TrueCrypt

TrueCrypt をセキュアにした暗号化仮想ドライブ作成ソフト。 TrueCrypt が持つ未修整の脆弱性を解決し、さらにブルートフォースアタックへの耐久性も高めた暗号化仮想ドライブ作成ソフトです。. Download TrueCrypt for Windows now from Softonic: 100% safe and virus free. More than 671 downloads this month. Download TrueCrypt latest version 2021.

Truecrypt Alternative
Truecrypt Download
Truecrypt.com
Truecrypt.org

Q: What is AWS Snowball?

AWS Snowball is a service that provides secure, rugged devices, so you can bring AWS computing and storage capabilities to your edge environments, and transfer data into and out of AWS. Those rugged devices are commonly referred to as AWS Snowball or AWS Snowball Edge devices. Previously, AWS Snowball referred specifically to an early hardware version of these devices, however that model has been replaced by updated hardware. Now the AWS Snowball service operates with Snowball Edge devices, which include on-board computing capabilities as well as storage.

Q: What is Snowball Edge?

Snowball Edge is an edge computing and data transfer device provided by the AWS Snowball service. It has on-board storage and compute power that provides select AWS services for use in edge locations. Snowball Edge comes in two options, Storage Optimized and Compute Optimized, to support local data processing and collection in disconnected environments such as ships, windmills, and remote factories. Learn more about its features here.

Q: What happened with the original 50 TB and 80 TB AWS Snowball devices?

The original Snowball devices were transitioned out of service and Snowball Edge Storage Optimized are now the primary devices used for data transfer.

Q: Can I still order the original Snowball 50 TB and 80 TB devices?

No. For data transfer needs now, please select the Snowball Edge Storage Optimized devices.

Q: How does Snowball Edge work?

You start by requesting one or more Snowball Edge Compute Optimized or Snowball Edge Storage Optimized devices in the AWS Management Console based on how much data you need to transfer and the compute needed for local processing. The buckets, data, Amazon EC2 AMIs, and Lambda functions you select are automatically configured, encrypted, and preinstalled on your devices before they are shipped to you. Once a device arrives, you connect it to your local network and set the IP address either manually or automatically with DHCP. Then use the Snowball Edge client software, job manifest, and unlock code to verify the integrity of the Snowball Edge device or cluster, and unlock it for use. The manifest and unlock code are uniquely generated and crypto-logically bound to your account and the Snowball Edge shipped to you, and cannot be used with any other devices. Data copied to Snowball Edge is automatically encrypted and stored in the buckets you specify.

All logistics and shipping is done by Amazon, so when copying is complete and the device is ready to be returned, the E Ink shipping label will automatically update the return address, ensuring that the Snowball Edge device is delivered to the correct AWS facility. Once the device ships, you can receive tracking status via messages sent by Amazon Simple Notification Service (Amazon SNS), generated texts and emails, or directly from the console.

All of the management for your Snowball Edge resources can be performed in the AWS management console and these operations require system engineers.

Q: What is the difference between Snowball Edge and Snowball?

AWS Snowball now refers to the service overall, and Snowball Edge are the current types of devices that the service uses – sometimes referred to generically as AWS Snowball devices. Originally, early Snowball hardware designs were for data transport only. Snowball Edge has the additional capability to run computing locally, even when there is no network connection available.

Q: What is the difference between the Snowball Edge Storage Optimized and Snowball Edge Compute Optimized options?

Snowball Edge Storage Optimized is the optimal choice if you need to securely and quickly transfer dozens of terabytes to petabytes of data to AWS. It is also a good fit for running general purpose analysis such as IoT data aggregation and transformation. It provides up to 80 TB of usable HDD storage, 40 vCPUs, 1 TB of SATA SSD storage, and up to 40 Gb network connectivity to address large scale data transfer and pre-processing use cases. We recommend using Snowball Edge Compute Optimized for use cases that require access to powerful compute and high-speed storage for data processing before transferring it into AWS. It features 52 vCPUs, 7.68 TB of NVMe SSD, and up to 100 Gb networking to run applications such as high-resolution video processing, advanced IoT data analytics, and real-time optimization of machine learning models in environments with limited connectivity. For more details, see the documentation.

Q: Who should use Snowball Edge?

