DOCSLIB.ORG

Truecrypt Installation and Deployment

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Truecrypt Installation and Deployment TrueCrypt Installation and Deployment Academic Services Exeter IT Desktop Support TrueCrypt Installation and Deployment Document reference: DS035 Document type: Desktop Support Procedure Document status: Live Review period: Twelve months Next review date: 14 Dec 2013 DS035 - Truecrypt installation and deployment - v2.4 - Master.docx Page 1 of 16 TrueCrypt Installation and Deployment 1 TABLE OF CONTENTS 1 Table of Contents ........................................................................................................... 2 2 Document History .......................................................................................................... 3 2.1 Document location .................................................................................................... 3 2.2 Revision history ........................................................................................................ 3 2.3 Approvals .................................................................................................................. 3 2.4 Reviews .................................................................................................................... 3 3 Introduction .................................................................................................................... 4 4 Pre-installation Steps .................................................................................................... 4 4.1 Data backup ............................................................................................................. 4 4.2 Initial assessment of the machine / health check ...................................................... 4 4.3 Check disk configuration ........................................................................................... 4 4.4 chkdsk ...................................................................................................................... 4 4.5 Analyse and defragment disk .................................................................................... 5 4.6 Create rescue CD folder ........................................................................................... 5 5 Install the TrueCrypt Application .................................................................................. 6 6 Encryption ...................................................................................................................... 6 6.1 Re-encryption ......................................................................................................... 11 7 User Deployment Steps ............................................................................................... 11 7.1 Change user password ........................................................................................... 11 7.2 User awareness ...................................................................................................... 11 8 Recovery Procedures .................................................................................................. 12 8.1 Recovery of the original IT support password ......................................................... 12 8.2 Procedure for decrypting the hard drive .................................................................. 14 9 Technical Information .................................................................................................. 15 9.1 Limitations .............................................................................................................. 15 9.2 Possible issues ....................................................................................................... 15 9.3 Further reading ....................................................................................................... 15 10 Appendix – Recommended Windows Configuration ............................................. 16 11 Appendix – Naming Convention for Header Files .................................................. 16 DS035 - Truecrypt installation and deployment - v2.4 - Master.docx Page 2 of 16 TrueCrypt Installation and Deployment 2 DOCUMENT HISTORY 2.1 DOCUMENT LOCATION This document can be accessed from the following location: http://www.exeter.ac.uk/it/equipmentandsoftware/howto 2.2 REVISION HISTORY The latest revision can be found at the top of the list: Revision Date Author Version Summary of Changes Amended Encryption process, amended 14 Dec 2012 Rob Hatswell 2.4 Recovery procedure, minor changes to text 10 Oct 2011 Bill Lambert 2.3 Added re encryption information 9 May 2011 Paul Field 2.2 Fixed typo in one of the technical comments Minor tweaks, mostly cosmetic. Added some April 2011 Various 2.1 extra tips Additional sections added for user advice, data 25th February 2011 Various 2.0 recovery issues, windows configuration and header naming conventions. 