Drivecrypt PLUS PACK
Legolas
Lot's of changes on www.drivecrypt.com !! Nicer & cleaner webdesign :)
Most interesting is the new DriveCrypt Plus Pack, which finally allows Pre-
Boot authentication.
Until April 13th, the price is $49. That makes $10 more than I paid for DC.
Shaun, I was wondering if there was a time-limited, reduced upgrade price
for existing DC users.
Have a nice day,
Legolas
Sam Simpson
Before adoption some questions need to be asked:
1) How closely tied to the original DC source code is this product?
2) "256-bit military strength encryption using proven cryptographic
algorithms." - what are the algorithms? AES is obvious, but....
3) "Powerful Pre-Boot Authentication" - details of how this works?
4) "Completely transparent to the user" - apart from the boot
authentication I guess ;) Does this technology work with laptops that
hibernate etc?
5) "Sector level protection" - what does that mean?
6) "Anti dictionary and brute-force attack mechanisms, due to the nature
of DCPP it is the most difficult system to attack compared to anything
else available". Tut. Does this mean that is uses a salt? What else?
That's a grand claim and needs some technical backing.
7) Who was the lead developer?
Still, looks like a very interesting and welcome development.
Also, it appears that SecureStar offering penetration testing:
http://www.securstar.de/penetration.html - though they leave out more
general testing methods than they include.
The about page at http://www.securstar.de/about.html also got a smile or
two - e.g. the Our Team section where "Dr. Manfred Hafner" is introduced
as a "well regarded consultants and security technologists". Eh? I've
read every crypto book published in the last 10 years and 90% of
conference papers and have yet to hear of this guy...Let's hope it's not
this Dr Manfred Hafner
http://translate.google.com/translate?hl=en&sl=de&u=http://www.altavita.ch/av_vortrag02/av_autonomes_alter020202.htm&prev=/search%3Fq%3D%2522Dr%2BManfred%2BHafner%2522%26hl%3Den
(who appears to have a medical doctorate or MD).
The paragraph at the bottom of Our Team (quoted with under Fair Use
terms) sure deserves some critical appraisal:
"With impressive credentials and a great depth and variety of
experience, our founders, technology and management teams represent a
virtual Who's Who of the information security industry.
You could not have a better group in your corner protecting your systems
and data."
*sigh*
Sam
Regards,
Sam
--
Regards,
Shaun Hollingworth
wrote:
>Interesting, I knew nothing about the new announcement or new product.
>Before adoption some questions need to be asked:
>
>1) How closely tied to the original DC source code is this product?
It isn't... It has been developed by Paul Le Roux, rather than
myself...
>2) "256-bit military strength encryption using proven cryptographic
>algorithms." - what are the algorithms? AES is obvious,
'Tis AES
One can't have too many algorithms, when decrypting at boot level....
>but....
>3) "Powerful Pre-Boot Authentication" - details of how this works?
I'll post more when I've had a chance to exmaine in detail the program
for myself....
>4) "Completely transparent to the user" - apart from the boot
>authentication I guess ;) Does this technology work with laptops that
>hibernate etc?
Yes. The whole of the designated hard drive, including the OS, is
encrypted....
>5) "Sector level protection" - what does that mean?
It means that the encryption is lower than the filing system level...
>6) "Anti dictionary and brute-force attack mechanisms, due to the nature
>of DCPP it is the most difficult system to attack compared to anything
>else available". Tut. Does this mean that is uses a salt?
It is likely to, as Paul is rather fond of them...
>What else?
On a practical note, the encryption initially goes in at the BIOS
level, so it is very difficult to write software to try and read the
disk, unless the drive is removed and installed in another computer,
as a slave, or second drive... Certainly there is no operating system
to hand on which cracking software can be installed, for to boot up
the OS, you have to know the pass phrases!
> That's a grand claim and needs some technical backing.
>7) Who was the lead developer?
Not me. See above..
>
>
>Still, looks like a very interesting and welcome development.
>
>
>Also, it appears that SecureStar offering penetration testing:
>http://www.securstar.de/penetration.html - though they leave out more
>general testing methods than they include.
