Английская Википедия:Comparison of disk encryption software
Материал из Онлайн справочника
This is a technical feature comparison of different disk encryption software.
Background information
Operating systems
Features
- Hidden containers: Whether hidden containers (an encrypted container (A) within another encrypted container (B) so the existence of container A can not be established)[60] can be created for deniable encryption. Note that some modes of operation like CBC with a plain IV can be more prone to watermarking attacks than others.
- Pre-boot authentication: Whether authentication can be required before booting the computer, thus allowing one to encrypt the boot disk.
- Single sign-on: Whether credentials provided during pre-boot authentication will automatically log the user into the host operating system, thus preventing password fatigue and reducing the need to remember multiple passwords.
- Custom authentication: Whether custom authentication mechanisms can be implemented with third-party applications.Шаблон:Clarify
- Multiple keys: Whether an encrypted volume can have more than one active key.
- Passphrase strengthening: Whether key strengthening is used with plain text passwords to frustrate dictionary attacks, usually using PBKDF2.
- Hardware acceleration: Whether dedicated cryptographic accelerator expansion cards can be taken advantage of.
- Trusted Platform Module: Whether the implementation can use a TPM cryptoprocessor.
- Filesystems: What filesystems are supported.
- Two-factor authentication: Whether optional security tokens (hardware security modules, such as Aladdin eToken and smart cards) are supported (for example using PKCS#11)
Layering
- Whole disk: Whether the whole physical disk or logical volume can be encrypted, including the partition tables and master boot record. Note that this does not imply that the encrypted disk can be used as the boot disk itself; refer to pre-boot authentication in the features comparison table.
- Partition: Whether individual disk partitions can be encrypted.
- File: Whether the encrypted container can be stored in a file (usually implemented as encrypted loop devices).
- Swap space: Whether the swap space (called a "pagefile" on Windows) can be encrypted individually/explicitly.
- Hibernation file: Whether the hibernation file is encrypted (if hibernation is supported).
Modes of operation
Different modes of operation supported by the software. Note that an encrypted volume can only use one mode of operation.
- CBC with predictable IVs: The CBC (cipher block chaining) mode where initialization vectors are statically derived from the sector number and are not secret; this means that IVs are re-used when overwriting a sector and the vectors can easily be guessed by an attacker, leading to watermarking attacks.
- CBC with secret IVs: The CBC mode where initialization vectors are statically derived from the encryption key and sector number. The IVs are secret, but they are re-used with overwrites. Methods for this include ESSIV and encrypted sector numbers (CGD).
- CBC with random per-sector keys: The CBC mode where random keys are generated for each sector when it is written to, thus does not exhibit the typical weaknesses of CBC with re-used initialization vectors. The individual sector keys are stored on disk and encrypted with a master key. (See GBDE for details)
- LRW: The Liskov-Rivest-Wagner tweakable narrow-block mode, a mode of operation specifically designed for disk encryption. Superseded by the more secure XTS mode due to security concerns.[120]
- XTS: XEX-based Tweaked CodeBook mode (TCB) with CipherText Stealing (CTS), the SISWG (IEEE P1619) standard for disk encryption.
- Authenticated encryption: Protection against ciphertext modification by an attacker
See also
- Cold boot attack
- Comparison of encrypted external drives
- Disk encryption software
- Disk encryption theory
- List of cryptographic file systems
Notes and references
External links
- DiskCryptor vs Truecrypt – Comparison between DiskCryptor and TrueCrypt
- Buyer's Guide to Full Disk Encryption – Overview of full-disk encryption, how it works, and how it differs from file-level encryption
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Company and product name change to Pointsec Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Initial cryptoloop patches for the Linux 2.5 development kernel: Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ dm-crypt was first included in Linux kernel version 2.6.4: https://lwn.net/Articles/75404/
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Release Notes. GnuPG
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite newsgroup
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Rebranded as ThinkVantage Client Security Шаблон:Cite webШаблон:Dead link
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Last update: 2020-03-02 Шаблон:Cite web
- ↑ Trend Micro
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 43,0 43,1 https://github.com/Aorimn/dislocker FUSE driver to read/write Windows BitLocker-ed volumes under Linux / Mac OSX
- ↑ Шаблон:Cite web
- ↑ 45,0 45,1 https://play.google.com/store/apps/details?id=com.sovworks.edslite Third party app allows to open containers encryptes with AES-256, SHA-512 hash and FAT file system
- ↑ http://www.truecrypt.org/misc/freebsd Although CipherShed can be built under FreeBSD, it is not recommended to run it because of bugs and instabilities when CipherShed is attempted to be used
- ↑ CrossCrypt - Only for the Microsoft Windows XP/2000 operating systems
- ↑ 48,0 48,1 48,2 http://www.freeotfe.org/docs/Main/Linux_volumes.htm FreeOTFE supports cryptoloop, dm-crypt/cryptsetup/dmsetup, and dm-crypt/LUKS volumes
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 51,0 51,1 Шаблон:Cite web
- ↑ https://code.google.com/p/libfvde/ libfvde supports reading FileVault2 Drive Encryption (FVDE) encrypted volumes
- ↑ http://www.freeotfe.org/docs/Main/Linux_volumes.htm Supports Linux volumes
- ↑ https://play.google.com/store/apps/details?id=com.nemesis2.luksmanager&hl=en_GB Third party app allows a user to open LibreCrypt compatible LUKS containers
- ↑ https://github.com/t-d-k/LibreCrypt/blob/master/docs/Linux_volumes.md Supports Linux volumes
- ↑ Шаблон:Cite web
- ↑ http://www.truecrypt.org/misc/freebsd Although TrueCrypt can be built under FreeBSD, it is not recommended to run it because of bugs and instabilities when TrueCrypt is attempted to be used
- ↑ https://play.google.com/store/apps/details?id=com.sovworks.eds.android Third party app allows to encrypt and decrypt VeraCrypt containers (only available in the paid version)
- ↑ https://apps.apple.com/de/app/disk-decipher/id516538625 Third party app allows to encrypt and decrypt VeraCrypt containers (only available in the paid version)
- ↑ http://www.jetico.com/linux/bcrypt-help/c_hiddn.htm Hidden containers description from Jetico (BestCrypt)
- ↑ 61,0 61,1 61,2 Secret-containers and Camouflage files ArchiCrypt Live Description Шаблон:Webarchive
- ↑ Supports "Guest" keys
- ↑ Using "Archicrypt Card"
- ↑ Supported by the BestCrypt container format; see BestCrypt SDK
- ↑ Supported by the BestCrypt Volume Encryption software
- ↑ With PIN or USB key
- ↑ BitLocker Drive Encryption: Value Add Extensibility Options
- ↑ 68,0 68,1 Шаблон:Cite web
- ↑ Recovery keys only.
