Masaryk University Faculty of Informatics Encrypted disk unmount using personalized audio instruction Bachelor’s Thesis Matúš Jarkovič Brno, Fall 2019 Replace this page with a copy of the official signed thesis assignment anda copy of the Statement of an Author. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out on my own. All sources, references, and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Matúš Jarkovič Advisor: RNDr. Dušan Klinec i Acknowledgements Firstly, I would like to express my deepest appreciation to my su- pervisor, RNDr. Dušan Klinec, for all of the suggestions, advice and guidance he provided me throughout the implementation and thesis creation. Secondly, I would like to thank my family that supported me dur- ing the studies. They have provided a very pleasant environment and the thesis would not be possible without them. Lastly, but most importantly I would like to express sincere gratitude to my beloved girlfriend who took care of me at all times. iii Abstract This thesis provides a brief overview of the most popular free open source storage encryption solutions as well as keyword spotting (KWS) systems. It mainly focuses on a basic functionality and highlights main features of these programs. Furthermore, a description of the most used types of storage encryption technologies is included. The goal of the practical part is to extend a disk encryption software VeraCrypt with a KWS system. For this task a tool named Mycroft Precise is used. The main task consists of the integration of these components including a two way communication between them, usage and testing. The purpose of the KWS is to continuously run in the background, process the input speech and notify the main application if user’s pre-defined keyword is spotted. If such event occurs, each mounted volume is immediately dismounted. iv Keywords storage encryption technologies, disk encryption, keyword spotting, audio processing, open source, cryptography, VeraCrypt, Mycroft Precise v Contents Introduction 1 1 Storage Encryption 3 1.1 Symmetric Cryptography ...................4 1.2 Asymmetric Cryptography ..................5 2 Types of Storage Encryption Technologies 7 2.1 Full/Whole Disk Encryption .................7 2.2 Volume/Virtual Disk Encryption ..............8 2.3 File/Folder Encryption ....................9 3 The Most Popular Encryption Software 11 3.1 VeraCrypt ........................... 11 3.1.1 Volume Encryption . 12 3.1.2 System Encryption . 12 3.1.3 Plausible Deniability . 13 3.1.4 Acceleration and Optimization . 14 3.1.5 Encryption and Hashing . 15 3.2 Cryptomator .......................... 15 3.2.1 Security . 16 3.2.2 Encryption and Hashing . 17 3.3 7-Zip ............................. 17 3.3.1 Encryption . 18 3.4 BitLocker ........................... 18 3.4.1 Additional Tools . 18 3.4.2 Security . 19 3.4.3 Encryption . 20 3.5 FileVault ............................ 20 3.5.1 Security . 20 3.5.2 Encryption and Disk Images . 21 3.6 Dm-crypt, LUKS and Cryptsetup .............. 21 3.6.1 Security and Encryption . 22 3.6.2 Plain Dm-crypt Mode . 24 4 Keyword Spotting Software 27 4.1 Mycroft Precise ........................ 29 vii 4.2 PocketSphinx ......................... 30 5 Implementation 31 5.1 Keyword Spotting System .................. 31 5.2 Preparation .......................... 31 5.3 Integration .......................... 33 5.4 Dependencies ......................... 34 5.5 Limitations and Future Work ................. 34 5.6 Testing and Recommendations ................ 36 Conclusion 39 Bibliography 41 A Usage Manual 45 B The source code 47 viii List of Figures 1.1 Encryption using Modes of Operation [7] 4 1.2 Symmetric Cryptography [10] 5 1.3 Asymmetric Cryptography [10] 5 2.1 Boot Sequence for FDE 8 2.2 Full Disk Encryption [13] 8 2.3 Volume Disk Encryption [13] 9 3.1 Hidden Volume [14] 13 3.2 Hidden Operating System [14] 15 3.3 LUKS partition layout [26] 22 3.4 LUKS partition header layout [27] 23 3.5 LUKS key slot layout [27] 24 4.1 HMM topology[35] 29 5.1 Main Window 32 5.2 Dismount Window 35 5.3 Reset Window 35 ix Introduction The development of information technologies in past few decades has brought a lot of new options which affects everyday life to a high degree, fortunately, mostly in a positive way. One of such inventions is the ability to interact with devices using speech. It has been a highly demanded function since it’s introduction mainly because of the sim- plicity and comfort it brings for the users. The goal of this thesis is to implement a keyword spotting system into a generally approved disk encryption software VeraCrypt. It is a free open source application which is supported by all main platforms. The program is able to securely store the user data on a media device. Thus, preventing the potential attacker from accessing sensitive infor- mation. The theoretical part provides an overview of the most popular disk encryption