hardware encryption with usb key?

Discussion in 'Storage & Backup' started by ae00711, Nov 29, 2018.

  1. ae00711

    ae00711 Member

    Joined:
    Apr 9, 2013
    Messages:
    1,504
    my mind is drawing a blank as to what to google..

    are there any devices that sit between HDD and controller, that encrypts everything (data) going thru, with a usb key, and if the usb key isn't present, no-go, no-show etc?
     
  2. power

    power Member

    Joined:
    Apr 20, 2002
    Messages:
    61,549
    Location:
    brisbane
    Bitlocker
     
  3. Arctic_Silver08

    Arctic_Silver08 Member

    Joined:
    Aug 11, 2012
    Messages:
    1,240
  4. elvis

    elvis Old school old fool

    Joined:
    Jun 27, 2001
    Messages:
    39,779
    Location:
    Brisbane
  5. waltermitty

    waltermitty Member

    Joined:
    Feb 19, 2016
    Messages:
    1,098
    Location:
    BRISBANE
    Doesn't LUKS have keydisks?
     
  6. elvis

    elvis Old school old fool

    Joined:
    Jun 27, 2001
    Messages:
    39,779
    Location:
    Brisbane
    PersianImmortal likes this.
  7. OP
    OP
    ae00711

    ae00711 Member

    Joined:
    Apr 9, 2013
    Messages:
    1,504
  8. OP
    OP
    ae00711

    ae00711 Member

    Joined:
    Apr 9, 2013
    Messages:
    1,504
  9. fad

    fad Member

    Joined:
    Jun 26, 2001
    Messages:
    2,334
    Location:
    City, Canberra, Australia
  10. PersianImmortal

    PersianImmortal Member

    Joined:
    Jun 27, 2001
    Messages:
    9,054
    Location:
    Canberra
    That is bizarre. Why would Microsoft include drive encryption software in Windows which effectively passes the encryption task onto the drive itself with no real safety check?

    I use Bitlocker to Go on my Corsair USB flash drives, which I assume should be OK given the flash drives don't have their own encryption capability. It's no joke that I've reached the point where I really can't trust Microsoft to do anything right.
     
  11. elvis

    elvis Old school old fool

    Joined:
    Jun 27, 2001
    Messages:
    39,779
    Location:
    Brisbane
    Yeah, I was going to recommend Addonics next. Nice little bit of in-between hardware for certain use cases, but can be a little challenging for low end users if you need to share the storage.
     
  12. ex4n

    ex4n Member

    Joined:
    Oct 5, 2011
    Messages:
    2,187
    Location:
    Perth
  13. elvis

    elvis Old school old fool

    Joined:
    Jun 27, 2001
    Messages:
    39,779
    Location:
    Brisbane
    Well, when that was posted, there were two camps:

    Camp 1: This is unreasonable, and Microsoft shouldn't trust random Chinese hardware providers to make reliable encryption

    Camp 2: This is perfectly reasonable, and not Microsoft's fault because Bitlocker was invented in an era when encryption was slow, couldn't be done in software at decent speed, and can't be expected to improve the code over the last decade (since AES hardware offload appeared in Intel CPUs).

    I'm in camp 1, and it sounds like you are too. It also seems like security professionals agree. This is on Microsoft and their duty of care. I have no idea how anyone could be in camp 2, but they are. There was some back and forth in the enterprise rant thread, but I gave up because it makes no sense to me how anyone could defend this.
     
    PersianImmortal likes this.
  14. fad

    fad Member

    Joined:
    Jun 26, 2001
    Messages:
    2,334
    Location:
    City, Canberra, Australia
    I fixed it for you, the issue is a SED company issue, that report suggests to Veracrypt or Bitlocker software only encryption.

    Edit:

    I'm in camp 1 and 2. This is an Opal standard, and everyone should have created devices which were secure. I'm not sure this is Microsoft's fault for not checking every single SSD out there.

    However as has been shown in the past, making secure hardware devices is difficult. With the amount of effort required to secure against all the different types of attacks.

    BitLocker software was shown to be insecure if a machine was on, or left in standby. With the key in system memory. With SED encryption this is no longer the case, but that key with these products has not been secured. So what's the difference.
     
