Secure Documents - Revision history

Jeschke at 12:51, 20 April 2005

2005-04-20T12:51:25Z

@@ Line 116: / Line 116: @@
 In addition GPG supports symmetric cryptography with the switch ''-c''.
 See ''man gpg'' for further information.
 ==Encrypted File Systems and related Stuff==
 * Cryptoloop
 * loop-AES

Jeschke: some GPG examples

2005-04-14T09:26:22Z

some GPG examples

@@ Line 1: / Line 1: @@
 =Secure Electronic Documents with PDF=
@@ Line 64: / Line 57: @@
 Default the [[ElGamal]]/[[DSA]] encryption will be used.
 A nice feature is the possibility to save public keys on so called "key servers".
 ==Encrypted File Systems and related Stuff==

141.20.8.17: /* Problems */

2005-02-28T08:27:56Z

Problems

← Older revision		Revision as of 08:27, 28 February 2005
Line 100:		Line 100:
	* packed and system-files can be not encrypted		* packed and system-files can be not encrypted
	* with pysical access and a bootdisk its possible to get access to files on a Win2k System		* with pysical access and a bootdisk its possible to get access to files on a Win2k System
	* EFS is not a 100%security ,it makes it more difficult to get access but not impossible(so don't save files on the harddisk if it is not ~~neccessary~~)		* EFS is not a 100%security ,it makes it more difficult to get access but not impossible(so don't save files on the harddisk if it is not necessary)

	=Problems=		=Problems=

141.20.8.17: /* Problems */

2005-02-28T08:26:50Z

Problems

← Older revision		Revision as of 08:26, 28 February 2005
Line 100:		Line 100:
	* packed and system-files can be not encrypted		* packed and system-files can be not encrypted
	* with pysical access and a bootdisk its possible to get access to files on a Win2k System		* with pysical access and a bootdisk its possible to get access to files on a Win2k System
	* EFS is not a 100%security ~~so its~~ makes it more difficult to get access but not impossible(so don't save files on the harddisk if it is not neccessary)		* EFS is not a 100%security ,it makes it more difficult to get access but not impossible(so don't save files on the harddisk if it is not neccessary)

	=Problems=		=Problems=

141.20.8.17: /* Problems */

2005-02-28T08:25:56Z

Problems

← Older revision		Revision as of 08:25, 28 February 2005
Line 99:		Line 99:
	* EFS provides only non-encrypted transfer over network		* EFS provides only non-encrypted transfer over network
	* packed and system-files can be not encrypted		* packed and system-files can be not encrypted
			* with pysical access and a bootdisk its possible to get access to files on a Win2k System
			* EFS is not a 100%security so its makes it more difficult to get access but not impossible(so don't save files on the harddisk if it is not neccessary)

	=Problems=		=Problems=

Henryk: Recovery agents also available on local computer

2005-02-27T08:11:27Z

Recovery agents also available on local computer

← Older revision		Revision as of 08:11, 27 February 2005
Line 88:		Line 88:
	==Security==		==Security==

	The only way (at the moment) to hack the symmetric or asymmetric key is brute-force and that takes a long time. So the best solution is to save the private key on a smartcard, but if you will lose the key you will have no longer access to the files. EFS provides the service of an Recovery Agent ~~(not on standalone machines)~~ and he(normaly the administrator of the domain) will get automaticly access to all encrypted files of all user on his domain.		The only way (at the moment) to hack the symmetric or asymmetric key is brute-force and that takes a long time. So the best solution is to save the private key on a smartcard, but if you will lose the key you will have no longer access to the files. EFS provides the service of an Recovery Agent and he(normaly the administrator of the domain) will get automaticly access to all encrypted files of all user on his domain.
	=> ATTENTION! Access to the recovery agent means access to all files!!!		=> ATTENTION! Access to the recovery agent means access to all files!!!

			Recovery agents can be designated either for the [http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/encrypt_to_add_recovery_agent.mspx local computer] or the [http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/sag_SEprocsAddRecAgent.asp complete domain].

