Re: Encryption is like a locked suitcase

Peter Gutmann (pgut001@cs.auckland.ac.nz)
Sat, 22 Aug 1998 12:43:49 (NZST)

• Next message: Enzo Michelangeli: "Re: random number code."
• Previous message: Dutra de Lacerda: "TRUE RANDOMNESS captured... (Keyboard-only)"
• In reply to: Mail System Internal Data: "DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA"

 
Jim Gillogly <jim@acm.org> writes:
 
>Rather than all these schemes about renaming files or replacing them with
>innocuous ones, I suppose if I were interested in putting something over on
>the inspectors I'd just temporarily remove LILO from my laptop and let it boot
>automatically into the totally benign Win95 partition instead of my insidious
>crypto-rich Linux partition. I think it unlikely that their inspection would
>notice an unused partition.
 
That depends on whether their scanner scans at the filesystem or drive level -
if they're checking the start of each sector for a JFIF or GIF signature
they'll still find it. What I'd do is use a partition-level encrypter and if
necessary change the partition type to 0 (empty). For example for SFS you can
change the partition type from 0x42 to 0x00 and still mount it from the device
driver since it uses a magic ID to find the partition rather than scanning the
partition table (you'd have to reset the ID for any of the other SFS tools to
work though). Any kind of disk analysis tool will just see an empty partition
full of garbage.
 
Peter.
 
 

• Next message: Enzo Michelangeli: "Re: random number code."
• Previous message: Dutra de Lacerda: "TRUE RANDOMNESS captured... (Keyboard-only)"
• In reply to: Mail System Internal Data: "DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA"