Encryption is Not Enough

Keeping digital data private takes more than just encrypting the data.

Inconvenient fact: Encryption is harder than it looks. Not just any encryption program will do. You need expertly designed encryption software that been proven over time.

As with other software, any encryption program can have hidden flaws that are eventually revealed. It can also have a secret backdoor. With that in mind, here are the attributes I look for when choosing an encryption program.

• The program must not use a proprietary encryption algorithm, but rather a time proven algorithm that has been extensively reviewed the cryptographic community. Examples are AES (Rijndael), DES, Triple-DES, Twofish, and Serpent, and combinations of these used in cascade.
• It must have been widely used for several years without being breached. Even though a new encryption program uses a time-proven algorithm, implementation of that algorithm can easily be faulty.
• Open-source software (not necessarily free) is a better choice than closed-source software, particularly if it is actively used by prominent entities.

Operating systems are messy. They leave behind all sorts of echos of the data they access or process -- swap files, temp files, hibernation files, browser artifacts, etc. Many simple encryption programs simply decrypt to a plain-text file. Yes, they may delete the file when you close the program, but they may not purge the file. It is trivial to find and open files that have merely been deleted. (You did know that deleted files are not actually erased didn't you?)

Thus anyone -- burgler, snatch thief, snoopy coworker -- who gains access to your computer, running or not, is likely to find plain text echos of your encrypted data. If you don't have adequate physical security for your computer, you need to use full disk encryption. Then those plain text echos will be encrypted when your computer is off. Be sure your program also encrypts your whole disk when your laptop lid is closed, not just when it is off.

A warning on backups: Encryption programs that create encrypted "volumes" (files that contain encrypted files) do not change the size of the volume file, and often do not change the file's "date modified" even though content in the file has been changed or added.  The purpose is to maintain plausable deniability, but the result can be that your backup software does not recognize that the file has changed, and skips backing it up.

Malware is another threat. If the computer that accesses your data is infected by spyware the plain text (decrypted) data can be transmitted to an exploiter over the Internet. Encryption doesn't do a thing for you in this case. Your security system (or lack thereof) has let you down.

One final worry: Your computer and/or storage devices may be subject to search. It may be better to not have your sensitive data with you if you're traveling by air. Consider storing your data in the cloud (online in encrypted form) or accessing it over a VPN when you need it.

Conclusions:

• It can be as important to protect your computer(s) from malware as it is to encrypt your data.
• If your sensitive data is on a computing device that is not always physically secure you need full disk encryption to keep sensitive data private.
• Device, folder or file encryption programs are adequate if you're merely transporting data on portable media, like CDs or DVDs, or storage devices, like external hard drives or USB thumb drives.

Note from the TrueCrypt manual:

"System [full disk] encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), hibernation files, swap files, etc., are always permanently encrypted (even when power supply is suddenly interrupted). Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and registry entries are always permanently encrypted as well."

Information on full disk encryption:

• 8 Reasons for Full Disk Encryption
• Bruce Schneier is a data-security expert, who recommends PGP Whole Disk Encryption program.
• full-disk-encryption.net
• Full-Disk Encryption Suites
• Comparison of disk encryption software
• Filesystem-level encryption