Consider Snowball Edge if you need to run computing in rugged, austere, mobile, or disconnected (or intermittently connected) environments. Also consider it for large-scale data transfers and migrations when bandwidth is not available for use of a high-speed online transfer service, such as AWS DataSync.
Snowball Edge Storage Optimized is the optimal data transfer choice if you need to securely and quickly transfer terabytes to petabytes of data to AWS. You can use Snowball Edge Storage Optimized if you have a large backlog of data to transfer or if you frequently collect data that needs to be transferred to AWS and your storage is in an area where high-bandwidth internet connections are not available or cost-prohibitive.
You can also use Snowball Edge to run edge computing workloads, such as performing local analysis of data on a Snowball Edge cluster and writing it to the S3-compatible endpoint. You can streamline it into existing workflows leveraging built-in capabilities such as the NFS file interface and migrate files to the device while maintaining file metadata.

Snowball Edge can operate in remote locations or harsh operating environments, such as factory floors, oil and gas rigs, mining sites, hospitals, and on moving vehicles. Snowball Edge is pre-configured and does not have to be connected to the internet, so processing and data collection can take place within isolated operating environments. Snowball Edge allows you to run the same software at the edge and access select AWS capabilities as you would with full connectivity to AWS.

Q. Can I use Snowball Edge to migrate data from one AWS Region to another AWS Region?

No. Snowball Edge is intended to serve as a data transport solution for moving high volumes of data into and out of a designated AWS Region. For use cases that require data transfer between AWS Regions, we recommend using S3 Cross-Region Replication as an alternative.

Q: How much data can I transfer using Snowball Edge?

You can transfer virtually any amount of data with Snowball Edge, from a few terabytes to many petabytes. You can transfer up to approximately 80 TB with a single Snowball Edge Storage Optimized device and can transfer even larger data sets with multiple devices, either in parallel, or sequentially.

Q: How long does it take to transfer my data?

Data transfer speed is affected by a number of factors including local network speed, file size, and the speed at which data can be read from your local servers. The end-to-end time to transfer up to 80 TB of data into AWS with Snowball Edge is approximately one week, including the usual shipping and handling time in AWS data centers.

Q: How long can I have a Snowball Edge for a specific job?

For security purposes, jobs using an AWS Snowball Edge device must be completed within 360 days of being prepared. If you need to keep one or more devices for longer than 360 days, contact AWS Support. Otherwise, after 360 days, the device becomes locked, can no longer be accessed, and must be returned. If the AWS Snowball Edge device becomes locked during an import job, we can still transfer the existing data on the device into Amazon S3.

Q: What are the specifications of the Snowball Edge devices?

Please see the AWS Snowball Features page for feature details and the Snowball Edge documentation page for a complete list of hardware specs, including network connections, thermal and power requirements, decibel output, and dimensions.

Q: What network interfaces does Snowball Edge support?

Snowball Edge Storage Optimized for data transfer devices have two 10G RJ45 ports, one 10/25G SFP28 port, and one 40G/100G QSFP28 port.
Snowball Edge Storage Optimized for edge compute devices have one 10G RJ45 port, one 10/25G SFP28 port, and one 40G QSFP+ port.

The Snowball Edge Compute Optimized devices (including the GPU option) have two 10G RJ45 ports, one 10/25G SFP28 port, and one 40G/100G QSFP28 port.

Q: What is the Snowball Edge default shipping option? Can I choose expedited shipping?

As a default, Snowball Edge uses two-day shipping by UPS. You can choose expedited shipping if your jobs are time-sensitive.

Disk encryption is a technology which protects information by converting it into unreadable code that cannot be deciphered easily by unauthorized people. Disk encryption uses disk encryption software or hardware to encrypt every bit of data that goes on a disk or disk volume. It is used to prevent unauthorized access to data storage.

The expression full disk encryption (FDE) (or whole disk encryption) signifies that everything on the disk is encrypted, but the master boot record (MBR), or similar area of a bootable disk, with code that starts the operating system loading sequence, is not encrypted. Some hardware-based full disk encryption systems can truly encrypt an entire boot disk, including the MBR.

Transparent encryption[edit]

Transparent encryption, also known as real-time encryption and on-the-fly encryption (OTFE), is a method used by some disk encryption software. 'Transparent' refers to the fact that data is automatically encrypted or decrypted as it is loaded or saved.

With transparent encryption, the files are accessible immediately after the key is provided, and the entire volume is typically mounted as if it were a physical drive, making the files just as accessible as any unencrypted ones. No data stored on an encrypted volume can be read (decrypted) without using the correct password/keyfile(s) or correct encryption keys. The entire file system within the volume is encrypted (including file names, folder names, file contents, and other meta-data).^[1]

To be transparent to the end-user, transparent encryption usually requires the use of device drivers to enable the encryption process. Although administrator access rights are normally required to install such drivers, encrypted volumes can typically be used by normal users without these rights.^[2]

In general, every method in which data is seamlessly encrypted on write and decrypted on read, in such a way that the user and/or application software remains unaware of the process, can be called transparent encryption.

