3 ms·

I don't think that's true. You definitely don't need a private key, you create a symmetric key from whatever randomness source you have, held in memory while yo

by x1798DE 10y ago

I don't think that's true. You definitely don't need a private key, you create a symmetric key from whatever randomness source you have, held in memory while you are using it to encrypt the data. The first thing you do is encrypt the symmetric key with the public key, then the rest of the data is encrypted as you go using the symmetric key. If you want to decrypt the data, you need the private key corresponding to the public key that this was encrypted with, but that can be left at home, but you never need it before that, so you can leave it at home if you want and you won't be able to access it until you get home.

dogma1138 10y ago
The DEK needs to be available in memory while the data is being encrypted on the fly e.g. being recorded, if it's encrypted already it's useless.
- x1798DE 10y ago
  Yes, the symmetric key (generated on the fly) is in memory while the data is being recorded, this is the case for every encryption technique. In the public/private scheme, once the symmetric key is no longer needed, you discard it permanently and files are only accessible using the private key, which you never had. A symmetric key is 256 bits, an HD video is on the order of hundreds of millions to billions of bits, so even if your public key crypto system were 100,000x slower than the symmetric crypto system, it's still going to be negligible compared to the cost of decrypting the remainder of the data. See https://en.wikipedia.org/wiki/Hybrid_cryptosystem https://en.wikipedia.org/wiki/Hybrid_cryptosystem For this reason, public/private key systems for data at rest is probably not particularly ineffcient relative to your suggestion of a symmetric FDE, plus it has the additional benefit that if you want to operate without the ability to decrypt data at rest, you have that option (by leaving the private key at home, since you only need the public key to write new data).

by x1798DE 10y ago

dogma1138 10y ago

The DEK needs to be available in memory while the data is being encrypted on the fly e.g. being recorded, if it's encrypted already it's useless.

x1798DE 10y ago
Yes, the symmetric key (generated on the fly) is in memory while the data is being recorded, this is the case for every encryption technique. In the public/private scheme, once the symmetric key is no longer needed, you discard it permanently and files are only accessible using the private key, which you never had. A symmetric key is 256 bits, an HD video is on the order of hundreds of millions to billions of bits, so even if your public key crypto system were 100,000x slower than the symmetric crypto system, it's still going to be negligible compared to the cost of decrypting the remainder of the data. See https://en.wikipedia.org/wiki/Hybrid_cryptosystem https://en.wikipedia.org/wiki/Hybrid_cryptosystem For this reason, public/private key systems for data at rest is probably not particularly ineffcient relative to your suggestion of a symmetric FDE, plus it has the additional benefit that if you want to operate without the ability to decrypt data at rest, you have that option (by leaving the private key at home, since you only need the public key to write new data).