Security of EFS (Was: cached Domain Password on Notebook, secure? )

From: Rowan.Smith@csiro.au
Date: 02/24/02 

From: Rowan.Smith@csiro.au
To: focus-ms@securityfocus.com
Date: Mon, 25 Feb 2002 09:36:21 +1100

I have read a number of documents on the security of EFS and have come to the following conclusion but have not been able to verify it due to a lack of tools available:

EFS is secure if you use Syskey (with strong password/pass phrase) on W2K for the following reasons:

        syskey encrypts the component of the registry that stores the certificate.
        Without the syskey password it is not possible to decrypt the certificate.
        It is easy to change the users password by injecting a old-style hash into the SAM, when W2K starts.
        But still without the SysKey password you can not get to the EFS certificate

EFS is not secure if you:

        Do not use syskey with a password and use it as a default install, which is password stored in the registry.
        It is easy to change a users password which then gives access to the certificate because it is automatically decrypted with syskey.
        I am also dubious of the security of the certificate if you hibernate, as the certificate would be written out (clear-text?) to disk as part of the memory dump.

The syskey password should be long (> 25 Characters) to ensure that a brute force attack on the registry keys would be expensive.

My own experiments have shown that as of W2K SP1+EncryptPack the limit to a syskey password was 32 Chars anything over this was ignored. This may change with later releases I have not tested.

If anyone has information to the contary with regard to the above I would be keen to hear?

-Rowan

Relevant Pages

  • Re: Windows XP Folder/File Encryption
    ... Only you can answer if it is worth doing. ... EFS is very secure if properly used. ... If a file is removed and the encryption keys are not available, ... See the links near the bottom of this page for more information about EFS: ...
    (microsoft.public.windowsxp.general)
  • Re: How do I encrypt a whole (external) USB harddisc (under Win2000 and WinXP)?
    ... EFS has more pitfalls than it returns in benefits. ... EFS is very secure, so much ... consider a simple backup to another magnetic media as adequate. ... > Occasionally I connect an external USB harddisc to my computer in order to ...
    (microsoft.public.windowsxp.general)
  • Re: EFS and trojan horses
    ... Trojan horses are rather uncommon and are not the first thing I would be ... are free firewalls, ... EFS if not properly secured has some security issues that may make it not ... very secure in some instances. ...
    (microsoft.public.security)
  • RE: Does W2K hold users email, EFS etc private key securely ?
    ... Everything depends on whether you are implementing EFS via GPO or locally, ... a secure hard disk area (at least ... Does W2K hold user's email, EFS etc private key securely? ... prompted for a separate passphrase to protect this key. ...
    (Focus-Microsoft)
  • Re: Ultra secure and user friendly file sharing on Server 2003?
    ... It doesn't look like that addresses network sniffing. ... think EFS is user friendly enough for the people who need to use it. ... All access needs to be audited and it needs to be secure from network ... to do FTP transfers etc.) ...
    (microsoft.public.windows.server.general)