>
>The about page at http://www.securstar.de/about.html also got a smile or
>two - e.g. the Our Team section where "Dr. Manfred Hafner" is introduced
>as a "well regarded consultants and security technologists". Eh? I've
>read every crypto book published in the last 10 years and 90% of
>conference papers and have yet to hear of this guy...Let's hope it's not
>this Dr Manfred Hafner
>http://translate.google.com/translate?hl=en&sl=de&u=http://www.altavita.ch/av_vortrag02/av_autonomes_alter020202.htm&prev=/search%3Fq%3D%2522Dr%2BManfred%2BHafner%2522%26hl%3Den
>(who appears to have a medical doctorate or MD).
One of the finest books on Sinclair Spectrum programming (which I
still have somewhere) was called " The Complete Spectrum Rom
Dissassembly" by Dr Ian Logan, and Dr Frank O'Hara.... and it was a
complete documentation of the nuances of the Specrum OS, The Basic
Interpreter, and all the bugs..... I was sure those guys had Phd's in
computer science.... In fact they were a couple of GPs, (MDs for you
in the USA) as I learned when I met them personally...... The upshot
is that most MDs are probably at least as intelligent as is the
average computer scientist, and it wouldn't surprise me, if an MD
could find encryption interesting to the degree that he or she, became
some kind of authority on the subject.....
Regards,
Shaun.
nemo outis
Hooray! Finally, it's here: whole disk encryption for the masses.
Yes, I have a thousand questions and some reservations and worries, but, hey,
it's a great start and today is a great day. My $50 will be on its way
forthwith - fifthwith at the latest :-)
Regards,
PS Simon Hunt, time to get Safeboot Solo onto the market. Let's have a
little healthy competition.
Justme
>Most interesting is the new DriveCrypt Plus Pack, which finally allows Pre-
>Boot authentication.
>
>Until April 13th, the price is $49. That makes $10 more than I paid for DC.
>Shaun, I was wondering if there was a time-limited, reduced upgrade price
>for existing DC users.
From the website:
Thank you for your interest about DriveCrypt PlusPack (DCPP)
DCPP will be released to the plublic only around April 15th,
and will be sold at the price of US$ 149.95
To everybody willing to PRE-ORDER the DCPP BEFORE April 13th,
SecurStar GmbH will offer an absolute special price of US$ 49.95
----------------
I have a bit of a problem with the special pre-order price that's only
valid until 2 days BEFORE the product is released. Doesn't give any
opportunity to find out what other users are saying about the product,
and find out how it performs under various conditions and how
transparent it REALLY is.
$150 is totally out of the question.
If they offer the $49.95 price for a few weeks AFTER the product is
released and after I've seen posts from people about how it works,
then I'll probably order it.
No idea if the Securstar people read this group, but I hope they're
receptive.
fjwi...@hotmail.com
>>authentication I guess ;) Does this technology work with laptops that
>>hibernate etc?
>
>Yes. The whole of the designated hard drive, including the OS, is
>encrypted....
The operating system is encrypted? I didn't think that was really
possible.
I talked to a compa;ny that got a "rave review from PC World a few
years ago about a disk encryption method they were marketing, they
also said that the operating system would be encrypted, I don't
believe that it went much of anywhere.At a "non-commercial" discounted
rate of$, it's no wonder.
Chris Epler
updated yet, but I don't see any updates to the site...?
On Wed, 03 Apr 2002 21:18:58 GMT, Legolas <leg...@legoli.com> wrote:
Sam Simpson
fjwi...@hotmail.com wrote:
>>>4) "Completely transparent to the user" - apart from the boot
>>>authentication I guess ;) Does this technology work with laptops that
>>>hibernate etc?
>>
>>Yes. The whole of the designated hard drive, including the OS, is
>>encrypted....
>
>
> The operating system is encrypted? I didn't think that was really
> possible.
Why? Give me a detailed explanation why it's not possible. It's
already been done by other companies
> I talked to a compa;ny that got a "rave review from PC World a few
> years ago about a disk encryption method they were marketing, they
> also said that the operating system would be encrypted, I don't
> believe that it went much of anywhere.At a "non-commercial" discounted
> rate of$, it's no wonder.
Maybe they didn't have good programmers?
Sam Simpson
Shaun Hollingworth wrote:
> On Wed, 03 Apr 2002 23:54:58 +0100, Sam Simpson <s...@samsimpson.com>
> wrote:
>
>
>>Interesting, I knew nothing about the new announcement or new product.
>>Before adoption some questions need to be asked:
>>
>>1) How closely tied to the original DC source code is this product?
>
>
> It isn't... It has been developed by Paul Le Roux, rather than
> myself...