2nd September 2010 Sue Watling 1.0 First live version 2.3 APPROVALS This document requires the following approvals: Name Title Version Date of approval Matt Coppell Incident Response Team Leader 2.4 14 Dec 2013 Paul Grogan Incident Response Team Leader 2.3 10 Oct 2011 Paul Grogan Incident Response Team Leader 2.2 9 May 2011 Paul Grogan Incident Response Team Leader 2.1 5 May 2011 Paul Grogan Incident Response Team Leader 2.0 25 March 2011 Paul Grogan Incident Response Team Leader 1.0 12 October 2010 2.4 REVIEWS This document was reviewed at the following dates with no updates required: Name Version Date of Review Notes DS035 - Truecrypt installation and deployment - v2.4 - Master.docx Page 3 of 16 TrueCrypt Installation and Deployment 3 INTRODUCTION This document is intended to be used by the University of Exeter’s Desktop Support staff and CDO’s supporting Colleges. It is to be used to guide the installation of TrueCrypt encryption software onto University-provided laptops. This document has been written to be applicable to the University’s recommended makes/models/builds of laptops running Windows XP SP3; however the software does support other versions of Windows and other Operating Systems. More information on supported Operating Systems can be found by visiting the link below. http://www.truecrypt.org/docs/?s=supported-operating-systems The instructions recommend encryption of the entire disk. 4 PRE-INSTALLATION STEPS For new PC deployments that have been imaged please skip to 4.5. 4.1 DATA BACKUP Confirm user has backed up their data including Outlook archive .pst files. If NOT, ensure their data is backed up to a removable device (e.g. External Hard Drive). 4.2 INITIAL ASSESSMENT OF THE MACHINE / HEALTH CHECK Technical staff to assess the machine, if deemed necessary re-image machine. Health check – look for any evidence of hardware faults, windows faults or traces of viruses/malware. Check Windows XP SP3 is installed. 4.3 CHECK DISK CONFIGURATION TrueCrypt may be installed on any PC that has been set up in the standard way (as described in the relevant DS documents). That is, one Windows Operating System fills the whole disk on a single partition. However, TrueCrypt may also be applied to any partition on a multi-partition disk, provided it does not have a “logical” partition. It must be a “primary” partition. If a whole-disk encryption is desired, and there are logical partitions, the contents of these partitions must be saved, the logical partitions deleted and replaced with primary partitions, and the content restored to these. 4.4 CHKDSK On older systems it’s advisable to run chkdsk /f /r before proceeding to encrypt the drive. This is to highlight damaged areas of the disk which could cause problems with the process. If any bad clusters etc. are found then further investigation is needed (software or hardware) before encryption can commence. DS035 - Truecrypt installation and deployment - v2.4 - Master.docx Page 4 of 16 TrueCrypt Installation and Deployment 4.5 ANALYSE AND DEFRAGMENT DISK Run Disk Defragmenter from ‘System Tools’ folder that can be found in the ‘Accessories’ folder via the ‘Start menu’. Analyse the C: drive. If the disk is partitioned analyse all other volumes as well. Defragment each partition if advised to do so by the application. Once all volumes are defragmented, exit Disk Defragmenter and reboot the machine. 4.6 CREATE RESCUE CD FOLDER During the installation sequence, you will be prompted to create a Rescue CD in the form of an .iso file (This CD is will be required to restore the original header). Ensure the account you are logged into has Administrator rights. Create a drive mapping to a server location where the Rescue CD information is to be stored. This should be an area accessed only by the IT Support team. Create a new folder, giving the folder the same name as the laptop (service tag – user’s name, e.g. B6YT998 – Minnie Mouse). This new folder will be used to store the Rescue CD .iso file. DS035 - Truecrypt installation and deployment - v2.4 - Master.docx Page 5 of 16 TrueCrypt Installation and Deployment 5 INSTALL THE TRUECRYPT APPLICATION If you have not done so, download and install TrueCrypt. Desktop Support Staff can find TrueCrypt on the Desktop Support shared drive. The latest stable version of TrueCrypt (version 7.1a) can be downloaded from http://www.truecrypt.org/downloads Start the setup of TrueCrypt and accept the licence At the next window headed ‘Wizard Mode’, make sure "Install" is selected and click “Next” At the next window headed ‘Setup Options’: Accept the default install location un-tick "Add TrueCrypt to Start menu" un-tick "Add TrueCrypt icon to desktop" This will hide the software from the user
Load more

Recommended publications
  • Operating System Boot from Fully Encrypted Device
    Masaryk University Faculty of Informatics Operating system boot from fully encrypted device Bachelor’s Thesis Daniel Chromik Brno, Fall 2016 Replace this page with a copy of the official signed thesis assignment and the copy of the Statement of an Author. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Daniel Chromik Advisor: ing. Milan Brož i Acknowledgement I would like to thank my advisor, Ing. Milan Brož, for his guidance and his patience of a saint. Another round of thanks I would like to send towards my family and friends for their support. ii Abstract The goal of this work is description of existing solutions for boot- ing Linux and Windows from fully encrypted devices with Secure Boot. Before that, though, early boot process and bootloaders are de- scribed. A simple Linux distribution is then set up to boot from a fully encrypted device. And lastly, existing Windows encryption solutions are described. iii Keywords boot process, Linux, Windows, disk encryption, GRUB 2, LUKS iv Contents 1 Introduction ............................1 1.1 Thesis goals ..........................1 1.2 Thesis structure ........................2 2 Boot Process Description ....................3 2.1 Early Boot Process ......................3 2.2 Firmware interfaces ......................4 2.2.1 BIOS – Basic Input/Output System . .4 2.2.2 UEFI – Unified Extended Firmware Interface .5 2.3 Partitioning tables ......................5 2.3.1 MBR – Master Boot Record .
