From Wikipedia, the free encyclopedia
 |
Information may be incorrect or incomplete, please edit or discuss on talk page if you know better. |
Technical feature comparison of different disk encryption software.
[edit] Background information
| Name |
Developer |
Release date |
Licensing |
Operating system support |
Development status |
| BestCrypt |
Jetico |
1993[1] |
Commercial, limited source code |
Linux 2.6, Windows NT-based, Windows 9x, Windows 3.1, MS-DOS |
Maintained |
| Sentry 2020 |
SoftWinter |
1998[2] |
Commercial, closed source |
Windows NT-based, Pocket PC |
Actively developed |
| PGPDisk |
PGP Corporation |
1998-09-01[3] |
Commercial, closed source |
Windows NT-based, Mac OS X |
Maintained |
| CrossCrypt |
Steven Scherrer |
1999-06-09[4] |
Free, open source (GPL) |
Windows NT-based |
? |
| DriveCrypt |
SecurStar GmbH |
2001 |
Commercial, closed source |
Windows NT-based |
Maintained |
| CGD |
Roland C. Dowdeswell |
2002-10-04[5] |
Free, open source (BSD) |
NetBSD 2.0+ |
Maintained |
| GBDE |
Poul-Henning Kamp |
2002-10-19[6] |
Free, open source (BSD) |
FreeBSD 5.0+ |
Maintained |
| cryptoloop |
? |
2003-07-02[7] |
Free, open source (GPL) |
Linux 2.5–2.6 |
Deprecated, known vulnerabilities |
| TrueCrypt |
TrueCrypt Foundation |
2004-02-02[8] |
Free, open source (custom) |
Linux 2.6, Windows NT-based |
Actively developed |
| dm-crypt/cryptsetup |
Christophe Saout |
2004-03-11[9] |
Free, open source (GPL) |
Linux 2.6 |
Actively developed |
| FreeOTFE |
Sarah Dean |
2004-10-10[10] |
Free, open source (custom) |
Windows NT-based, Pocket PC |
Actively developed |
| dm-crypt/LUKS |
Clemens Fruhwirth (LUKS) |
2005-02-05[11] |
Free, open source (GPL) |
Linux 2.6 |
Actively developed |
| GELI |
Pawel Jakub Dawidek |
2005-04-11[12] |
Free, open source (BSD) |
FreeBSD 6.0+ |
Maintained |
| CryptArchiver |
WinEncrypt |
? |
Commercial, closed source |
Windows NT-based |
Maintained |
| n-Crypt Pro |
n-Trance Security Ltd |
2005 |
Commercial, closed source |
Windows NT-based |
Maintained |
| Scramdisk |
Shaun Hollingworth |
? |
Free, open source (custom) |
Windows 9x-based |
Unmaintained |
| SecuBox |
Aiko Solutions |
2007-02-19[13] |
Commercial, closed source |
Windows CE, Windows Mobile |
Actively developed |
[edit] Features
- Hidden containers: Whether hidden containers can be created for deniable encryption. Note that some modes of operation can be more prone to watermarking attacks than others.
- Pre-boot authentication: Whether authentication can be required before booting the computer, thus allowing one to encrypt the boot disk.
- Custom authentication: Whether custom authentication mechanisms can be implemented with third-party applications.
- Multiple keys: Whether an encrypted volumes can have more than one active key.
- Passphrase strengthening: Whether key strengthening is used with plain text passwords to frustrate dictionary attacks, usually using PBKDF2.
- Hardware acceleration: Whether dedicated cryptography acceleration extension cards can be taken advantage of.
[edit] Layering
- Whole disk: Whether the whole disk can be encrypted, including the partition tables. Note that this does not imply that the encrypted disk can be booted off of; refer to "pre-boot authentication" in the features comparison table.
- Partition: Whether individual disk partitions can be encrypted.
- File: Whether the encrypted container can be stored in a file (usually implemented as encrypted loop devices).
- Swap space: Whether the swap space (called a "pagefile" on Windows) can be encrypted individually/explicitly.
[edit] Modes of operation
Different modes of operation supported by the software. Note that an encrypted volume can only use one mode of operation.
- CBC w/ public IVs: The CBC (cipher block chaining) mode where initialization vectors are statically derived from the sector number and and are not secret; this means that IVs are re-used when overwriting a sector and the vectors can easily be guessed by an attacker, leading to watermarking attacks.