Do you know if it is an e4m derivitive or a new product?
>>2) "256-bit military strength encryption using proven cryptographic
>>algorithms." - what are the algorithms? AES is obvious,
>
>
> 'Tis AES
> One can't have too many algorithms, when decrypting at boot level....
I assume SHA is used for passphrase hashing or something?
>>but....
>>3) "Powerful Pre-Boot Authentication" - details of how this works?
>
>
> I'll post more when I've had a chance to exmaine in detail the program
> for myself....
That would be great, cheers.
>>4) "Completely transparent to the user" - apart from the boot
>>authentication I guess ;) Does this technology work with laptops that
>>hibernate etc?
>
>
> Yes. The whole of the designated hard drive, including the OS, is
> encrypted....
>
>
>
>>5) "Sector level protection" - what does that mean?
>
>
> It means that the encryption is lower than the filing system level...
I guess it works by hooking into BIOS level HD calls then?
Of course, I in no way meant that CompSci students are in anyway better
at coding than any other vaguely bright person. It just seems that
S-Star are "overplaying" some of the descriptions of the staff. I'd
like to know the details of Dr Hafners published work in the security
field - or are S-Star just using his PhD / MD because it looks flash?
Cheers,
Sam
Terry Johnson
than the OS. It loads before the OS loads and runs the decryption routine.
Then the machine boots as normal.
Examples of other software that perform similarly are bootloaders. In the
past, Maxtor used a special piece of software that allowed older machines to
use larger hard drives. This software was installed and even if the disk was
formatted, the software was still there. It would take a low level format to
be rid of the software.
Whole disk encryption software works in a similar manner. It is set to run
before the OS runs, it decrypts what is necessary to run the machine and
then passes over control to the OS.
Does this help clear it up for you?
Jeff Biggerstaff
fjwi...@hotmail.com
wrote:
>
>
>fjwi...@hotmail.com wrote:
>>>>4) "Completely transparent to the user" - apart from the boot
>>>>authentication I guess ;) Does this technology work with laptops that
>>>>hibernate etc?
>>>
>>>Yes. The whole of the designated hard drive, including the OS, is
>>>encrypted....
>>
>>
>> The operating system is encrypted? I didn't think that was really
>> possible.
>
>Why? Give me a detailed explanation why it's not possible. It's
>already been done by other companies
>
Sam, I am John Doe with this stuff, by no means an expert. When I
think of "operating system", I think of something no smaller than
Windows 3.1, or dos 5.0. which I believe was on 2 floppies.
It is natural to think the operating system is necessary for the
computer to boot up, though apparently it is not. I just thought that
any kind of program that was capable of it would have to be contained
on more than a single floppy disk.
If this is true, then I am interested. I keep my financial information
on my computer, and the location I live at is, I am afraid, burglar
friendly, a little remote. The only sure-fire way that I know of
protecting my financial data to MY satisfaction(call me paranoid) is
by creating large scramdisk containers, which I have already done, or
encrypting the entire hard drive.
Flare
Let's hope full source code will be released so
that I will be able to upgrade to XP :-)
PS - and let's also hope that those US guys've
done it well (AES ;)
aaaa
create virtual container(s) afterward?
Wouldn't the pre-boot encryption be as safe as the container version?
Is it totally secure?
Thanks
Sam Simpson
> fjwi...@hotmail.com wrote:
>
>
>>The operating system is encrypted? I didn't think that was really
>>possible.
>
>
> Sam Simpson <s...@samsimpson.com> wrote:
>
>>Why? Give me a detailed explanation why it's not possible. It's
>>already been done by other companies
>
>
> catch-22 situation. You need the operating system in place in order to load
> and run the encryption software and get the password from the user, but you
> need the encryption software to already be loaded and running in order to
> load and run the encrypted operating system. I don't see any way to do it
> without using a special hard drive interface card with its own processor to
> do the encrypting and decrypting work.
Not at all. Rather than simply booting the OS, why not use a different
boot loader that accepts the users passphrase, attaches an interupt
handler that captures HD read/writes that automatically decrypts data.
It's not rocket science (though it would be hard to implement!)
Sam Simpson
loading a BIOS interupt redirector to capture HD calls and on the fly
decrypt/encrypt data. This program could then call the normal OS boot
code and load the operating as normal.
Sam Simpson
in MyDocs or whatever and it'd also be encrypted automatically.