    [Show full text]
  • Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives
    Self-encrypting deception: weaknesses in the encryption of solid state drives Carlo Meijer Bernard van Gastel Institute for Computing and Information Sciences School of Computer Science Radboud University Nijmegen Open University of the Netherlands [email protected] and Institute for Computing and Information Sciences Radboud University Nijmegen Bernard.vanGastel@{ou.nl,ru.nl} Abstract—We have analyzed the hardware full-disk encryption full-disk encryption. Full-disk encryption software, especially of several solid state drives (SSDs) by reverse engineering their those integrated in modern operating systems, may decide to firmware. These drives were produced by three manufacturers rely solely on hardware encryption in case it detects support between 2014 and 2018, and are both internal models using the SATA and NVMe interfaces (in a M.2 or 2.5" traditional form by the storage device. In case the decision is made to rely on factor) and external models using the USB interface. hardware encryption, typically software encryption is disabled. In theory, the security guarantees offered by hardware encryp- As a primary example, BitLocker, the full-disk encryption tion are similar to or better than software implementations. In software built into Microsoft Windows, switches off software reality, we found that many models using hardware encryption encryption and completely relies on hardware encryption by have critical security weaknesses due to specification, design, and implementation issues. For many models, these security default if the drive advertises support. weaknesses allow for complete recovery of the data without Contribution. This paper evaluates both internal and external knowledge of any secret (such as the password).
    [Show full text]
  • Zenworks 2017 Update 4 Troubleshooting Full Disk Encryption January 2019
    ZENworks 2017 Update 4 Troubleshooting Full Disk Encryption January 2019 This document provides troubleshooting guidelines for common problems related to ZENworks Full Disk Encryption. If, after completing the troubleshooting steps, the problem is not resolved, you should contact Technical Support (https://www.novell.com/support/) for additional help. 1 Windows PE Emergency Recovery Disk (ERD) is not working Make sure you have installed the correct WAIK architecture (32-bit vs 64-bit) (Windows 7 only) If you manually created the ERD, use the PowerShell script provided in the Cool Solutions “Windows Powershell script to create a Windows PE emergency recovery disk for ZENworks Full Disk Encryption” article. Try creating the ERD using the ADK for Windows instead of Windows AIK. See “Creating a Windows PE Emergency Recovery Disk” in the ZENworks Full Disk Encryption Emergency Recovery Reference. Try burning the ERD to a DVD rather than a CD. 2 Issues with PBA login or boot sequence After pre-boot authentication occurs, the BIOS or UEFI settings must be correctly set for Windows. With unusual DMI hardware configurations, the standard ZENworks PBA boot method and Linux kernel configuration used to provide the BIOS settings, might not work, resulting in hardware that does not function correctly or is not recognized by Windows. Beginning in ZENworks 2017 Update 2, the Full Disk Encryption Agent includes DMI menu options to repair the boot sequence for issues relating to these DMI configurations. This menu is accessible by using the Ctrl + G keyboard command at a brief point when Full Disk Encryption is shown during a device restart.
    [Show full text]
  • Disk Encryption with 100Gbe Crypto Accelerator
    Disk Encryption with 100GbE Crypto Accelerator Chelsio T6 vs. Intel AES-NI vs. Software Enabled Encryption Executive Summary Chelsio Crypto Accelerator is a co-processor designed specifically to perform computationally intensive cryptographic operations more efficiently than general-purpose CPUs. Servers with system load, comprising of cryptographic operations, see great performance improvement by offloading crypto operations on to the Chelsio Unified Wire adapter. Chelsio’s solution uses the standard crypto API framework provided by the operating system and enables the offloading of crypto operations to the adapter. This paper showcases the disk encryption acceleration capabilities of Chelsio T6 adapters by comparing its performance with Intel AES-NI and software encryption. Chelsio solution excels with 100Gbps Crypto rate performance for both encryption and decryption with less than 50% CPU usage. Chelsio’s T6 encryption solution assures complete data protection to datacenters, while providing substantial savings on CPU and memory. Chelsio Disk Encryption Offload The Terminator 6 (T6) ASIC from Chelsio Communications, Inc. is a sixth generation, high performance 1/10/25/40/50/100Gbps unified wire engine which offers crypto offload capability for AES and SHA variants. Chelsio’s disk encryption solution is a special case of data at rest protection where the storage media is a sector-addressable device. Chelsio offloads the AES-XTS mode, which is designed for encrypting data stored on hard disks where there is no additional space for an integrity field. AES-XTS builds on the security of AES by protecting the storage device from many dictionary and copy/paste attacks. Chelsio crypto driver registers with the kernel crypto framework with high priority and ensures that any disk encryption request is offloaded and processed by T6 adapter.
