So why don't we use full disk encryption on all mobile devices?

Discussion in 'Computer Security' started by Saqib Ali, Oct 13, 2006.

  1. Saqib Ali

    Saqib Ali Guest

    2006 Security Breaches Matrix reveals that a large number of the data
    leaks were caused due to stolen laptops, which can be easily mitigated
    by using full disk encryption on the laptop. So why not encrypt the
    whole drive? Cost and performance impact are the usual arguments. Tests
    show that access time for files increases by 56%-85% after full disk
    encryption. And the cost of FDE software usually ranges from $0-$300
    depending on how good of a software and support you wanna get. So is it
    NOT worth it?

    Data from tests (performance impact) of the FDE products (PGP,
    Compusec, Pointsec and Utimaco):
    http://www.xml-dev.com/blog/index.php?action=viewtopic&id=250

    2006 Security Breaches Matrix:
    http://www.efortresses.com/refdocs/2006-Breaches-Matrix.pdf
     
    Saqib Ali, Oct 13, 2006
    #1
    1. Advertising

  2. Saqib Ali

    Jim Watt Guest

    On 12 Oct 2006 19:56:04 -0700, "Saqib Ali" <>
    wrote:

    <snip>

    For most purposes the use of a disk password would be
    give adequate protection, no overhead on legitimate use
    and no additional cost. IBM laptops have had it for a
    long time.

    --
    Jim Watt
    http://www.gibnet.com
     
    Jim Watt, Oct 13, 2006
    #2
    1. Advertising

  3. Jim Watt wrote:

    > For most purposes the use of a disk password would be
    > give adequate protection, no overhead on legitimate use
    > and no additional cost.


    adequate == none? Just moves the plates to another electronic board and
    you've got full access. Even I'm competent enough to do that.
     
    Sebastian Gottschalk, Oct 13, 2006
    #3
  4. Saqib Ali

    Notan Guest

    Sebastian Gottschalk wrote:
    >
    > Jim Watt wrote:
    >
    > > For most purposes the use of a disk password would be
    > > give adequate protection, no overhead on legitimate use
    > > and no additional cost.

    >
    > adequate == none? Just moves the plates to another electronic board and
    > you've got full access. Even I'm competent enough to do that.


    Wrong.

    A hard drive password will protect data, even if the drive is moved
    to another "home."

    Notan
     
    Notan, Oct 13, 2006
    #4
  5. Saqib Ali

    Saqib Ali Guest

    Sebastian Gottschalk wrote:
    > adequate == none? Just moves the plates to another electronic board and
    > you've got full access. Even I'm competent enough to do that.


    After Full Disk Encryption, I DON'T think you can simply move the
    platters to different board and you get full access. I think you are
    talking about ATA Drive Lock


    saqib
    http://www.full-disk-encryption.net
     
    Saqib Ali, Oct 13, 2006
    #5
  6. Saqib Ali wrote:

    > Sebastian Gottschalk wrote:
    >> adequate == none? Just moves the plates to another electronic board and
    >> you've got full access. Even I'm competent enough to do that.

    >
    > After Full Disk Encryption, I DON'T think you can simply move the
    > platters to different board and you get full access. I think you are
    > talking about ATA Drive Lock


    Exactly that's what the IBM password lock thing is about.
     
    Sebastian Gottschalk, Oct 13, 2006
    #6
  7. Saqib Ali

    Saqib Ali Guest

    > > After Full Disk Encryption, I DON'T think you can simply move the
    > > platters to different board and you get full access. I think you are
    > > talking about ATA Drive Lock

    >
    > Exactly that's what the IBM password lock thing is about.


    oops sorry. I didn't realize the original poster was talking about ATA
    Drive lock.

    I thought they were talking about Utimaco which is a FDE solution and
    ships for free with IBM/Lenovo laptops.

    saqib
    http://www.full-disk-encryption.net
     
    Saqib Ali, Oct 13, 2006
    #7
  8. Saqib Ali

    Jim Watt Guest

    On Fri, 13 Oct 2006 12:01:09 +0200, Sebastian Gottschalk
    <> wrote:

    >Jim Watt wrote:
    >
    >> For most purposes the use of a disk password would be
    >> give adequate protection, no overhead on legitimate use
    >> and no additional cost.

    >
    >adequate == none? Just moves the plates to another electronic board and
    >you've got full access. Even I'm competent enough to do that.


    But you are incapable of removing malware without flattening
    the system ...