Sam Simpson
security problems with 95/98/ME/XP/W2k/NTv4 etc. Windows really needs
to be *dumped* for a better OS in reality!
Pogo P. Possum
<nob...@cotsebay.cotse.net> wrote:
>Hi i have a dump question:
>
>Is the Standart Drivecrypt software included in Drivecrypt Plus Pack or is it just a "add-on". If it is not included is there any need for the standard software if you have Drive Crypt Plus Pack??
>
>thanks
>
>Sh
>
>
In a private email to me, Shaun addressed this concern, because I had
it too. He essentially told me that unlke DriveCrypt, all partitions
are visible, once the system is up and running, and so you will also
need to have normal driveCrypt containers or partitions, if you wish
to turn things on and off......IE The two programs are designed to be
complimentary...
nemo outis
Much as I am delighted with the prospect of DriveCrypt Plus Pack (assuming it
works as described, has no back doors, etc.) I intend to supplement it with
another "container/partition encrypter" for additional security for sensitive
files.
Despite the merits of "regular" Drivecrypt I will use a product from another
manufacturer to mitigate risks if one manufacturer's products are defective or
compromised. Bestcrypt or Vdisk seem good candidates to use for containers
nested within (or alongside) a HD/OS more broadly protected by Drivecrypt Plus
Pack. (A future alternative could be, for instance, Safeboot Solo with regular
Drivecrypt containers inside - or on separate partitions.)
The HD/OS protector provides general protection (against OS info leaks,
terrain-denial for software keyloggers, etc.) while the container
file/partition holds sensitive data. If nesting doesn't have
performance/compatibility problems, then that is probably superior to using
the two protections separately (e.g., on different partitions).
Think of it as a castle with an outer wall and then the keep.
Regards,
Pogo P. Possum
wrote:
Yeah -- "If nesting doesn't have performance/compatibility problems."
I burn a lot of CD-Rs. I find that I can burn from a
Blowfish-protected container once opened, but I wonder about the
performance penalty from "nested" containers, especially if one is not
as fast as Blowfish. -- Am I going to start making coasters if I try
burning CD-Rs in such a case, I wonder? Does anyone have any thoughts
on this?
Regards back to ya!
fjwi...@hotmail.com
e-mail today.
>Hi,
>
>
>Thank you for your email.
>DCPP is a separate program then DriveCrypt.
>As a matter of fact it does not work with volumes but it encrypt entire hard
>disks.
>
>
>It is possible to run both programs simultaneusly ( DCPP on top of
>DriveCrypt ),
>however DriveCrypt is not included in the DCPP promotion
>
>
>If you buy DCPP now, you are automatically entitled to get the new DCPP
>version for Win 98 free of charge,
>however it may take around 2-3 months until that version will be ready.
>
>
>Best regards
>
>
>W. Hafner
>
Thinking about trying it out myself.
Hope this helps.
On Thu, 4 Apr 2002 02:50:05 +0200 (CEST), Nomen Nescio
<nob...@dizum.com> wrote:
>This looks really good. The only other game in town, that I know of, that
>offers full HD encryption is safeboot and as far as I know they only offer
>it to corporate users. This also seeems to put my fears of winding up with
>XP someday, and wondering whether to get BC or DC, to rest. If I preorder
>at the special price offered of $49, will I be able to upgrade (or downgrade,
>depending on how you look at it) to a 98 compatible version when it becomes
>available? The site says that it's not *yet* available for 98, is such a version
>really being worked on? I don't know when or if I'll be forced to move to
>XP, I'm just anticipating it if I ever have to get a new computer.
Flare
> Of course, having boot-level security doesn't solve the million other
> security problems with 95/98/ME/XP/W2k/NTv4 etc. Windows really needs
> to be *dumped* for a better OS in reality!
Yes, but in 2002 I don't see it realistic to expect all people using
personal computers could switch to Linux or another system. Windows are
so wide-spread now that we simply have to use them and also find
ways to improve their security and privacy instead of just dumping
them. BTW, tell me if you know a 100% secure OS.
(I'd say the most secure is the most encrypted one ;-)
Regards
David
Flare
> is probably superior to using the two protections separately (e.g.,
> on different partitions).