    [Show full text]
  • Speeding up Linux Disk Encryption Ignat Korchagin @Ignatkn $ Whoami
    Speeding Up Linux Disk Encryption Ignat Korchagin @ignatkn $ whoami ● Performance and security at Cloudflare ● Passionate about security and crypto ● Enjoy low level programming @ignatkn Encrypting data at rest The storage stack applications @ignatkn The storage stack applications filesystems @ignatkn The storage stack applications filesystems block subsystem @ignatkn The storage stack applications filesystems block subsystem storage hardware @ignatkn Encryption at rest layers applications filesystems block subsystem SED, OPAL storage hardware @ignatkn Encryption at rest layers applications filesystems LUKS/dm-crypt, BitLocker, FileVault block subsystem SED, OPAL storage hardware @ignatkn Encryption at rest layers applications ecryptfs, ext4 encryption or fscrypt filesystems LUKS/dm-crypt, BitLocker, FileVault block subsystem SED, OPAL storage hardware @ignatkn Encryption at rest layers DBMS, PGP, OpenSSL, Themis applications ecryptfs, ext4 encryption or fscrypt filesystems LUKS/dm-crypt, BitLocker, FileVault block subsystem SED, OPAL storage hardware @ignatkn Storage hardware encryption Pros: ● it’s there ● little configuration needed ● fully transparent to applications ● usually faster than other layers @ignatkn Storage hardware encryption Pros: ● it’s there ● little configuration needed ● fully transparent to applications ● usually faster than other layers Cons: ● no visibility into the implementation ● no auditability ● sometimes poor security https://support.microsoft.com/en-us/help/4516071/windows-10-update-kb4516071 @ignatkn Block
    [Show full text]
  • The Growing Impact of Full Disk Encryption on Digital Forensics
    digital investigation 8 (2011) 129e134 Available online at www.sciencedirect.com journal homepage: www.elsevier.com/locate/diin The growing impact of full disk encryption on digital forensics Eoghan Casey a,*, Geoff Fellows b, Matthew Geiger c, Gerasimos Stellatos d a cmdLabs, 1101 E. 33rd Street, Suite C301, Baltimore, MD 21218, United States b LG Training Partnership, United Kingdom c CERT, United States d CACI International, United States article info abstract Article history: The increasing use of full disk encryption (FDE) can significantly hamper digital investi- Received 16 March 2011 gations, potentially preventing access to all digital evidence in a case. The practice of Received in revised form shutting down an evidential computer is not an acceptable technique when dealing with 17 September 2011 FDE or even volume encryption because it may result in all data on the device being Accepted 24 September 2011 rendered inaccessible for forensic examination. To address this challenge, there is a pressing need for more effective on-scene capabilities to detect and preserve encryption Keywords: prior to pulling the plug. In addition, to give digital investigators the best chance of Digital forensics obtaining decrypted data in the field, prosecutors need to prepare search warrants with Full disk encryption FDE in mind. This paper describes how FDE has hampered past investigations, and how Hard drive encryption circumventing FDE has benefited certain cases. This paper goes on to provide guidance for Volatile data gathering items at the crime scene that may be useful for accessing encrypted data, and for Memory forensics performing on-scene forensic acquisitions of live computer systems.