	==Problems==		==Problems==

141.20.8.17: /* Literature */

2005-02-24T13:03:27Z

Literature

← Older revision		Revision as of 13:03, 24 February 2005
Line 108:		Line 108:
	=Literature=		=Literature=
	* Die PostScript- & PDF-Bibel, Thomas Merz, Olaf Drümmer, Dpunkt Verlag, ISBN: 3935320019		* Die PostScript- & PDF-Bibel, Thomas Merz, Olaf Drümmer, Dpunkt Verlag, ISBN: 3935320019
			* Windows Server 2003, Eric Tierling, Addison-Wesley, ISBN: 3827320763
			* google.de ;)

141.20.8.17: /* Encrypted FileSystem (EFS) with Windows 2000/XP/2003 */

2005-02-24T12:58:54Z

Encrypted FileSystem (EFS) with Windows 2000/XP/2003

← Older revision		Revision as of 12:58, 24 February 2005
Line 93:		Line 93:
	==Problems==		==Problems==

	- Saving an encrypted file on a non NTFS-Partition means lost of encryption.		* Saving an encrypted file on a non NTFS-Partition means lost of encryption.
	- tmp-files are normaly not encrypted => best solution is to encrypt a folder so all files in the folder are encrypted (f.e. word always creates the tmp-files in the same folder)		* tmp-files are normaly not encrypted => best solution is to encrypt a folder so all files in the folder are encrypted (f.e. word always creates the tmp-files in the same folder)
	- EFS provides only non-encrypted transfer over network		* EFS provides only non-encrypted transfer over network
	- packed and system-files can be not encrypted		* packed and system-files can be not encrypted

	=Problems=		=Problems=

141.20.8.17: /* Encrypted FileSystem (EFS) with Windows 2000/XP/2003 */

2005-02-24T12:57:46Z

Encrypted FileSystem (EFS) with Windows 2000/XP/2003

← Older revision		Revision as of 12:57, 24 February 2005
Line 90:		Line 90:
	The only way (at the moment) to hack the symmetric or asymmetric key is brute-force and that takes a long time. So the best solution is to save the private key on a smartcard, but if you will lose the key you will have no longer access to the files. EFS provides the service of an Recovery Agent (not on standalone machines) and he(normaly the administrator of the domain) will get automaticly access to all encrypted files of all user on his domain.		The only way (at the moment) to hack the symmetric or asymmetric key is brute-force and that takes a long time. So the best solution is to save the private key on a smartcard, but if you will lose the key you will have no longer access to the files. EFS provides the service of an Recovery Agent (not on standalone machines) and he(normaly the administrator of the domain) will get automaticly access to all encrypted files of all user on his domain.
	=> ATTENTION! Access to the recovery agent means access to all files!!!		=> ATTENTION! Access to the recovery agent means access to all files!!!

			==Problems==

			- Saving an encrypted file on a non NTFS-Partition means lost of encryption.
			- tmp-files are normaly not encrypted => best solution is to encrypt a folder so all files in the folder are encrypted (f.e. word always creates the tmp-files in the same folder)
			- EFS provides only non-encrypted transfer over network
			- packed and system-files can be not encrypted

	=Problems=		=Problems=

141.20.8.17: /* Encrypted FileSystem (EFS) with Windows 2000/XP/2003 */

2005-02-24T12:43:57Z

Encrypted FileSystem (EFS) with Windows 2000/XP/2003

← Older revision		Revision as of 12:43, 24 February 2005
Line 73:		Line 73:
	=Encrypted FileSystem (EFS) with Windows 2000/XP/2003=		=Encrypted FileSystem (EFS) with Windows 2000/XP/2003=

			==What is EFS?==

			EFS is part of the OS and makes encryption of files and folders on a NTFS-partition possible.
			It is very easy for a user to encrypt or decrypt a file.

			==Why EFS?==

			With EFS you have an file access authorization. F.e. if an other user have physical access to your machine too maybe he has access to your private files. so you can encrypt the files with EFS and only you, with your private key, can open the file. EFS works transparently in the background.

			==Encryption==

			EFS use a combination of symmetric and asymmetric encryption. At first the file will be encrypted via DESX(128bit) or 3DES(168bit), the symmetric encryption, and then the key will be assymmetric encrypted via RSA(1024bit). The private key is saved on the machine encrypted via the user master key.

			==Security==

			The only way (at the moment) to hack the symmetric or asymmetric key is brute-force and that takes a long time. So the best solution is to save the private key on a smartcard, but if you will lose the key you will have no longer access to the files. EFS provides the service of an Recovery Agent (not on standalone machines) and he(normaly the administrator of the domain) will get automaticly access to all encrypted files of all user on his domain.
			=> ATTENTION! Access to the recovery agent means access to all files!!!

	=Problems=		=Problems=