Password Protecting Sd Cards In Pandora

[Kramy]

Oh my... this thread is long, and favours the hard(er) way of doing things.

Simple:
1) Install TrueCrypt.
2) Format SD card to FAT32.
3) Use Truecrypt to create an encrypted file on the partition.
4) Mount encrypted file as a drive letter in Windows.

It's all GUI, and is remarkably easy to pull off.

Might be a tad more difficult on the linux end, but I'm sure someone can tell you how to make a script that that mounts the truecrypt file as a folder, whenever you insert it.

Encrypting the FS on the fly cripples performance in every benchmark I've seen, so expect any data accesses to hammer the processor and be roughly 1/8th the speed they normally are.

On my Win2k box, my old Raptor dropped from ~95MB/sec read to ~80MB/sec read after encrypting my partition. Not exactly performance murdering, although I can't speak for how it affects Linux.

 

[lulzfish]

On my Win2k box, my old Raptor dropped from ~95MB/sec read to ~80MB/sec read after encrypting my partition. Not exactly performance murdering, although I can't speak for how it affects Linux.

Also, all that data has to be decrypted by the processor first, rather than just going straight into RAM.
For a handheld device like the Pandora, this is going to slow it down much more than a desktop PC.

 

[Kramy]

Also, all that data has to be decrypted by the processor first, rather than just going straight into RAM.
For a handheld device like the Pandora, this is going to slow it down much more than a desktop PC.

I was under the impression the CPU was involved in "disk" I/O anyway. But you are correct - memory bandwidth is precious, and this could slow it down far more than it would a desktop computer.

 

[Enverex]

Also, all that data has to be decrypted by the processor first, rather than just going straight into RAM.
For a handheld device like the Pandora, this is going to slow it down much more than a desktop PC.

I was under the impression the CPU was involved in "disk" I/O anyway. But you are correct - memory bandwidth is precious, and this could slow it down far more than it would a desktop computer.

Right, but now it's involved in disk I/O AND has to encrypt/decrypt everything on the fly adding much more load.

 

[dflemstr]

Oh my... this thread is long, and favours the hard(er) way of doing things.

Simple:
1) Install TrueCrypt.
2) Format SD card to FAT32.
3) Use Truecrypt to create an encrypted file on the partition.
4) Mount encrypted file as a drive letter in Windows.

It's all GUI, and is remarkably easy to pull off.

Might be a tad more difficult on the linux end, but I'm sure someone can tell you how to make a script that that mounts the truecrypt file as a folder, whenever you insert it.

Encrypting the FS on the fly cripples performance in every benchmark I've seen, so expect any data accesses to hammer the processor and be roughly 1/8th the speed they normally are.

On my Win2k box, my old Raptor dropped from ~95MB/sec read to ~80MB/sec read after encrypting my partition. Not exactly performance murdering, although I can't speak for how it affects Linux.

TrueCrypt works exactly the same way on Linux (It has a GUI! Fancy that!) but I recommended LUKS because it can be multiple times faster, have better and more secure key storage than TrueCrypt (for example, with TrueCrypt, someone *will* be able to break into your Pandora if you have suspended it (you know, suspend-to-ram or suspend-to-disk), but you can prevent this with LUKS), and LUKS is generally more integrated than TrueCrypt.

There are also multiple frontends for LUKS on Linux, so you probably won't have to use the CLI to open the device; you can just double click on it in a file browser and there will be a dialog that asks for your password. Easy. No need for complicated external programs.

 

[Kramy]

TrueCrypt works exactly the same way on Linux (It has a GUI! Fancy that!) but I recommended LUKS because it can be multiple times faster, have better and more secure key storage than TrueCrypt (for example, with TrueCrypt, someone *will* be able to break into your Pandora if you have suspended it (you know, suspend-to-ram or suspend-to-disk), but you can prevent this with LUKS), and LUKS is generally more integrated than TrueCrypt.

There are also multiple frontends for LUKS on Linux, so you probably won't have to use the CLI to open the device; you can just double click on it in a file browser and there will be a dialog that asks for your password. Easy. No need for complicated external programs.

That sounds good. Just as long as there's also a GUI for his (presumably) Windows PC.

Hehe... good thing for me Suspend to RAM doesn't work on my Windows box.

 

[id10t]

Has anyone actually compiled truecrypt for the ARM processor yet?

 

[Grench]

Isn't it possible to just encrypt a directory structure instead of an entire partition?

And how does GPG fit into this?

 

[lulzfish]

Isn't it possible to just encrypt a directory structure instead of an entire partition?

And how does GPG fit into this?

With TrueCrypt, yes. That's why I have a number of ".avi" files that are actually encrypted collections of videos.
I don't know how GPG works, though. I'm not interested enough in crypto to investigate multiple programs. It's the kind of thing I could see using a GUI for.

 

[dflemstr]

Isn't it possible to just encrypt a directory structure instead of an entire partition?

Yes, via e.g. EncFS which is a FUSE-based file system. It will, when mounted, put everything that you put in its mount point in another directory, encrypt the file and obfuscate the name. So, if you use "encryptedfolder" as the "source directory", and "decryptedfilder" as the mount point, "decryptedfolder/bla.jpg" will be encrypted and copied to "encryptedfolder/26hahm34mfdj3.d32k" (And the folders stay in sync so both files are removed when one of them is removed).
The disadvantage to using this system is that files are encrypted separately, so an attacker can count the number of files you have, find a specific file s/he's looking for by file size, and focus the attack on that file. With LUKS, this isn't possible, since an encrypted drive is homogeneously encrypted.

And how does GPG fit into this?

Not at all, why would it? No communication is happening save for via the south bridge of your computer. GPG is only useful for encrypting stuff when it is being transported either via an untrusted medium or to an untrusted recipient/from an untrusted sender. You use it for e-mail or data signing or the like. Not for general file storage.

 

[valhalla]

(...)
I recommend you check out Truecrypt (www.truecrypt.org). It is opensource and you can easily encrypt your usb harddrive with it for exemple. There are version for linux, mac and windows.

Just so you know, it isn't GPL licence but uses the "TrueCrypt Collective License". That's the reason why it's not included in the Ubuntu repository I believe. Nothing to worry too much about though if you want my opinion (and you can get .deb package)

No, TrueCrypt isn't opensource nor freesoftware, even if they claim it to be so: it's license hasn't been approved by wither OSI nor FSF, and major distributions consider it too imprecise, so they don't feel they can safely distribute it.

Also, it's authors are unknown, and this isn't exactly something that inspires confidence in crypto software.

 

[daniel3000]

Hi all,
has anyone compiled Truecrypt for Pandora yet?

Thanks
Daniel