Disk encryption vs. filesystem-level encryption[edit]

Disk encryption does not replace file encryption in all situations. Disk encryption is sometimes used in conjunction with filesystem-level encryption with the intention of providing a more secure implementation. Since disk encryption generally uses the same key for encrypting the whole drive, all of the data can be decrypted when the system runs. However, some disk encryption solutions use multiple keys for encrypting different volumes. If an attacker gains access to the computer at run-time, the attacker has access to all files. Conventional file and folder encryption instead allows different keys for different portions of the disk. Thus an attacker cannot extract information from still-encrypted files and folders.

Unlike disk encryption, filesystem-level encryption does not typically encrypt filesystem metadata, such as the directory structure, file names, modification timestamps or sizes.

Disk encryption and Trusted Platform Module[edit]

Trusted Platform Module (TPM) is a secure cryptoprocessor embedded in the motherboard that can be used to authenticate a hardware device. Since each TPM chip is unique to a particular device, it is capable of performing platform authentication. It can be used to verify that the system seeking the access is the expected system. ^[3]

A limited number of disk encryption solutions have support for TPM. These implementations can wrap the decryption key using the TPM, thus tying the hard disk drive (HDD) to a particular device. If the HDD is removed from that particular device and placed in another, the decryption process will fail. Recovery is possible with the decryption password or token.

Although this has the advantage that the disk cannot be removed from the device, it might create a single point of failure in the encryption. For example, if something happens to the TPM or the motherboard, a user would not be able to access the data by connecting the hard drive to another computer, unless that user has a separate recovery key.

Implementations[edit]

There are multiple tools available in the market that allow for disk encryption. However, they vary greatly in features and security. They are divided into three main categories: software-based, hardware-based within the storage device, and hardware-based elsewhere (such as CPU or host bus adaptor). Hardware-based full disk encryption within the storage device are called self-encrypting drives and have no impact on performance whatsoever. Furthermore, the media-encryption key never leaves the device itself and is therefore not available to any virus in the operating system.

The Trusted Computing GroupOpal Storage Specification provides industry accepted standardization for self-encrypting drives. External hardware is considerably faster than the software-based solutions, although CPU versions may still have a performance impact^{[clarification needed]}, and the media encryption keys are not as well protected.

All solutions for the boot drive require a pre-boot authentication component which is available for all types of solutions from a number of vendors. It is important in all cases that the authentication credentials are usually a major potential weakness since the symmetric cryptography is usually strong.^{[clarification needed]}

Password/data recovery mechanism[edit]

Secure and safe recovery mechanisms are essential to the large-scale deployment of any disk encryption solutions in an enterprise. The solution must provide an easy but secure way to recover passwords (most importantly data) in case the user leaves the company without notice or forgets the password.

Challenge–response password recovery mechanism[edit]

Challenge–response password recovery mechanism allows the password to be recovered in a secure manner. It is offered by a limited number of disk encryption solutions.

Some benefits of challenge–response password recovery:

No need for the user to carry a disc with recovery encryption key.
No secret data is exchanged during the recovery process.
No information can be sniffed.
Does not require a network connection, i.e. it works for users that are at a remote location.

Emergency recovery information (ERI)-file password recovery mechanism[edit]

An emergency recovery information (ERI) file provides an alternative for recovery if a challenge–response mechanism is unfeasible due to the cost of helpdesk operatives for small companies or implementation challenges.

Some benefits of ERI-file recovery:

Small companies can use it without implementation difficulties.
No secret data is exchanged during the recovery process.
No information can be sniffed.
Does not require a network connection, i.e. it works for users that are at a remote location.

Security concerns[edit]

Most full disk encryption schemes are vulnerable to a cold boot attack, whereby encryption keys can be stolen by cold-booting a machine already running an operating system, then dumping the contents of memory before the data disappears. The attack relies on the data remanence property of computer memory, whereby data bits can take up to several minutes to degrade after power has been removed.^[4] Even a Trusted Platform Module (TPM) is not effective against the attack, as the operating system needs to hold the decryption keys in memory in order to access the disk.^[4]

Full disk encryption is also vulnerable when a computer is stolen when suspended. As wake-up does not involve a BIOS boot sequence, it typically does not ask for the FDE password. Hibernation, in contrast goes via a BIOS boot sequence, and is safe.

