Re: Crypt questions

From: Roger Abell [MVP] (mvpNOSPAM@asu.edu)
Date: 06/30/02 

From: "Roger Abell [MVP]" <mvpNOSPAM@asu.edu>
Date: Sun, 30 Jun 2002 01:10:00 -0700

"M O J O" <m o j o @ n e w w e b s o l u t i o n s . d k> wrote in message
news:OXvgM2vHCHA.1632@tkmsftngp10...
> Hi,
>
> I hope you will find some time to answer my questions ... please :o)
>
will try

> I've never worked with Windows XP Pro encryption before, so please forgive
> my lack of knowledge.
>
we all start somewhere

> Here's my questions:
>
> 1) Is WinXP Pro excryption/decryption safe? I mean has it been hacked?
Not to my knowledge, but it seems likely that the default algorithm
is within reach of some agencies with mega CPU power.

> Buggy?
EFS in W2k and XP is not buggy.
However, there are some issues with what controls how
you can get a handle on what is needed to decrypt files
in XP (specifically, with what happens when an account's
password is changed). AFAIK these are fixed in XP SP1
and these can also be worked around in the English version.
>
> 2) I use a moveable (slave) harddrive to take my data from work to home.
If
> I encrypt data on this drive, will it be visible to both machines?
No. It will be encrypted and so not visible in the clear to all.
For the right account it can be decrypted if both accounts have
the correct certificate imported. If the machines are not both
XP (i.e. one is W2k) you will have some restrictions on what
algorithm you can use as there are more options here in XP
than in W2k. The default should work in both.
>
> 3) At work we have several laptops. If I encrypt the harddrives (NTFS) on
> these machines, will a theif be able to decrypt the data?
This depends. Are the machines in a domain or standalone, and
are they W2k or XP ? Also, if the machines are probed for
their SAM and the accounts brute cracked, then the thief can
just log in with existing accounts. In this case, local accounts
(non-domain) that have their certs in them will let them at the
encrypted data just as they would allow the valid account holder.
W2k standalone has some weakness, that can be prevented,
but present in the default state (take control of the default
recovery agent or remove the decryption key from the system).
XP in the default state no longer has this issue.
A secured environment would have the laptops with a recovery
agent defined and the decryption key removed, and the laptops
would require smartcard login when getting more extreme.
Given the above cares, and/or use of the machines in a domain,
there is very little the thief could do except throw time on a
supercomputer at attempting to get into the files.
>
> Thanks!!!!!!!!!
>
> Regards,
> M O J O

Relevant Pages

  • CryptoAPI cryptographic service provider (CSP) for this implementation could not be acquired during
    ... We are trying to encrypt and decrypt some fields using RSA ... Our environment has 5 machines and all the 5 machines have this key in ... The problem occurs when we run around 1000 successive requests for ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Rijndael decryption succeeds SOMETIMES
    ... while our dev machines are single proc. ... >> it to produce an crypto key, which is then used to encrypt and decrypt. ...
    (microsoft.public.dotnet.security)
  • Re: Local Accounts
    ... All 3 users had accounts on all 3 computers. ... Well maybe true but when the client machines were not in a domain we had sofware installed that we did not want to reinstall when on the domain. ... The local admin account can be useful for some system changes, ...
    (microsoft.public.windows.server.sbs)
  • Re: Disabling Interactive Logon Against Security Group
    ... Essentially this is to secure half a dozen guest accounts on domain of ... question "disable interactive logon privilages against specific OU/User ... Where I follow least privilege this is a total non-issue, as the machines ... If you set this in a GPO then the list that is to be denied that you ...
    (microsoft.public.security)
  • Re: Terminal release ip command?
    ... Apart from networking between the two machines right:-) ... pick up a single DHCP address from your ISP, ... DHCP IP addresses on your own private network and NAT taking care ... the case of free dial-up accounts where an ISP may create far more ...
    (comp.sys.mac.system)