    [Show full text]
  • The Future of Digital Forensics
    Royal Holloway Information Security Thesis Series | The future of digital forensics The future of digital forensics Investigators have three avenues of attack to use when tackling the complexities of full disk encryption by Nia Catlin, MSc in information security (Royal Holloway) and Lorenzo Cavallaro, ISG, Royal Holloway THINKSTOCK Royal Holloway Information Security Thesis Series | The future of digital forensics The future of digital forensics in the era of full disk encryption Full disk encryption presents a theoretically insurmountable challenge for digital forensics, but authorities still have three avenues of attack for attempting to analyse protected devices. Anti-forensic countermeasures pose a developing challenge, however by Nia Catlin and Lorenzo Cavallaro In the past, forensics relied on artifacts left behind on a suspect’s computer, an intimate knowledge of all the nooks and crannies in which incriminating evidence may be hidden, the tendency of criminals to fail even to attempt to assume they will not be caught, and the failure of criminals to cover their tracks. Unfortunately for digital forensic investigators, their work constitutes a physical security breach, and the use of full disk encryption can be as effective at preventing them carrying out that work as it is at preventing a laptop thief from stealing passwords. The severe consequences of the exposure of corporate and customer data have led to the development of user-friendly and very secure full disk encryption. Moreover, the fear of device theft has led to its widening adoption. Most of the encryption algorithms – when used correctly – are considered unbroken for practical purposes, so authorities trying to analyse such a protected device are left with three avenues of attack: key search, live forensic acquisition and forced key disclosure.
    [Show full text]
  • Dell EMC Unity: Data at Rest Encryption a Detailed Review
    Technical White Paper Dell EMC Unity: Data at Rest Encryption A Detailed Review Abstract This white paper explains the Data at Rest Encryption feature, which provides controller-based encryption of data stored on Dell EMC™ Unity storage systems to protect against unauthorized access to lost or stolen drives or system. The encryption technology as well as its implementation on Dell EMC Unity storage systems are discussed. June 2021 H15090.6 Revisions Revisions Date Description May 2016 Initial release – Unity OE 4.0 July 2017 Updated for Unity OE 4.2 June 2021 Template and format updates. Updated for Unity OE 5.1 Acknowledgments Author: Ryan Poulin The information in this publication is provided “as is.” Dell Inc. makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any software described in this publication requires an applicable software license. This document may contain certain words that are not consistent with Dell's current language guidelines. Dell plans to update the document over subsequent future releases to revise these words accordingly. This document may contain language from third party content that is not under Dell's control and is not consistent with Dell's current guidelines for Dell's own content. When such third party content is updated by the relevant third parties, this document will be revised accordingly. Copyright © 2016-2021 Dell Inc. or its subsidiaries. All Rights Reserved. Dell Technologies, Dell, EMC, Dell EMC and other trademarks are trademarks of Dell Inc.
    [Show full text]
  • Cybersecure Features of the MBX1 Platform
    Whitepaper Cybersecure features of the MBX1 platform © OMICRON Page 1 of 5 Content 1 Secure Customized Unified Extensible Firmware Interface (UEFI) ..................................................3 2 Secure Crypto-Processor .....................................................................................................................3 3 Secure and Measured Boot ..................................................................................................................3 4 Full disk encryption ...............................................................................................................................3 5 Processes execute with Least Privileges ...........................................................................................3 6 Secure by default ...................................................................................................................................3 7 Authenticated firmware upgrades .......................................................................................................4 8 Effective isolation of the Windows PC from the system under test. ................................................4 © OMICRON 2019 Page 2 of 5 1 Secure Customized Unified Extensible Firmware Interface (UEFI) The MBX1 utilizes a customized modern UEFI which supports Secure Boot (refer to section 3). The UEFI of each MBX1 is secured with a unique password and is only accessible by OMICRON support. 2 Secure Crypto-Processor The MBX1 is equipped with a discrete ISO/IEC 11889 compliant Trusted
    [Show full text]
  • File Encryption
    IRON RULES PROTECT ALL OF YOUR DEVICES AND DATA Encryption Encryption* adds another layer of protection around your data, and should be used if the data is sensitive. There are a number of encryption standards available applying different algorithms while encrypting data/devices; confidential info should be protected with the 256-bit AES or above – see pg 2 for advice. *What is Encryption renders your data into an unreadable format, therefore without the encryption? knowledge of the encryption key an unauthorised access attempt could not get hold of any usable information. The intent is to maintain your data confidentiality and integrity (as the main elements of InfoSec) when it’s at rest or in transit. When do you It depends on the nature of data whether encryption is needed; confidential data and need it? sensitive personal information in the context of UK Data Protection Act should be encrypted if held outside LSE network. How can it be Encryption could be applied to both the data files, and devices accessing such data. applied? You need to set your encryption key while encrypting the data files/devices. An encryption key is the password used to decrypt the encrypted data or devices. Any encryption is only as strong as the password chosen. IRON RULES PROTECT ALL OF YOUR DEVICES AND DATA 7zip (http://www.7-zip.org/) as a compression tool can create zipped archives with 256-bit AES encryption, which can be opend on PCs or Macs Axcrypt (http://www.axantum.com/a.xcrypt/Downloads.html) can provide 128-bit AES encryption, which can be opened on PCs but not Macs Window’s Encrypting File System (EFS) (http://windows.microsoft.com/en-gb/windows/what-is-encrypting-file- File system#1TC=windows-7) provides AES and 3DES encryption (not secure prior to Windows 7) encryption Mac users can also download iZip (http://www.izip.com/) which can provide 256-bit AES encryption to zipped archives.
