Benefits
Full disk encryption has several benefits compared to regular file or folder encryption, or encrypted vaults. The following are some benefits of full disk encryption:
Nearly everything including the swap space and the temporary files is encrypted. Encrypting these files is important, as they can reveal important confidential data. With a software implementation, the bootstrapping code cannot be encrypted however. (For example, Bitlocker leaves an unencrypted volume to boot from, while the volume containing the operating system is fully encrypted.)
With full disk encryption, the decision of which individual files to encrypt is not left up to users' discretion. This is important for situations in which users might not want or might forget to encrypt sensitive files.
Support for pre-boot authentication. [1]
Immediate data destruction, as simply destroying the cryptography keys renders the contained data useless. However, if security towards future attacks is a concern, purging or physical destruction is advised.
Full disk encryption vs. filesystem-level encryption
Full disk encryption does not replace file or directory encryption in all situations. Disk encryption is sometimes used in conjunction with filesystem-level encryption with the intention of providing a more secure implementation. Since disk encryption generally uses the same key for encrypting the whole volume, all data are decryptable when the system runs. However, some FDE solutions use multiple keys for encrypting different partitions. If an attacker gains access to the computer at run-time, he has access to all files. Conventional file and folder encryption instead allows different keys for different portions of the disk. Thus an attacker cannot extract information from still-encrypted files and folders.
Unlike full disk encryption, filesystem-level encryption does not typically encrypt filesystem metadata, such as the directory structure, file names, modification timestamps or sizes.
Full disk encryption and Trusted Platform Module
Trusted Platform Module (TPM) is a secure cryptoprocessor embedded in the motherboard that can be used to authenticate a hardware device. Since each TPM chip is unique to a particular device, it is capable of performing platform authentication. It can be used to verify that the system seeking the access is the expected system.
A limited number of full disk encryption solutions have support for TPM. These implementations can wrap the decryption key using the TPM, thus tying the hard disk drive (HDD) to a particular device. If the HDD is removed from that particular device and placed in another, the decryption process will fail. Recovery is possible with the decryption password or token.
Although this has the advantage that the disk cannot be removed from the device, it might create a single point of failure in the encryption. For example, if something happens to the TPM or the motherboard, you might not be able to access your data simply by connecting the hard drive to another computer, unless you also have a separate recovery key.
Implementations
Main article: Comparison of disk encryption software
There are multiple tools available in the market that allow for full disk encryption. However, they vary greatly in features and security. They are divided into two main categories: hardware-based and software-based. The Hardware-based Full Disk Encryption solutions are considerably faster than the software-based solutions, and usually produce no overhead for the CPU or the hard disk drive. Hardware-based Full Disk Encryption, without some form of user authentication, provides absolutely no protection of data. Currently, there are two solutions providing Pre-Boot Authentication for Hardware-based Full Disk Encryption and a BIOS or ATA password can provide basic access control.
A limited number of full disk encryption solutions also support TPM to tie encrypted data to a particular platform.
Microsoft Windows Vista and Windows Server 2008 include a form of full disk encryption by the name of BitLocker Drive Encryption that can utilize TPM
Thursday, August 6, 2009
Subscribe to:
Post Comments (Atom)




kf;jsfs dfsa df;ks'p fa'pdifsdfsdf
ReplyDeletefg;dsfjsd f jsdf sldf dflsd fjdslf djfds fjsd fjsdfs ;sjfdlsajdf;lja;dlf ;lsdjf;ljsa;ldf;lasjfljasdl;fjlsd fjd;lfsda;ljflas dfljs;ladflajsdfljalfj lafj;lsdjflsjdf safjdf sdfj flsdlfjsd flksjf;l fj flsfl dfljlfj jfldflfdjlafjfl;afdffjfld f fjldfjd lsdkjf djf fjf fdj;df jdf
ReplyDeletejljh df j;ldf j jdlsf ;o d;f udoifp sapdifp udf df ufdsuaf;weuwe peuf;s;ff fsdfsapfipf9 f;o9ff'p;fposd
ReplyDeletekiul;idsudids;dpsidi dsiidppd'isd dpspds didsdsi dsdas pdispsdipdispidpids'pdpidpidpidp dpidsp sdpipd isdp'di'pidsp'ip'ds daidaipiadip addapidpidp pdsi
ReplyDeletek;ipfipdfjdsfuisdfs fisidfisdf psdfpsdpifpsdif'pisdpf pidfpidpfi
ReplyDelete,kjgfg; gjsfg sdfgpifpgfdpigfdi gidfgpdfig igpdfipgidfgidf pfds
ReplyDeletedf dff sdauf idsjfljsdaf sdjflsjdfl asldjf
ReplyDeletenflsaddf jsfljsadf jlsajfl saf sdfjlsaf ppf fpafppfo pofpifp pofpfpifpi [weipeiwer weifkfdk dvsdfljfsjfd deepak
ReplyDeletewww.uritpitstop.com
ReplyDeletekiul;idsudids;dpsidi dsiidppd'isd dpspds didsdsi dsdas pdispsdipdispidpids'pdpidpidpidp dpidsp sdpipd isdp'di'pidsp'ip'ds daidaipiadip addapidpidp pdsi