IMHO this would be a CPU load disaster. The system could even appear
to freeze. It is difficult to tell for how long periods of time. It
could freeze for a second or two every five seconds (depends on how
the driver is programmed.) It is difficult to tell, we'll have to
wait and see. Anyway, you should expect at least 50% performance
degradation.
You'd better put your "sensitive" BC/SD/DC containers outside
the DCPP partition. There are more reasons to place your OS on a
seperate partition or even a separate drive. I've always done it
so and never regreted.
Now, I hope that it will be possible to boot multiple operating
systems with DCPP. For example, you may want to have one OS for
internet surfing and another one as your main system (secured
by the absence of any net connection and probably entirely
encrypted.) You may also need Linux instead of MSWindows
sometimes.
Regards
David
Paul Le Roux
>
>Interesting, I knew nothing about the new announcement or new product.
>Before adoption some questions need to be asked:
>
>1) How closely tied to the original DC source code is this product?
the 2 programs share only small amounts fo code, this is due to the
fact that they work completely differently; DC pretends to be a block
driver, DCPP is basically a fancy filter driver, DCPP uses some code
from DC for the redscreen mode, that's about it.
>2) "256-bit military strength encryption using proven cryptographic
>algorithms." - what are the algorithms? AES is obvious, but....
it offers AES256 in CBC mode plus SHA1 is the crypto (SHA1 is iterated with
salt to expand the key out to 256 bits); why not SHA2, well it took
3 months for me to hand tune the SHA1 implementation in
386 assembler and get the size down to about 500 bytes, that's right the
code for a full SHA1 with padding the works is about 500 bytes, SHA2 would
be too big code size wise.
>3) "Powerful Pre-Boot Authentication" - details of how this works?
basically a small program is installed in the MBR of your harddisk which
loads before anything else, it presents a 800x600 VGA screen asking you to
enter the passphrases, (it has 2 lines not 4 like DC). once this is entered
the encryption is keyed with the SHA1 iteration from above, the proper
interrupts are hooked, at the machine continues to load the bits from the
O/S that's being started such as NTOSKRNL NTLDR etc
>4) "Completely transparent to the user" - apart from the boot
>authentication I guess ;) Does this technology work with laptops that
>hibernate etc?
yes and no, hidden hibernate partitions won't be encrypted, better to use
suspend if you can
>5) "Sector level protection" - what does that mean?
similar to DC with a different of producing the IV
>6) "Anti dictionary and brute-force attack mechanisms, due to the nature
>of DCPP it is the most difficult system to attack compared to anything
>else available". Tut. Does this mean that is uses a salt? What else?
it uses 64-bit salt plus iterates the SHA1 hash, to expand its output
but it is not using PKCS5, it is harder to brute force because accessing
the encrypted keys is much more difficult, also encrypted partitions are
not identified as they are in DC
> That's a grand claim and needs some technical backing.
>7) Who was the lead developer?
>
me
>
>Still, looks like a very interesting and welcome development.
>
>
>Also, it appears that SecureStar offering penetration testing:
>http://www.securstar.de/penetration.html - though they leave out more
>general testing methods than they include.
>
>The about page at http://www.securstar.de/about.html also got a smile or
>two - e.g. the Our Team section where "Dr. Manfred Hafner" is introduced
>as a "well regarded consultants and security technologists". Eh? I've
>read every crypto book published in the last 10 years and 90% of
>conference papers and have yet to hear of this guy...Let's hope it's not
>this Dr Manfred Hafner
>http://translate.google.com/translate?hl=en&sl=de&u=http://www.altavita.ch/av_
vortrag02/av_autonomes_alter020202.htm&prev=/search%3Fq%3D%252
Paul Le Roux
the BIOS which is nothing but another bit of coded loaded at start up,
you insert code in the chain anywhere and you can put in the encryption
of course there are many ways to do it...
In article <3cac935e...@news.earthlink.net>, fjwi...@hotmail.com says...
Paul Le Roux
yeah it's certainly not something you want to try without
first telling your wife you will be in your room for a year....
Paul Le Roux
other than this DCPP stops some thief from being able to do anything with
the data on your machine which for me is more important than the hardware
itself. it also stops your wife; your business partner; whatever;
from checking what
you've been looking at in IE, handles all the crap that windows splatters
all about the place like IE history, the cache, the hidden sync directory
on win2k etc.
In article <3CAD9FDB...@samsimpson.com>, s...@samsimpson.com says...
Paul Le Roux
In article <59sqaugjkk7sb9gdh...@4ax.com>, aaaa@ says...
