Filevault
Video Suggestions
Purposeful Blue-on-White or Official Fragging
WorldNews.com
Andrea Pirlo widmet Sieg gegen Florenz Fabrice Muamba
Goal
Osama wanted to kill Obama to create chaos
The Siasat Daily
Egyptian Christians mourn Orthodox pope Shenouda III
The Guardian
Toulouse Shooting: Gunman Kills 4 Outside Jewish School
Huffington Post
FileVault uses encrypted file systems that are encrypted and decrypted on the fly. A master password (and recovery key in 10.7+) is created as a precaution against a user losing his or her password. Although early versions were slow and caused system to temporarily hang when used with disk-intensive applications, such as sound and video editing, the performance of FileVault has been improved in more recent versions of Mac OS X.
In Mac OS X v.10.4.x and below, FileVault stores the encrypted file system as a Sparse Disk Image, which is basically a single large file. In Mac OS X v10.5 (Leopard), FileVault stores the encrypted file system as a new image called a Sparse bundle. Sparse bundles break images into smaller 8MB files called bands, allowing them to be backed up using Leopard's Time Machine feature (see below for limitations, however). If transferring FileVault data from a previous Mac that uses 10.4 using the built-in utility to move data to a new machine, the data continues to be stored in the old sparse image format, and the user must turn FileVault off and then on again to re-encrypt in the new sparse bundle format. FileVault 2, introduced in Mac OS X Lion, encrypts entire disks rather than users' home folders. This also solves the compatibility problems related to backup, as the encryption is transparent to backup software when the operating system is running.
If the OS or an application requires the unencrypted data to be found at its original path, then a symbolic link can be made, and the image file added to login items, and the password for the image added to the login keychain, but some such things are not for the average user. Rather than give special attention to just ''parts'' of a home directory, it may be simpler to allow FileVault encryption of the ''whole''.
Without Mac OS X Server: Time Machine back up of a FileVault home directory, to a local volume, can occur only whilst the user is logging (or logged) out. From such volumes:
With Mac OS X Server as a Time Machine destination:
As FileVault restricts the ways in which other users' processes can access the user's content, so some third party backup solutions can back up the contents of a user's FileVault home directory ''only if'' other parts of the computer (including other users' home directories) are excluded.
The use of 128 bit AES rather than 256 bit AES is theoretically less secure, though this would represent a true vulnerability only if a flaw were found in the algorithm that made it easier to attack smaller keys. Currently, a 128 bit key is considered long enough to be immune from brute force attack.
Notably, when encrypting a disk with FileValut 2, the user is given a 25-character alphanumeric "recovery key", which is stated to be case insensitive. Thus, we have 25 characters, each of which have 36 possibilities. As there are only approximately 2^124 possibilities for such a key, this "recovery key" loses a further 4 bits of key entropy, leaving FileVault 2 with effectively 124 bit keys. While a 124 bit key should also be theoretically secure, it remains to be seen what other flaws may exist that this slight weakness could be combined with to possibly lead to insecure encryption.
FileVault also is flawed in that the encryption pass phrase is the user's login password. This discourages use of cryptographically strong pass phrases. The average user will not wish to type in a pass phrase with 128 bits of entropy every time they log in to the computer, open a secure system preference, allow privilege escalation of a running program, unlock the screen saver, and so on. If the user chooses to do this, they they must type in an unbearably long pass phrase every time they do these things. If they do not, then FileVault 1 or 2 can be broken by brute force. Of note, FileVault 2 enables the administrator to designate a number of user accounts authorized to decrypt the systme disk. This means that if any one of those users has a pass phrase weaker than a cryptographically strong pass phrase, then the system is only as (in)secure as the weakest pass phrase chosen by any of those users. This is a glaring problem with FileVault that raises serious questions about how well cryptography is understood at Apple development, or alternatively, how serious Apple is about developing a truly secure solution. Of note, early versions of FileVault automatically stored the user's passphrase in the system keychain, requiring the user to notice and go out of their way to manually disable this security hole that a truck could be driven through, providing another glaringly obvious example of poor cryptographic design at Apple.
Several shortcomings have been identified in FileVault's use of cryptography. FileVault first generation uses "128-bit AES encryption". Its security can be broken by cracking either 1024-bit RSA or 3DES-EDE, both of which are considered weaker than 128-bit AES.