- CBC w/ secret IVs: The CBC mode where initialization vectors are statically derived from the encryption key and sector number. The IVs are secret, but they are re-used with overwrites. Methods for this include ESSIV and encrypted sector numbers (CGD).
- LRW: The Liskov-Rivest-Wagner tweakable narrow-block mode, a mode of operation specifically designed for disk encryption.
- Random per-sector keys: The CBC mode where random keys are generated for each sector when it is written to, thus does not exhibit the typical weaknesses of CBC with re-used initialization vectors. The individual sector keys are stored on disk and encrypted with a master key. (See GBDE for details)
[edit] See also
[edit] Notes and references
- ^ Jetico Company Info. Jetico. Retrieved on January 5, 2007.
- ^ Sentry 2020 news. Retrieved on January 2, 2007.
- ^ "PGP 6.0 Freeware released - any int'l links?". comp.security.pgp. (Google Groups). Retrieved on 2007-01-04.
- ^ Stefan Scherrer (2004-02-03). readme.txt in CrossCrypt source distribution. Retrieved on January 5, 2007.
- ^ Roland Dowdeswell (2002-10-04). CryptoGraphic Disk. mailing list announcement. Retrieved on January 14, 2007.
- ^ gbde(4) man page in FreeBSD 4.11. GBDE manual page as it appeared in FreeBSD 4.11. Retrieved on December 24, 2006.
- ^ Initial cryptoloop patches for the Linux 2.5 development kernel: http://uwsg.iu.edu/hypermail/linux/kernel/0307.0/0348.html
- ^ TrueCrypt version history. Retrieved on December 24, 2006.
- ^ dm-crypt was first included in Linux kernel version 2.6.4: http://lwn.net/Articles/75404/
- ^ FreeOTFE version history. Retrieved on December 24, 2006.
- ^ Clemens Fruhwirth. LUKS version history. Retrieved on December 24, 2006.
- ^ geli(8) man page in FreeBSD 6.0. GELI manual page as it first appeared in FreeBSD 6.0. Retrieved on December 24, 2006.
- ^ Secubox for Pocket PC. release announcement. Aiko Solutions. Retrieved on May 22, 2007.
- ^ Supported by the BestCrypt container format; see BestCrypt SDK
- ^ PGP Whole Disk Encryption FAQ. PGP Corporation. Retrieved on December 24, 2006.
- ^ PGP private keys are always protected by strengthened passphrases
- ^ a b c DriveCrypt features. SecurStar GmbH. Retrieved on January 3, 2007.
- ^ a b c Roland C. Dowdeswell, John Ioannidis. "The CryptoGraphic Disk Driver" (PDF). Retrieved on 2006-12-24.
- ^ Federico Biancuzzi (2005-12-21). Inside NetBSD's CGD. interview with Roland Dowdeswell. ONLamp.com.
- ^ a b c d FreeBSD Handbook: Encrypting Disk Partitions. Retrieved on December 24, 2006.
- ^ a b c Poul-Henning Kamp. "GBDE - GEOM Based Disk Encryption" (PDF). Retrieved on 2006-12-24.
- ^ a b c dm-crypt and cryptoloop volumes can be mounted from the initrd before the system is booted
- ^ FreeOTFE allows multiple keys to mount the same container file via encrypted keyfiles
- ^ a b geli(8) man page in FreeBSD-current. GELI manual page in current FreeBSD. Retrieved on December 24, 2006.
- ^ n-Crypt Pro does not use password authentication — biometric/USB dongle authentication only
- ^ a b c TrueCrypt documentation: TrueCrypt Volume. Retrieved on January 8, 2007.
- ^ Third-Party Project: TCTEMP. Retrieved on January 8, 2007. "TCTEMP automates the process of using TrueCrypt to on-the-fly encrypt the Windows paging (swap) file, temporary files, and print spooler files."
- ^ dm-crypt can encrypt a file-based volume when used with the losetup utility included with all major Linux distributions
- ^ New features in BestCrypt version 8. Jetico. Retrieved on March 2, 2007.
- ^ man 4 cgd in NetBSD-current. NetBSD current manual page on CGD (2006-03-11). Retrieved on December 24, 2006.
- ^ See released source code; just uses sector number in earlier versions
- ^ New containers created with TrueCrypt versions 4.1 and up use LRW, old containers use plain CBC
- ^ Starting with Linux kernel version 2.6.20, CryptoAPI supports the LRW mode: http://lwn.net/Articles/213650/
- ^ Linux/BSD disk encryption comparison. Retrieved on December 24, 2006.