    However, these days drive electronics are not interchangable
    and its the control board you would need to change, rather
    than opening the enclosure and whipping out the platters
    (to give them the correct name)

    There are better ways around it, but not for the average
    or even above average laptop thief.
    --
    Jim Watt
    http://www.gibnet.com
     
    Jim Watt, Oct 13, 2006
    #8
  9. Saqib Ali

    Saqib Ali Guest

    > > After Full Disk Encryption, I DON'T think you can simply move the
    > > platters to different board and you get full access. I think you are
    > > talking about ATA Drive Lock

    >
    > Exactly that's what the IBM password lock thing is about.


    However I will add that Seagate's FDE.2 drives encrypt everything by
    default before "placing it on the platter" So the mere act of enabling
    ATA Drive Lock on a Seagate FDE.2 drive does the trick. Even if you
    take out the platters and place it in a different enclosure you won't
    be able to access the data.
    See:
    http://www.seagate.com/docs/pdf/marketing/po_momentus_5400_fde_bb.pdf

    Also Seagate has plugged all the known ATA Drive Lock hacks (as far as
    I know).

    saqib
    http://www.full-disk-encryption.net
     
    Saqib Ali, Oct 13, 2006
    #9
  10. Saqib Ali wrote:

    >>> After Full Disk Encryption, I DON'T think you can simply move the
    >>> platters to different board and you get full access. I think you are
    >>> talking about ATA Drive Lock

    >>
    >> Exactly that's what the IBM password lock thing is about.

    >
    > However I will add that Seagate's FDE.2 drives encrypt everything by
    > default before "placing it on the platter" So the mere act of enabling
    > ATA Drive Lock on a Seagate FDE.2 drive does the trick. Even if you
    > take out the platters and place it in a different enclosure you won't
    > be able to access the data.
    > See:
    > http://www.seagate.com/docs/pdf/marketing/po_momentus_5400_fde_bb.pdf


    Reading that, it seems to suck:
    - can interfere with TPM
    - of course it can't be snoop-proof as claimed
    - proprietary scheme
    - most likely it's ECB and has no MAC
    - stupid talking about buzzwords like "intellectual property"

    > Also Seagate has plugged all the known ATA Drive Lock hacks (as far as
    > I know).


    So what? You also always read, change and write back the firmware.
     
    Sebastian Gottschalk, Oct 13, 2006
    #10
  11. Saqib Ali

    ulee Guest

    Sebastian Gottschalk wrote:
    > Jim Watt wrote:
    >
    > > For most purposes the use of a disk password would be
    > > give adequate protection, no overhead on legitimate use
    > > and no additional cost.

    >
    > adequate == none? Just moves the plates to another electronic board and
    > you've got full access. Even I'm competent enough to do that.
     
    ulee, Oct 14, 2006
    #11
  12. Saqib Ali

    ulee Guest

    Sebastian Gottschalk wrote:
    > Jim Watt wrote:
    >
    > > For most purposes the use of a disk password would be
    > > give adequate protection, no overhead on legitimate use
    > > and no additional cost.

    >
    > adequate == none? Just moves the plates to another electronic board and
    > you've got full access. Even I'm competent enough to do that.
     
    ulee, Oct 14, 2006
    #12
  13. Saqib Ali

    Jim Watt Guest

    On Fri, 13 Oct 2006 21:26:07 +0200, Sebastian Gottschalk
    <> wrote:

    >- stupid talking about buzzwords like "intellectual property"


    Its a legal term, not a 'buzzword' unless you share a cave
    with Bin Laden you would have come across it.
    --
    Jim Watt
    http://www.gibnet.com
     
    Jim Watt, Oct 14, 2006
    #13
  14. Saqib Ali

    Saqib Ali Guest

    OK, the review of the 7 Full Disk Encryption suites is now complete.
    The results are at:
    http://www.xml-dev.com/blog/index.php?action=viewtopic&id=250

    I did an analysis of various FDE solutions to find the best one for my
    needs. The key thing I was interested was that it must be AES 256,
    reasonably fast, inexpensive, and *offer key recovery in case of
    password loss*.

    Compusec is great for home / personal use. It is cheap i.e. $0.00
    (Free), and does not slow down the computer as much as the other
    products. But that is because it only support 128 bit AES, which is a
    major drawback as most enterprise settings require at least 256 bit
    AES. Compusec also has a great online support forum where you can get
    your questions answered by Compusec employees and other experienced
    users.

    I ended up purchasing both Utimaco and Pointsec. They are excellent
    products. They both support AES 256. The downside is that they are
    little bit expensive (Pointsec:$170 ; Utimaco:$200) and slow.

    The best thing is they both offer great password / encryption key
    recovery capabilities. You can create a recovery disk with both
    products.