    Last edited: Nov 29, 2018
  15. elvis

    elvis Old school old fool

    Joined:
    Jun 27, 2001
    Messages:
    39,779
    Location:
    Brisbane
    As per the rant thread discussion, why does a full disk encryption system choose "dangerous but fast" as the default, and "potentially slower by more secure" as a manual option?

    Microsoft have let down their customers. In 2018, if a non-technical user clicks "encrypt" because they're worried about safety and security, they should get the more secure option by default. You shouldn't need to be a cryptographic researcher or IT professional any more to have faith that your operating system does what it should.

    Consider, for example, if file copies offered a faster copy option, but had a 50% chance of destroying your data. Is it reasonable to suggest that the end user should be trained up to dig inside complex options and choose a more reliable file copy method than the poor default? No. File copying is standard practice now, and doesn't require a computer science degree like it did in the 70s.

    Encryption is now at this level. People should be able to trust a vendor who offers a secure or encrypted feature that it has met with the full, professional testing and reliability that such a claim deserves. Especially from the world's largest desktop software manufacturer.

    There is no excuse for BitLocker to have failed here in the way it has. It's pure negligence.
     
    PersianImmortal likes this.
  16. PersianImmortal

    PersianImmortal Member

    Joined:
    Jun 27, 2001
    Messages:
    9,054
    Location:
    Canberra
    Absolutely. Microsoft has a duty of care to ensure that users know the limitations and vulnerabilities when using Bitlocker. It also seems like Microsoft needs to raise its standards in terms of what it considers appropriate for supported drives.

    I had a quick look through the Bitlocker documentation and they do seem to note it, but not prominently enough in my opinion:

    And their Encrypted Hard Drive documentation notes the limitations clearly, but does not explain the security implications:

     
  17. elvis

    elvis Old school old fool

    Joined:
    Jun 27, 2001
    Messages:
    39,779
    Location:
    Brisbane
    YubiKey can work as either a long password generator, or a 2FA system, depending on the model you buy.

    It's not an encryption device itself. Merely something that makes strong passwords and 2FA a bit easier. You can use YubiKey with certain encryption tools (as long as they either take input from the virtual HID on the YubiKey, or support the bluetooth/NFC/USB/smartcard/etc type options of these and similar devices like the ones Google are selling). But it won't do the encryption itself.
     
    Last edited: Nov 29, 2018
    ex4n likes this.
  18. chip

    chip Member

    Joined:
    Dec 24, 2001
    Messages:
    3,799
    Location:
    Pooraka Maccas drivethrough
    Problem is, it's not just cheap/shitty hardware that we can't rely on. It's everything.

    Every single class of hardware in the system, from the UEFI to the networking chips to the wireless radios to the TPM to the mass storage to the CPU itself (including AES-NI and other SIMD extensions), from all the major manufacturers, has been shown over the last few years to be absolutely riddled with both design and implementation security flaws.

    Security is a garbage fire, and all signs point to it getting worse, not better.
     
    elvis likes this.
  19. elvis

    elvis Old school old fool

    Joined:
    Jun 27, 2001
    Messages:
    39,779
    Location:
    Brisbane
    I agree, but (a) it's difficult, and (b) there are some things we can do to mitigate risk, like not offload crypto into hard disk firmware when the OS manufacturer has better qualified, better paid and more invested people on staff to do the work in a more consistent manner.

    It's not about choosing the best. It's about choosing the least bad.
     
  20. DarkYendor

    DarkYendor Member

    Joined:
    Feb 25, 2008
    Messages:
    3,203
    Location:
    Perth
    If the OS is doing the encryption, the plain-text keys must be in RAM all the time. Even if you protect it, one RAM exploit (chrome plug-ins anyone) and now the malicious actor has your keys. Can't do that if the full keys never hit your RAM.

    Also, if the HDD has dedicated HW for AES, it's going to remove the performance hit compared to using your CPU for the heavy lifting. Same reason you use a proper RAID card for performance, rather than a soft-raid where the XORing is left to the CPU.
     

Share This Page

Advertisement: