This chapter is from the book
This chapter is from the book
This chapter is from the book
Filesystem Encryption
Even when an attacker has complete access to your host, you can still use encryption to protect your most sensitive data. Properly implemented, encrypting files is a great way to keep private data from being read by the wrong people. Historically, however, encrypting data you use on a regular basis has been a difficult and awkward process. The tools available for most operating systems were very complex and required the user to have deep knowledge of cryptography and system administration.
Thankfully, modern operating systems have made huge advances in useable encryption. Microsoft Windows XP and Mac OS X both have the capability to encrypt user data in a manner that is secure and relatively transparent. This is a great leap forward as it allows for your data to be secure even in the event of theft. Previously this was only possible with very specialized software or with a great deal of effort.
At the heart of filesystem encryption in Mac OS X are two applications: DiskCopy and KeychainAccess. DiskCopy is used to create and copy disk images to drives. KeychainAccess is used to automatically handle passwords and passphrases for programs and web sites. KeychainAccess is discussed in detail in Chapter 5, "User Applications."
Primarily DiskCopy is used to burn CD-R and DVD-RAM discs. However, it can also create disk images that will exist on top of a normal hard disk filesystem. These disk images are convenient for storing personal data and moving it between machines. Images created by DiskCopy are also used for software distribution. Many popular freeware and shareware software packages ship as disk images that can be mounted on a machine, used to install the software, then discarded. The disk image, typically with a .dmg extension, is downloaded and saved to a local disk. When the image is activated, DiskCopy will verify the checksum of the image, and then mount the volume contained in the image on the desktop. You can then access the data in the volume like any disk. When you are done with the volume, it can be unmounted by ejecting it as if it were removable media.
DiskCopy also allows for these disk images to be encrypted using AES to protect the data inside. AES, the Advanced Encryption Standard, is a symmetric cryptographic mechanism endorsed by the United States government. AES has gone through detailed analysis and is generally considered secure. For most uses it is secure enough to be unbreakable.
Before you make your new volume, determine how large you need it to be. If you are going to be storing email or other small files only, a few megabytes should work fine. If you are going to be storing multimedia files and other types of large data, you may need to allocate several hundred megabytes. Be aware that when you make the disk image it uses all the space when it is created. It does not grow based on your needs up to a maximum nor can it be grown later if you fill it up. It should be big enough to hold the data you need but not so much to run yourself out of space.
To create an encrypted volume, launch DiskCopy from the Utilities folder. Create a new disk image by selecting File, New, Blank Image. A window pops up enabling you to configure properties for the new image (see Figure 3.9). The Save As field is the name of the file in which the image will be saved. The Volume Name is the name the volume will have once it is mounted. Choose the format required for your workstation. For a discussion of the differences between HFS+ and UFS and why you would choose one or the other, see Chapter 2, "Installation." Finally, set the required size, select AES encryption, and click Create.
)
Figure
3.9 Creating a blank image with DiskCopy.
DiskCopy will then create and format the image. It will then prompt you for a passphrase for the image. This password is what will protect your sensitive data, so be sure it is a strong password with a combination of letters, numbers, and special characters. If the Remember Password check box is checked, this passphrase will then be stored in your keychain so you do not have to type it in every time you need to mount the volume. After the passphrase is entered and verified, the volume will be mounted and you can begin using it.
After your next reboot, the volume will not be mounted automatically. To use the volume, double-click on the disk image. DiskCopy launches, accesses your keychain with your log-in credentials, and decrypts and mounts the volume. If you need to unmount the volume, simply drag it to the trash or type Command-E to (virtually) eject it.
Encrypted Files and Filesystems in Windows XP Versus OS X
Windows XP handles encrypted files and filesystems much differently than OS X. In OS X, files cannot be encrypted individually. Rather, you must go through the preceding process with DiskCopy and create a standalone volume. In Windows XP, you can encrypt a file, a directory, or an entire filesystem. This allows for much greater flexibility in only encrypting exactly what you need.
In Windows XP, if a file is moved from an encrypted directory to an unencrypted directory, the file retains its encrypted attribute. That ensures that you do not inadvertently remove protection from a sensitive file. Like OS X, the files are effectively "unlocked" using your log-in credentials when you authenticate to the operating system. However, there is no standalone keychain application that manages this access. Access is controlled by the core authentication mechanisms within Windows XP.