    [Show full text]
  • Anti-Forensics: the Rootkit Connection for Black Hat USA 2009
    [Black Hat USA 2009] Anti-Forensics: The Rootkit Connection Black Hat USA 2009 Conference Proceedings Anti-Forensics: The Rootkit Connection Bill Blunden Principal Investigator Below Gotham Labs www.belowgotham.com Abstract Conventional rootkits tend to focus on defeating forensic live incident response and network monitoring using a variety of concealment strategies (e.g. hooking, detour patching, covert channels, peer-to-peer communication, etc.). However, the technology required to survive a post-mortem analysis of secondary storage, which is just as vital in the grand scheme of things, recently doesn’t seem to have garnered the same degree of coverage. In this paper, we’ll examine different approaches to persisting a rootkit and the associated anti-forensic tactics that can be employed to thwart an investigator who’s performing an autopsy of a disk image. 1 | Below Gotham Labs [Black Hat USA 2009] Anti-Forensics: The Rootkit Connection Contents Introduction 4 Post-Mortem Dance Steps 5 Worst-Case Scenario 6 Strategies for the Worst Case 7 Disk Analysis: Tactics and Countermeasures 9 Defense in Depth 9 Forensic Duplication 10 Reserved Disk Regions 10 Recovering File System Objects 10 Full Disk Encryption 10 File System Attacks 11 File concealment 11 Out-of-Band Concealment 11 In-Band Concealment 13 Application Layer Concealment 15 Recovering Deleted Files 16 File Wiping 16 Meta-Data Shredding 17 Encryption 17 Key Management 17 Collecting File Meta Data 18 Altering Checksums 18 Modifying Timestamps 19 Identifying Known Files 20 Injecting
    [Show full text]
  • Optimizing Dm-Crypt for XTS-AES: Getting the Best of Atmel Cryptographic Co-Processors
    Optimizing dm-crypt for XTS-AES: Getting the Best of Atmel Cryptographic Co-processors Levent Demir1;2, Mathieu Thiery1;2, Vincent Roca1, Jean-Michel Tenkes2 and Jean-Louis Roch3 1Incas ITSec, France 2Univ. Grenoble Alpes, Inria, France 3Univ. Grenoble Alpes, Grenoble INP, LIG, France Keywords: Full Disk Encryption, XTS-AES, Linux dm-crypt Module, Cryptographic Co-processor, Atmel Board. Abstract: Linux implementation of Full Disk Encryption (FDE) relies on the dm-crypt kernel module, and is based on the XTS-AES encryption mode. However, XTS-AES is complex and can quickly become a performance bot- tleneck. Therefore we explore the use of cryptographic co-processors to efficiently implement the XTS-AES mode in Linux. We consider two Atmel boards that feature different cryptographic co-processors: the XTS- AES mode is completely integrated on the recent SAMA5D2 board but not on the SAMA5D3 board. We first analyze three XTS-AES implementations: a pure software implementation, an implementation that leverages the XTS-AES co-processor, and an intermediate solution. This work leads us to propose an optimization of dm-crypt, the extended request mode, that enables to encrypt/decrypt a full 4kB page at once instead of issu- ing eight consecutive 512 bytes requests as in the current implementation. We show that major performance gains are possible with this optimization, a SAMA5D3 board reaching the performance of a SAMA5D2 board where XTS-AES operations are totally offloaded to the dedicated cryptographic co-processor, while remaining fully compatible with the standard. Finally, we explain why bad design choices prevent this optimization to be applied to the new SAMA5D2 board and derive recommendations for future co-processor designs.
    [Show full text]