>
>With pre-boot full disk encryption, why would it still be nessasary to
>create virtual container(s) afterward?
>
DCPP does not use any containers; you can use DC ontop of DCPP.
say for example you want C: encrypted, but you need to have access
to DC encrypted cd-roms you still need DC, or you may want to have your
really important stuff hidden in a WAV file using DC on top of your DCPP
encrypted computer...
Paul Le Roux
be. mainly thanks to MS Office and the continuing for the LINUX guys to right
there own drivers for each new bit of kit that hits the streets. it's a shame
but thanks to the fact that the US government does not have the balls to
do anything about them this problems not going away any time soon
In article <8d5e27d5.02040...@posting.google.com>,
flar...@yahoo.com says...
Paul Le Roux
>> If nesting doesn't have performance/compatibility problems, then that
>> is probably superior to using the two protections separately (e.g.,
>> on different partitions).
>
>IMHO this would be a CPU load disaster. The system could even appear
>to freeze.
says who?
It is difficult to tell for how long periods of time. It
>could freeze for a second or two every five seconds (depends on how
>the driver is programmed.) It is difficult to tell, we'll have to
>wait and see. Anyway, you should expect at least 50% performance
>degradation.
there's no reason not to have DC containers ontop of DCPP encrypted disks
the drivers are separate, both products use their own threads to access
the physical disks, each DCPP encrypted disk uses it's own thread, as
does each DC encrypted disk, you could also nest containers in each other
on top of each other then put the whole thing on a DCPP disk without problems,
obviously there will be a CPU hit but this is linear, also things like
pagefiles/web cache etc for example can be on DCPP disks without problems
Paul Le Roux
>
>Thanks for the reply Shaun, see further questions etc below:
>
>Shaun Hollingworth wrote:
>> On Wed, 03 Apr 2002 23:54:58 +0100, Sam Simpson <s...@samsimpson.com>
>> wrote:
>>
>>
>>>Interesting, I knew nothing about the new announcement or new product.
>>>Before adoption some questions need to be asked:
>>>
>>>1) How closely tied to the original DC source code is this product?
>>
>>
>> It isn't... It has been developed by Paul Le Roux, rather than
>> myself...
>
>Do you know if it is an e4m derivitive or a new product?
>
it's a fully new product, the nt driver does take some code from the
nt driver in E4M /SD/DC but it works very differently, shaun has not
yet seen all the code, much of it is hand coded in assembly, the GUI is
very different from everything that came before, it has fully a
integrated help system, 2 gui skins, support for BMP/WAV stego and
much more.
Paul Le Roux
is already done the low level stuff is the same as under NT/2K/XP because
it of course starts before they do... mainly it's the vxd and maybe
some tweaks to the gui that are needed under Win9x/ME
In article <58d9f83e6c047bf7...@dizum.com>, nob...@dizum.com
says...
Paul Le Roux
People may still want containers because the container allows deniability!
, if your presented with a DCPP password screen and you get the
password wrong your computer won't boot, obviously this means your using
crypto; if your forced to handover your key or you get 2 years or whatever
it is jail, you still need DC to hide the stuff your really don't want
people seeing once your box is booted....
IE: DCPP stops thieves, your wife, your children whatever from messing
with your stuff, DC+WAV based containers stops "whoever" when your forced
to handover your pass phrases because you have electrodes attached to your body
and bleeding from the head !! and there are plenty of places where this could
happen:--- if you happen to live in intolerant countries such as England or
Zimbabwe to name 2.
In article <3CAD99B4...@samsimpson.com>, s...@samsimpson.com says...
Pogo P. Possum
wrote:
Has anyone yet raised the issue (a hot one formerly with respect to
regular DC, as I recall) of closed versus open source code with Plus
Pack? Is this in fact even an issue? Does one need to be concerned
at all about a so-called "back door" that local LE or governments
might have pressured SecurStar into building into the PP code?
--Or am I merely betraying my "Idiot's Guide to Encyption" level of
understanding of this subject by raising this question?
A knowledgable--and hopefully not too condescending-- reply would be
appreciated.
Pogo
Chris Epler
got the name DriveCrypt in it, which is another product, then they add 'PLUS
PACK' which makes it sound VERY MUCH like an add-on to DriveCrypt. Not a very
smart choice of names.. If I were going to market this as an entirely
seperate product then I would NAME is entirely different.
