Phoenix Network Forums

Im using encryption from very beginning of the boot process, but I wonder when the drive is open, is there a way to say everything in some folder should automatically be encrypted?

wrd wrote:Im using encryption from very beginning of the boot process, but I wonder when the drive is open, is there a way to say everything in some folder should automatically be encrypted?

Under which operating system do you do that? Which encryption algorithm do you use? Where does your system get the encryption key from? Is there even any?

Windows: the filesystem encryption functionality of Windows is completely worthless, because there isn't any key to use. It's some kind of simple transformation, which can be reverted easily. Using Microsoft's EFS on the other hand yields real encryption, but it's closed source, so nobody knows, how secure it actually is, and nobody knows fore sure that Microsoft doesn't have a secondary key to decrypt any EFS. Also because it uses an asymmetric algorithm, it's painfully slow, even on newer computers.

Real encryption (like provided by most free operating systems) means you need to have a choice among some cryptographic algorithms. Currently AES (Rijndael - Advanced Encryption Standard) is believed to be the most secure such algorithm, but you might want to use Blowfish instead, for which no security flaws have been reported yet, too. Choose a key size of at least 192 bits (you should have that choice). Another important thing is the block cipher mode. There are several ones with CFB (cipher block chaining) being the most widely used (and most secure). ECB (encrypted code book) is the least secure and should never be used in real applications.

At some point in your boot sequence, when the encrypted filesystems are mounted (or otherwise declared), you should need to specify a key. This can be as simple as entering a passphrase, but more secure systems would need some kind of an external device holding the key (like a floppy disk, CD-ROM, flash disk or smart card). The key itself should be encrypted as well, still requiring you to enter the proper (long) passphrase for the key. I'd recommend a flash disk holding the key. But don't forget to have a backup ready, in case your flash disk breaks or gets stolen. When the key itself is encrypted with a good passphrase, then you don't need to worry about it being stolen. The thief couldn't get the key without having the passphrase.

Hi again!

Im using safeguard that encrypts the whole disk. Still I would like it more safe under same condition, keep it simple so its still worth the effort while you are working. PGP have virtual drives and thats good but I would like to keep everything on one partition letter like c:\ so it stays in that boundary. Its messy to keep track of every mapping networking unit that I connect to everyday.

Thanks...

Well, their is a method that can be used.
You install the OS onto VMWARE Workstation.
You make sure you install the bootloader on your OS partition.
Now you should use a linux distro or cygwin to extract the image to a hd partition. Check up some manuals of how to install Mac OSX on a PC for more info on that.

wrd wrote:Im using safeguard that encrypts the whole disk. Still I would like it more safe under same condition, keep it simple so its still worth the effort while you are working. PGP have virtual drives and thats good but I would like to keep everything on one partition letter like c:\ so it stays in that boundary. Its messy to keep track of every mapping networking unit that I connect to everyday.

First: you didn't answer my questions.

Second: Safeguard guarantees that your data can be restored in case you forget your encryption passphrase. In other words: your data is effectively not encrypted. And what do we learn from this? Never trust proprietary encryption software!

bart416 wrote:Well, their is a method that can be used.
You install the OS onto VMWARE Workstation.
You make sure you install the bootloader on your OS partition.
Now you should use a linux distro or cygwin to extract the image to a hd partition. Check up some manuals of how to install Mac OSX on a PC for more info on that.

What does that have to do with encryption?

mm_freak wrote:[First: you didn't answer my questions.

Sorry, Its windows in all kind of formats.

wrd wrote:

mm_freak wrote:[First: you didn't answer my questions.

Sorry, Its windows in all kind of formats.

I've had several questions. =)