"Encrypting a drive offers no security when someone has physical access to the machine. Why? Because the encryption key itself cannot be encrypted, it has to be on the disk some..."

Not quite true-- most key-based encryption systems DO encrypt the keys locally, and use a (usually smaller) password for the encryption of the private key stored on the drive.
The result is that even with physical access to the machine SOME SECURITY is present, although less than otherwise. This is because it is easier to break the smaller password than the full key. Some security is still there, but it will be MUCH easier to break (like using a small key in the first place)

Now if the system is to AUTOMATICALLY mount the drive unencrypted (ie without asking for a password first), THEN there really is NO SECURITY, as the key will HAVE TO BE UNENCRYPTED.

William

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/393/33361#33361