Also problematic is the FileVault first gen's use of the CBC mode of operation (see Disk encryption theory) and the unsafe storage of keys in the Mac OS X "safe sleep" mode.
A study published in 2008 found data remanence in dynamic random access memory (DRAM), with data retention of seconds to minutes at room temperature and much longer times when memory chips were cooled to low temperature. The study authors were able to use a cold boot attack to recover cryptographic keys for several popular disk encryption systems, including FileVault, by taking advantage of redundancy in the way keys are stored after they have been expanded for efficient use, such as in key scheduling. The authors recommend that computers be powered down, rather than be left in a "sleep" state, when not in physical control by the owner.
On 31 July 2008, Brian Krebs posts on his ''Washington Post'' blog, that Charles Edge, an American researcher from Georgia, found a security hole in FileVault and had to withdraw from a speech about it at the Black Hat Briefings.
Category:Mac OS X Category:Cryptographic software Category:Disk encryption
de:FileVault fr:FileVault it:FileVault nl:FileVault ja:FileVault sv:FileVault ru:FileVault uk:FileVaultThis text is licensed under the Creative Commons CC-BY-SA License. This text was originally published on Wikipedia and was developed by the Wikipedia community.
The World News (WN) Network, has created this privacy statement in order to demonstrate our firm commitment to user privacy. The following discloses our information gathering and dissemination practices for wn.com, as well as e-mail newsletters.
We do not collect personally identifiable information about you, except when you provide it to us. For example, if you submit an inquiry to us or sign up for our newsletter, you may be asked to provide certain information such as your contact details (name, e-mail address, mailing address, etc.).
When you submit your personally identifiable information through wn.com, you are giving your consent to the collection, use and disclosure of your personal information as set forth in this Privacy Policy. If you would prefer that we not collect any personally identifiable information from you, please do not provide us with any such information. We will not sell or rent your personally identifiable information to third parties without your consent, except as otherwise disclosed in this Privacy Policy.
Except as otherwise disclosed in this Privacy Policy, we will use the information you provide us only for the purpose of responding to your inquiry or in connection with the service for which you provided such information. We may forward your contact information and inquiry to our affiliates and other divisions of our company that we feel can best address your inquiry or provide you with the requested service. We may also use the information you provide in aggregate form for internal business purposes, such as generating statistics and developing marketing plans. We may share or transfer such non-personally identifiable information with or to our affiliates, licensees, agents and partners.
We may retain other companies and individuals to perform functions on our behalf. Such third parties may be provided with access to personally identifiable information needed to perform their functions, but may not use such information for any other purpose.
In addition, we may disclose any information, including personally identifiable information, we deem necessary, in our sole discretion, to comply with any applicable law, regulation, legal proceeding or governmental request.
We do not want you to receive unwanted e-mail from us. We try to make it easy to opt-out of any service you have asked to receive. If you sign-up to our e-mail newsletters we do not sell, exchange or give your e-mail address to a third party.
E-mail addresses are collected via the wn.com web site. Users have to physically opt-in to receive the wn.com newsletter and a verification e-mail is sent. wn.com is clearly and conspicuously named at the point of
collection.If you no longer wish to receive our newsletter and promotional communications, you may opt-out of receiving them by following the instructions included in each newsletter or communication or by e-mailing us at michaelw(at)wn.com
The security of your personal information is important to us. We follow generally accepted industry standards to protect the personal information submitted to us, both during registration and once we receive it. No method of transmission over the Internet, or method of electronic storage, is 100 percent secure, however. Therefore, though we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
If we decide to change our e-mail practices, we will post those changes to this privacy statement, the homepage, and other places we think appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.
If we make material changes to our e-mail practices, we will notify you here, by e-mail, and by means of a notice on our home page.
The advertising banners and other forms of advertising appearing on this Web site are sometimes delivered to you, on our behalf, by a third party. In the course of serving advertisements to this site, the third party may place or recognize a unique cookie on your browser. For more information on cookies, you can visit www.cookiecentral.com.
As we continue to develop our business, we might sell certain aspects of our entities or assets. In such transactions, user information, including personally identifiable information, generally is one of the transferred business assets, and by submitting your personal information on Wn.com you agree that your data may be transferred to such parties in these circumstances.