    They also offer password recovery using Challenge / Response sequence,
    where the IT Helpdesk can perform a Challenge/Response sequence with
    the user to help them recover the password or reset it to a new one.
    Off course Challenge/Response password recovery is the NOT most secure,
    especially if the user is remote, but you have the option to disable it
    on the laptop if you want.
    ..

    saqib
    http://www.full-disk-encryption.net
     
    Saqib Ali, Nov 4, 2006
    #14
  15. Saqib Ali

    Unruh Guest

    "Saqib Ali" <> writes:

    >OK, the review of the 7 Full Disk Encryption suites is now complete.
    >The results are at:
    >http://www.xml-dev.com/blog/index.php?action=viewtopic&id=250


    >I did an analysis of various FDE solutions to find the best one for my
    >needs. The key thing I was interested was that it must be AES 256,
    >reasonably fast, inexpensive, and *offer key recovery in case of
    >password loss*.


    Sorry, AES 256 why? It is idiotic in that finding a 128 bit key is simply
    infeasible now and in the rather distant future.
    And then you demand key recovery which means that you automatically make
    the system weak. If you can recover the key, so can the enemy. Ie, it is
    like saying "I want a 1 foot thick steel door for my home, and I want a cat
    door in it, so if I forget my key I can reach in and unlock it. "

    >Compusec is great for home / personal use. It is cheap i.e. $0.00
    >(Free), and does not slow down the computer as much as the other
    >products. But that is because it only support 128 bit AES, which is a
    >major drawback as most enterprise settings require at least 256 bit


    How in th eworld is that a drawback? Under what rational criteria is that a
    drawback?


    >AES. Compusec also has a great online support forum where you can get
    >your questions answered by Compusec employees and other experienced
    >users.


    >I ended up purchasing both Utimaco and Pointsec. They are excellent
    >products. They both support AES 256. The downside is that they are
    >little bit expensive (Pointsec:$170 ; Utimaco:$200) and slow.


    >The best thing is they both offer great password / encryption key
    >recovery capabilities. You can create a recovery disk with both
    >products.


    >They also offer password recovery using Challenge / Response sequence,
    >where the IT Helpdesk can perform a Challenge/Response sequence with
    >the user to help them recover the password or reset it to a new one.
    >Off course Challenge/Response password recovery is the NOT most secure,
    >especially if the user is remote, but you have the option to disable it
    >on the laptop if you want.


    And now you tell me that a third party also has your key as well? Sheesh.


    >.


    >saqib
    >http://www.full-disk-encryption.net
     
    Unruh, Nov 4, 2006
    #15
  16. Saqib Ali

    Saqib Ali Guest

    > How in th eworld is that a drawback? Under what rational criteria is that a
    > drawback?


    hmm, all i said that compusec was a excellent product but it only
    offers 128bit AES. Most of the government agencies, and especially if
    you work for financial institution, require you to use 256 AES.


    > And now you tell me that a third party also has your key as well? Sheesh.


    hmm. what do you mean by third party?

    For the Challenge/Response password recovery to work, the IT Help Desk
    needs to know a secret. If that secret is leaked (e.g. posted on a
    website) yes then a attacker *might* be login into the system. The
    attacker would still need another secret, the user's logon name, which
    may or may not be easy to guess in 3 trys.

    As I said earlier, you can turn off the challence/response password
    recovery if you want. But it is good to have in case the employee
    leaves the company without giving up the passwords. This may not be
    applicable in all situations.

    BTW, the site that was hosting the analysis was down for a short period
    of time. It is back online the URL is still the same:
    http://www.xml-dev.com/blog/index.php?action=viewtopic&id=250

    saqib
    http://www.full-disk-encryption.net
     
    Saqib Ali, Nov 4, 2006
    #16
  17. Saqib Ali

    Arthur T. Guest

    In
    Message-ID:<>,
    "Saqib Ali" <> wrote:

    >> How in th eworld is that a drawback? Under what rational criteria is that a
    >> drawback?

    >
    >hmm, all i said that compusec was a excellent product but it only
    >offers 128bit AES. Most of the government agencies, and especially if
    >you work for financial institution, require you to use 256 AES.


    What version of Compusec did you benchmark? I haven't
    installed it, yet, but the documentation of CompuSec 4.21 says,
    "Fast AES Algorithm with 128 or 256 bit key length."

    --
    Arthur T. - ar23hur "at" intergate "dot" com
    Looking for a good MVS systems programmer position
     
    Arthur T., Nov 4, 2006
    #17
  18. Saqib Ali

    Saqib Ali Guest

    > What version of Compusec did you benchmark? I haven't
    > installed it, yet, but the documentation of CompuSec 4.21 says,
    > "Fast AES Algorithm with 128 or 256 bit key length."


    I had the 4.21 (Free) version installed. And 128bit was the only
    option. Maybe I missed something.