All software-based encryption systems are vulnerable to various side channel attacks such as acoustic cryptanalysis and hardware keyloggers. In contrast, self-encrypting drives are not vulnerable to these attacks since the hardware encryption key never leaves the disk controller.

Also, most of full disk encryption schemes don't protect from data tampering (or silent data corruption, i.e. bitrot).^[5] That means they only provide privacy, but not integrity. Block cipher-based encryption modes used for full disk encryption are not authenticated encryption themselves because of concerns of the storage overhead needed for authentication tags. Thus, if tampering would be done to data on the disk, the data would be decrypted to garbled random data when read and hopefully errors may be indicated depending on which data is tampered with (for the case of OS metadata – by the file system; and for the case of file data – by the corresponding program that would process the file). One of the ways to mitigate these concerns, is to use file systems with full data integrity checks via checksums (like Btrfs or ZFS) on top of full disk encryption. However, cryptsetup started experimentally to support authenticated encryption^[6]

Full disk encryption[edit]

Benefits[edit]

Full disk encryption has several benefits compared to regular file or folder encryption, or encrypted vaults. The following are some benefits of disk encryption:

Nearly everything including the swap space and the temporary files is encrypted. Encrypting these files is important, as they can reveal important confidential data. With a software implementation, the bootstrapping code cannot be encrypted however. For example, BitLocker Drive Encryption leaves an unencrypted volume to boot from, while the volume containing the operating system is fully encrypted.
With full disk encryption, the decision of which individual files to encrypt is not left up to users' discretion. This is important for situations in which users might not want or might forget to encrypt sensitive files.
Immediate data destruction, such as simply destroying the cryptographic keys (crypto-shredding), renders the contained data useless. However, if security towards future attacks is a concern, purging or physical destruction is advised.

The boot key problem[edit]

One issue to address in full disk encryption is that the blocks where the operating system is stored must be decrypted before the OS can boot, meaning that the key has to be available before there is a user interface to ask for a password. Most Full Disk Encryption solutions utilize Pre-Boot Authentication by loading a small, highly secure operating system which is strictly locked down and hashed versus system variables to check for the integrity of the Pre-Boot kernel. Some implementations such as BitLocker Drive Encryption can make use of hardware such as a Trusted Platform Module to ensure the integrity of the boot environment, and thereby frustrate attacks that target the boot loader by replacing it with a modified version. This ensures that authentication can take place in a controlled environment without the possibility of a bootkit being used to subvert the pre-boot decryption.

With a pre-boot authentication environment, the key used to encrypt the data is not decrypted until an external key is input into the system.

Solutions for storing the external key include:

Username / password
Using a smartcard in combination with a PIN
Using a biometric authentication method such as a fingerprint
Using a dongle to store the key, assuming that the user will not allow the dongle to be stolen with the laptop or that the dongle is encrypted as well
Using a boot-time driver that can ask for a password from the user
Using a network interchange to recover the key, for instance as part of a PXE boot
Using a TPM to store the decryption key, preventing unauthorized access of the decryption key or subversion of the boot loader
Using a combination of the above

Truecrypt Alternative

All these possibilities have varying degrees of security; however, most are better than an unencrypted disk.

References[edit]

^'Truecrypt User Guide'(PDF). grc.com.
^'t-d-k/LibreCrypt'. GitHub.
^Information technology. Trusted platform module, BSI British Standards, doi:10.3403/30177265u, retrieved 2020-12-04
^ ^a^bJ. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten (2008-02-21). 'Lest We Remember: Cold Boot Attacks on Encryption Keys'. Princeton University. Archived from the original on 2011-07-22. Retrieved 2008-02-22.Cite journal requires |journal= (help)CS1 maint: multiple names: authors list (link)
^'Practical disadvantages of GCM mode encryption'. Cryptography Stack Exchange.
^'docs/v2.0.0-ReleaseNotes · master · cryptsetup / cryptsetup'. GitLab.

External links[edit]

On-The-Fly Encryption: A Comparison – Reviews and lists the different features of disk encryption systems (archived version from January 2013)
All about on-disk/full-disk encryption on one page – covers the use of dm-crypt/LUKS on Linux, starting with theory and ending with many practical examples about its usage (archived version from September 2015).
Buyer's Guide to Full Disk Encryption – Overview of full-disk encryption, how it works, and how it differs from file-level encryption, plus an overview of leading full-disk encryption software.

Truecrypt.org

Retrieved from 'https://en.wikipedia.org/w/index.php?title=Disk_encryption&oldid=1010431513'

Foxmate266