- ↑ 70,0 70,1 70,2 70,3 Шаблон:Cite journal
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Although each volume encrypted with CipherShed can only have one active master key, it is possible to access its contents through more than one header. Each header can have a different password and/or keyfiles if any (cf. TrueCrypt FAQ: Is there a way for an administrator to reset a volume password or pre-boot authentication password when a user forgets it (or loses a keyfile)?)
- ↑ 74,0 74,1 Шаблон:Cite web
- ↑ 75,0 75,1 Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 77,0 77,1 77,2 dm-crypt and cryptoloop volumes can be mounted from the initrd before the system is booted
- ↑ 78,0 78,1 Шаблон:Cite web
- ↑ 79,0 79,1 Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 81,0 81,1 Шаблон:Cite web
- ↑ uses the lower filesystem (stacking)
- ↑ 83,0 83,1 Шаблон:Cite web
- ↑ 84,0 84,1 84,2 84,3 84,4 Шаблон:Cite journal
- ↑ 85,0 85,1 Шаблон:Cite web
- ↑ FreeOTFE has a modular architecture and set of components to allow 3rd party integration
- ↑ FreeOTFE allows multiple keys to mount the same container file via encrypted keyfiles
- ↑ 88,0 88,1 88,2 88,3 Шаблон:Cite web
- ↑ 89,0 89,1 89,2 Шаблон:Cite journal
- ↑ 90,0 90,1 Шаблон:Cite web
- ↑ 91,00 91,01 91,02 91,03 91,04 91,05 91,06 91,07 91,08 91,09 91,10 Шаблон:Cite web
- ↑ Using customization
- ↑ Шаблон:Cite web
- ↑ n-Crypt Pro does not use password authentication— biometric/USB dongle authentication only
- ↑ Шаблон:Cite web
- ↑ PGP private keys are always protected by strengthened passphrases
- ↑ 97,0 97,1 Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 99,0 99,1 For TrueCrypt containers
- ↑ Шаблон:Cite web
- ↑ optional by using -K OpenBSD Manual Pages: vnconfig(8)
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 105,0 105,1 105,2 Шаблон:Cite web
- ↑ Although each volume encrypted with TrueCrypt can only have one active master key, it is possible to access its contents through more than one header. Each header can have a different password and/or keyfiles if any (cf. TrueCrypt FAQ: Is there a way for an administrator to reset a volume password or pre-boot authentication password when a user forgets it (or loses a keyfile)?)
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ Within a VHD http://www.howtogeek.com/193013/how-to-create-an-encrypted-container-file-with-bitlocker-on-windows/
- ↑ dm-crypt can encrypt a file-based volume when used with the Шаблон:Mono utility included with all major Linux distributions
- ↑ yes, but the user needs custom scripts: http://www.linuxquestions.org/questions/slackware-14/luks-encryption-swap-and-hibernate-627958/
- ↑ Uses proprietary e-Capsule file system not exposed to the OS.
- ↑ 113,0 113,1 not technically part of FileVault, but provided by many versions of Mac OS X; can be enabled independently of FileVault
- ↑ http://macmarshal.com/images/Documents/mm_wp_102.pdfШаблон:Dead link
- ↑ Шаблон:Cite web
- ↑ 116,0 116,1 File-based volume encryption is possible when used with Шаблон:Mono utility.
- ↑ Шаблон:Cite web
- ↑ http://www.openbsd.org/plus38.html OpenBSD 3.8 change notes
- ↑ however, not Windows UEFI-based computers with a GUID partition table (GPT)
- ↑ LRW_issue
- ↑ Containers created with ArchiCrypt Live version 5 use LRW
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ 124,0 124,1 Шаблон:Cite journal
- ↑ Шаблон:Cite web
- ↑ 126,0 126,1 Containers created with TrueCrypt versions 1.0 through 4.0 use CBC.
- ↑ 127,0 127,1 Containers created with TrueCrypt versions 4.1 through 4.3a use LRW, and support CBC for opening legacy containers only.
- ↑ Containers created with CipherShed or TrueCrypt versions 5.0+ use XTS, and support LRW/CBC for opening legacy containers only.
- ↑ Starting with Linux kernel version 2.6.20, CryptoAPI supports the LRW mode: https://lwn.net/Articles/213650/
- ↑ Шаблон:Cite web
- ↑ Шаблон:Cite web
- ↑ For Scramdisk containers
- ↑ For TrueCrypt 4 containers
- ↑ For TrueCrypt 5 and 6 containers
- ↑ Шаблон:Cite web
- ↑ Containers created with TrueCrypt versions 5.0 or later use XTS, and support LRW/CBC for opening legacy containers only.