    Let me know if are able to install the product successfully and encrypt
    using 256bit AES

    thanks
    saqib
    http://www.full-disk-encryption.net
     
    Saqib Ali, Nov 4, 2006
    #18
  19. Saqib Ali

    Unruh Guest

    "Saqib Ali" <> writes:

    >> How in th eworld is that a drawback? Under what rational criteria is that a
    >> drawback?


    >hmm, all i said that compusec was a excellent product but it only
    >offers 128bit AES. Most of the government agencies, and especially if
    >you work for financial institution, require you to use 256 AES.


    I guess I did say rational criteria. There si no rational reason to prefer
    256 over 128.


    >> And now you tell me that a third party also has your key as well? Sheesh.


    >hmm. what do you mean by third party?


    >For the Challenge/Response password recovery to work, the IT Help Desk
    >needs to know a secret. If that secret is leaked (e.g. posted on a
    >website) yes then a attacker *might* be login into the system. The
    >attacker would still need another secret, the user's logon name, which
    >may or may not be easy to guess in 3 trys.


    The help desk is the third person. Anyone else who knows the password is
    the third person. That introduces a huge security hole, far far larger than
    any AES128/256 distinction. It reduces the security to something like the
    unix crypt funtion-- seeems secure but is easily broken. In this case not
    broken, but susceptible to other far more efficient lines of attack than
    direct attack on the cypher.



    >As I said earlier, you can turn off the challence/response password
    >recovery if you want. But it is good to have in case the employee
    >leaves the company without giving up the passwords. This may not be
    >applicable in all situations.


    I understand why you would want it. It is also a huge security hole. That
    is where I would spend my security concerns, not whether it uses 128, 256
    or whatever size AES.



    >BTW, the site that was hosting the analysis was down for a short period
    >of time. It is back online the URL is still the same:
    >http://www.xml-dev.com/blog/index.php?action=viewtopic&id=250


    >saqib
    >http://www.full-disk-encryption.net


    All I am saying is that the number of bits should not be factor in your
    decision, unless there is some insane political reason to take it into
    account. It is the least of your worries.

    You also have to decide what it is you are using the encryption to protect
    yourself from. If it is from the local druggie, or if it is fromNSA those
    are very different situations.
    The other thing you shoud chech is write speeds. If they use a stream
    cypher, they have to rekey every single time you write. And they have to
    reencrypt the whole block. If the block is file sized, they have to rewrite
    the whole file, not just the section of the file that changed.
    They also have to have a subkey management fascility.
     
    Unruh, Nov 5, 2006
    #19
  20. Saqib Ali

    Arthur T. Guest

    In
    Message-ID:<>,
    "Saqib Ali" <> wrote:

    >> What version of Compusec did you benchmark? I haven't
    >> installed it, yet, but the documentation of CompuSec 4.21 says,
    >> "Fast AES Algorithm with 128 or 256 bit key length."

    >
    >I had the 4.21 (Free) version installed. And 128bit was the only
    >option. Maybe I missed something.
    >
    >Let me know if are able to install the product successfully and encrypt
    >using 256bit AES


    I installed it, didn't like it, and uninstalled it. I didn't
    try encrypting the drives, but I tried using 256-bit strings for
    the securityinfo.dat file, and couldn't make it work.

    Of course, even 128-bit encryption is overkill since the
    password is a maximum of 16 alpha-numeric characters. I work that
    out to be just over 95 bits worth. Even worse, you *must* have
    two passwords (one for password recovery), so I figure that brings
    it down to just over 94 bits.

    Also, there's something akin to a back-door in Compusec. In
    their Yahoo support group, one message said:

    >Hi, may I recommend you to send your Securityinfo.dat file to:
    >
    >support.sg@ce-infosys
    >
    >Send it with a request to have them extract your UserID and password
    >reset code.
    >
    >Let us know if you encounter any problem.
    >
    >CE-Infosys




    --
    Arthur T. - ar23hur "at" intergate "dot" com
    Looking for a good MVS systems programmer position
     
    Arthur T., Nov 8, 2006
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Saqib Ali
    Replies:
    22
    Views:
    1,262
    Ertugrul Soeylemez
    Jan 5, 2007
  2. princess
    Replies:
    0
    Views:
    501
    princess
    May 16, 2007
  3. princes
    Replies:
    0
    Views:
    432
    princes
    May 20, 2007
  4. princes

    Mobile reviews,Secrets,mobile venues, mobile themes

    princes, Jun 2, 2007, in forum: Digital Photography
    Replies:
    0
    Views:
    515
    princes
    Jun 2, 2007
  5. princes

    Mobile 3GP Videos, Mobile Games, Mobile secrets

    princes, Jun 5, 2007, in forum: Digital Photography
    Replies:
    0
    Views:
    457
    princes
    Jun 5, 2007
Loading...

Share This Page