solutions and KWS systems freely available. The implemented KWS system, if configured, is continuously lis- tening and processing the audio input from the microphone. When a keyword is detected, VeraCrypt dismounts all of the mounted vol- umes and destroys the key materials used for the data decryption. Therefore, encrypting all of the vulnerable decrypted data. This ex- tension also provides a simple interface for interaction with the KWS system module. The text is divided into five individual chapters. The first chapter provides a brief overview of the available encryption types. The second chaper then covers the technologies which can be used for the storage encryption. Chapter three focuses on the most popular disk encryption solutions while chapter four is a summary of the KWS systems. Finally, the last chapter describes the implementation part of the thesis. 1 1 Storage Encryption Storage encryption software is a type of security program that uses cryptography for protecting data stored on media device from unau- thorized access. Software-based encryption is the most commonly used due to its economic feasibility and flexibility. Nevertheless, it has some drawbacks and limitations such as degrading of system perfor- mance, higher power consumption and can be potentially less secure [1]. It hides the true meaning of the data using various encryption algorithms also known as ciphers [2]. These algorithms depend on a key which is used to modify the data. A symmetric key is a sequence of random bits which is used when encrypting plain text or decrypting cipher text. These keys are generated by the encryption program usually by a key derivation function (KDF). It is an essential component of every cryptographic system [3]. An example of a KDF can be the Password-based Key Derivation Function 2 (PBKDF2). It’s purpose is to take multiple parameters and derive one or more cryptographically strong keys from this input. User’s password in combination with salt, number of iterations and some kind of pseudorandom function (PRF), for example hash-based message authentication code (HMAC) serve as parameters [4]. All these variables are basically applied by the PBKDF2 to the password. The recommended number of iterations are given by standards. These are constantly changing with increasing speeds of central pro- cessing units (CPU) as the iterations increases the processing power needed for brute-force1 (dictionary) attacks. On the other hand, the salt provides better protection against rainbow table2 attacks. Salt is a random data that is added to the password to make the password hash unique. To ensure that the salt is really random and do not de- pend on the internal state of computer, hardware-based noise sources such as microphone input, camera noise or most commonly mouse movements are used. Two major categories of encryption algorithms currently exist, sym- metric and asymmetric [5, 6]. Each of them has unique features that 1. https://en.wikipedia.org/wiki/Bruteforce_attack 2. https://en.wikipedia.org/wiki/Rainbow_table 3 1. Storage Encryption make them adequate for certain tasks. Despite having two completely different types, many times their combination also called hybrid en- cryption is practical. The most common usage is to encrypt the data via symmetric encryption and the symmetric key, used for the data encryption, with asymmetric encryption. 1.1 Symmetric Cryptography Symmetric cryptography [6] or shared secret encryption uses the same key for encrypting and decrypting the data. It is the older technique from the two mentioned. Generally speaking, symmetric key encryp- tion is much more efficient in time and storage requirements than asymmetric. Therefore, it is the one which is used when it comes to encryption of data stored on the media. The symmetric key encryption methods are divided into block ciphers or stream ciphers. Block ciphers, which use constant blocks length, are employed in disk encryption. Encrypting/decrypting a sector is achieved by dividing it into blocks matching the ciphers block size. Applying the cipher to each block separately would not be secure because the same plaintext always produces the same ciphertext. The mode of operation using this method is named electronic codebook (ECB). This mode is very problematic and is not recommended to use. The main problem is that it does not hide data patterns very well which can be seen in the Figure 1.1[7]. This could lead to potential data leaks. Figure 1.1: Encryption using Modes of Operation [7] A possible solution for this problem is using other modes of oper- ation such as cipher-block chaining (CBC), counter (CTR) and many 4 1. Storage Encryption others. The most popular and standardized mode of operation for disk encryption is Xor-encrypt-xor (XEX)-based tweaked-codebook with ciphertext stealing (XTS)[8]. These modes ensure that each block is mathematically related to another block.