IT Help Desk authenticates the user in the usual ways (e.g. check office voice mail etc), as the policy dictates. 3) Once authenticated the user give the partial secret to the HelpDesk. 4) The HelpDesk then combine it with the secret they have to produce a temporary password. 5) The temporary password is then used to unlock the HDD once, and new credentials are created. -- Saqib Ali, CISSP, ISSAP http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: It's a Presidential Mandate, Feds use it. How come you are not using FDE?
Legal access is a special case -- what is the law (and practice) in any given country on forced access to keys? If memory serves, Mike Godwin Yup. Disk Crypto has a ugly side as well, as highlighted by the recent incident where FBI was unable to crack the encryption used by a pedophile and murderer. There was a long discussion on this topic on the Security-Basics mailing list: http://www.xml-dev.com/lurker/thread/20061020.173753.ee4c6a0c.en.html#20061020.173753.ee4c6a0c saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: It's a Presidential Mandate, Feds use it. How come you are not using FDE?
Yes, encrypted disks aren't much good unless the OS also encrypts (at least) swap space. I note that OpenBSD ships with swap-space I think you are confusing Disk Encryption with Full Disk Encryption (FDE). They are two different beast. FDE encrypts the entire boot drive, including the OS, kernel and the swap space. Disk Encryption, on the other hand, only encrypts the non-OS portion. saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: It's a Presidential Mandate, Feds use it. How come you are not using FDE?
Algorithms can be perfect and implementation sloppy. If you can review the code you might find the problem, but with proprietary code, fergetit. I think you guys are missing the point. The term Snake-Oil Crypto refers to the algorithm and NOT the actual implementation. This is a important distinction. I am copying Matt Curtain (who maintains Snake-Oil Crypto FAQ) and Bruce Schneier so that they can correct me if I am wrong. We all know that many open crypto algorithms (like kerberos, AES) have been implemented in sloppy manner in both open-source and close-source world. Being open source doesn't necessarily mean that the implementation is secure. When is the last time you checked the code for the open source app that you use, to make sure that it is written properly? saqib http://www.full-disk-encryption.net On 1/18/07, Allen [EMAIL PROTECTED] wrote: Saqib Ali wrote: Since when did AES-128 become snake-oil crypto? How come I missed that? Compusec uses AES-128 . And as far as I know AES is NOT snake-oil crypto Saqib, I believe you are correct as to the algorithm, but the snake-oil is in the implementation, As I have often said, A misplaced comma in an English sentence will merely get you a bad reputation as a writer, however, a misplaced comma in a nuclear weapons project may leave an enduring mark on the world. Closed-source doesn't mean that it is snake-oil. If that was the case, the Microsoft's EFS, and Kerberos implementation would be snake oil too. As I recall there have been a few problems with Kerberos in the past. Best, Allen - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED] -- Saqib Ali, CISSP, ISSAP http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: One Laptop per Child security
And here is the wired coverage of the BitFrost platform: http://www.wired.com/news/technology/0,72669-0.html?tw=wn_culture_1 From the article: But it should come as no surprise -- given how thoroughly the project has rewritten the conventions of what a laptop should be -- that the OLPC's security isn't built on firewalls and anti-virus software. Instead, the XO will premiere a security system that takes a radical approach to computer protection. For starters, it does away with the ubiquitous security prompts so familiar to users of Windows and anti-virus software, said Ivan Krstic, a young security guru on break from Harvard, who's in charge of security for the XO. How can you expect a 6-year old to make a sensible decision when 40-year olds can't? Krstic asked, in a session at the 2007 RSA Conference. Those boxes simply train users to check yes, he argued. Krstic's system, known as the BitFrost platformRead more at: http://www.wired.com/news/technology/0,72669-0.html?tw=wn_culture_1 saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
interesting and thought provoking resources on quantum crypto
i have been tasked by my advisor to create series of mini-lectures slides on the topic of cryptography for a freshman year CS class. each mini-lecture will be 10-12 mins and will be delivered towards the end of the class (so i will have to make them *very* interesting). There is be 12 sessions. I know what to include in the slides, but i would like to end each session with a link/URL to a interesting and thought provoking resource on quantum crypto. any thoughts? the resource has to be related to quantum crypto saqib http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: quantum computer demonstrated, maybe.
Another interesting piece is that even D-Wave's own Chief Executive Herb Martin says the machine isn't a real quantum computer, but is instead a kind of special-purpose machine that uses some quantum mechanics. http://hosted.ap.org/dynamic/stories/T/TECHBIT_QUANTUM_QUANDARY?SITE=FLDAYSECTION=HOMETEMPLATE=DEFAULT saqib http://www.full-disk-encryption.net On 2/15/07, Perry E. Metzger [EMAIL PROTECTED] wrote: The most interesting bit of the article: And how exactly would users know that it was the quantum computer rather than a human or ordinary computer answering their queries? There's really no way to convince a skeptic who's accessing the machine remotely, Rose admits. For now, D-Wave's device is slower than an inexpensive home computer, but Rose says a potentially faster 1,000-qubit version should be available by the end of next year. One wonders if the quote is remotely accurate. http://www.sciam.com/article.cfm?chanID=sa001articleID=BD4EFAA8-E7F2-99DF-372B272D3E271363 -- Saqib Ali, CISSP, ISSAP http://www.full-disk-encryption.net - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
An Extension of Weiner's Attack on RSA Encryption
This year's BT Young Scientist Award for Mathematics was awarded to a 19 year old in the field of cryptography. The project, entitled 'An Extension of Weiner's Attack on RSA Encryption' used complex mathematics to challenge the security of keys associated with encryption. Using cutting edge mathematical research, Abdul succeeded in decreasing the security of safe keys, used to decode mathematical messages. Abdul's discoveries have many practical applications in the areas of IT and internet safety. Read more: http://www.btyoungscientist.ie/f_version/mediacentre_win.html Does anyone have details on the methods used in the project? If so, please share. Saqib http://security-basics.blogspot.com/ - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Contested UK encryption disclosure law takes effect
Source: http://www.washingtonpost.com/wp-dyn/content/article/2007/10/01/AR2007100100511.html British law enforcement gained new powers on Monday to compel individuals and businesses to decrypt data wanted by authorities for investigations. .. Failure to comply could mean a prison sentence of up to two years for cases not involving national security or five years for those that do. Read the entire story at: http://www.washingtonpost.com/wp-dyn/content/article/2007/10/01/AR2007100100511.html Saqib http://security-basics.blogspot.com/ - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Bid on a SnakeOil Crypto Algorithm Patent
http://www.freepatentauction.com/patent.php?nb=950 Snake Oil Keywords: 1) Breach-proof Encryption, 2) landmark invention in Cryptography and Information Security saqib http://security-basics.blogspot.com/ - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