Paul Le Roux
DCPP does not include DC as far as I know,but email securstar for the
answer to that one. DCPP offers complete OS encryption and supports
BMP and normal-Windows WAV stego for the DCPP KeyStores.
In article <2E2GWEFA373...@anonymous.poster>,
nob...@cotsebay.cotse.net says...
>
>Hi i have a dump question:
>
>Is the Standart Drivecrypt software included in Drivecrypt Plus Pack or is it
just a "add-on". If it is not included is there any need for t
>
>thanks
>
>Sh
>
>
>
Sam Simpson
single-handedly producing this solution.
We may agree on commercial aspects of SecureStar, but I certainly credit
you and Shaun with being the best programmers I know!
Sam Simpson
> yeah this is the problem LINUX is not yet masses ready and may never
> be. mainly thanks to MS Office and the continuing for the LINUX guys to right
> there own drivers for each new bit of kit that hits the streets.
This situation is changing now - you have to go out of your way to buy
hardware that isn't very well supported under Linux.
Linux runs on a billion more platforms than Windows and does so more
securely. I love Linux :)
> it's a shame
> but thanks to the fact that the US government does not have the balls to
> do anything about them this problems not going away any time soon
>
> In article <8d5e27d5.02040...@posting.google.com>,
> flar...@yahoo.com says...
>
>>Sam Simpson <s...@samsimpson.com> wrote in message
>
> news:<3CAD9FDB...@samsimpson.com>...
>
>>>Of course, having boot-level security doesn't solve the million other
>>>security problems with 95/98/ME/XP/W2k/NTv4 etc. Windows really needs
>>>to be *dumped* for a better OS in reality!
>>
>>Yes, but in 2002 I don't see it realistic to expect all people using
>>personal computers could switch to Linux or another system. Windows are
>>so wide-spread now that we simply have to use them and also find
>>ways to improve their security and privacy instead of just dumping
>>them. BTW, tell me if you know a 100% secure OS.
>>(I'd say the most secure is the most encrypted one ;-)
>>
>>Regards
>>David
>
>
Sam Simpson
I have no doubt it's going to be closed source with no release or peer
review.
> Is this in fact even an issue?
YES! Closed source crypto is, according to crypto experts, next to useless.
People should be actively discouraged from buying closed source crypto.
> Does one need to be concerned
> at all about a so-called "back door" that local LE or governments
> might have pressured SecurStar into building into the PP code?
Yep, as well as accidental bugs etc.
> --Or am I merely betraying my "Idiot's Guide to Encyption" level of
> understanding of this subject by raising this question?
Not at all - you are spot on. Wagner showed years ago that closed
source software has no benefits from a user perspective.
> A knowledgable--and hopefully not too condescending-- reply would be
> appreciated.
In alt.security.scramdisk? ;)
Sam Simpson
> well the main problem with windows is to get yourself a good firewall,
It's a good start, but then you get problems like Outlook content
autorunning, IE bugs left right and center, 350,000 machines hit by the
various IIS bugs *in one go* and the rest of the problems. Firewalls
don't protect against any of these things.
> other than this DCPP stops some thief from being able to do anything with
> the data on your machine which for me is more important than the hardware
> itself.
Of course.
> it also stops your wife; your business partner; whatever;
> from checking what
> you've been looking at in IE, handles all the crap that windows splatters
> all about the place like IE history, the cache, the hidden sync directory
> on win2k etc.
So true. Sigh, I looked at writing a "machine cleaner" that cleaned
down the registry, file system etc for this same purpose. I started
writing it and then quickly gave up when I found how inconsistent
Windows implementation was and how they (appear....) to go out of their
way in making the program so hard to write.
Now I have a 30 line Linux a shell script (that also calls some Perl
code etc) that does the job nicely.
Paul Le Roux
encrypted disks unlike SD/DC, the key for the boot disk is stored encrypted
in the mbr, keys for other disks are stored in keystores which can be
either straight files, or BMP or WAV files.
both normal file keystores and BMP/WAV keystores contain no identifying
information, and are encrypted with SHA1 based AES. also this means
many disks could be protected with one key if you wanted this, unlike
DC/SD.
In article <96089edd7d06c0fb...@dizum.com>, nob...@dizum.com
says...
>
><DCPP offers complete OS encryption and supports
><BMP and normal-Windows WAV stego for the DCPP KeyStores.
>
>What do you mean by this? Are you saying that you can create stego containers
>in bmp and wav files with DCPP? What are the "DCPP keystores"?
>
Sam Simpson
> Sam Simpson <s...@samsimpson.com> wrote in message news:<3CAD9FDB...@samsimpson.com>...
>
>>Of course, having boot-level security doesn't solve the million other
>>security problems with 95/98/ME/XP/W2k/NTv4 etc. Windows really needs
>>to be *dumped* for a better OS in reality!
>
>
> Yes, but in 2002 I don't see it realistic to expect all people using
> personal computers could switch to Linux or another system.
No: only people who care about security. If you aren't serious about
security (for example are on a corporate LAN away from the internet),
then you have fewer drivers to move.
> Windows are
> so wide-spread now that we simply have to use them
No, you don't. It's cheaper, more secure and more flexible to use
another OS (Linux, BSD, Sun etc etc - even the new OS from Apple is
better than MS).
> and also find
> ways to improve their security and privacy instead of just dumping
> them.
Only to find that Microsoft seem to go out of their way to make security
easy to obtain? No thanks.
> BTW, tell me if you know a 100% secure OS.
I've never made that assertion. I *can* however tell you about
operating systems that are designed by teams that take security
seriously, that adhere to common security standards and protocols and
are re-active to user comments.
BTW, my rationale for moving to Linux is here if you are interested:
http://www.samsimpson.com/linux.php see esp the security engineering
section.
> (I'd say the most secure is the most encrypted one ;-)
Not once you've booted it though! Then the OS you are using can be
exploited irrespective of the drive encryption....
Paul Le Roux
yes exactly you want something that works, solves your problem
that took a year to write, cost thousands of dollars to create in time,
salaries etc, but you want it free!
In article <3cb1acb5....@news.atl.bellsouth.net>, arnei...@GoFor21.com
says...
>
>Sam Simpson <s...@samsimpson.com> wrote:
>
>>I have no doubt it's going to be closed source with no release or peer
>>review.
>
>What a waste! It sounded so interesting - just the sort of thing I've been
>waiting for, but without open source code it's essentially worthless.
>
>http://www.counterpane.com/crypto-gram-9909.html#OpenSourceandSecurity
>--
>"Arneil Moky" is actually 53179...@GoFor21.com (53179 24680).
> 012345 6789 <-Use this key to decode my email address and name.
> Other messages to this domain will bounce.
>
Paul Le Roux
Sam please lets not turn this into a linux advocacy group, i'm asking
that we keep it on topic, but to answer you:
first off you have to go out of your way to buy hardware that supports linux
not the other way around, I give you examples such as Winmodems, PCI Modems
generally, Winprinters, video capture cards (and for that matter video editing
software), normally you can buy linux supported kit but typically you find
that a) it's 1 or 2 generations away from the current model, b) it ships
with a driver that won't support your new kernel.
i'm not trying to spread anti-Linux FUD that is MS's job, but lets not build
it up into something it's not.
the next major problem is the real rub: does anyone know who to make money
from linux applications? i don't think so; most people such as Redhat
etc make money from support, this to me is the real problem preventing
quality linux applications from appearing....
In article <3CB0A35E...@samsimpson.com>, s...@samsimpson.com says...
nemo outis
>Sam Simpson <s...@samsimpson.com> wrote:
>
>>I have no doubt it's going to be closed source with no release or peer
>>review.
>
>waiting for, but without open source code it's essentially worthless.
>
>http://www.counterpane.com/crypto-gram-9909.html#OpenSourceandSecurity
In every security situation the question of trust comes up. To be sure
open-source security programs are, in many ways, much preferable to
closed-source programs, since you don't have to extend much trust towards the
software manufacturer. However, even open-source is not a panacea.
As one (surprisingly, NOT hypothetical) example, even with open-source code
you would have to be sure your compiler doesn't introduce a back door. Or do
you want to examine the compiler's source code, and so forth?
Even if, say, Bruce Schneier reviewed and OKed the code, you would have to
have some trust in his opinion. Hell, even if *I myself* reviewed the source
code, I would extend little "trust" to my opinion because of my very limited
competence in cryptography - I hope I don't also have to worry about
deliberate self-deception :-)
Regards,
PS If you're truly paranoid, buy a copy of DCPP, reverse engineer Securstar's
code, and then recode your own version.