3 ms·

I think there are some situations where there might be a difference: ones where the adversary does not know for sure whether the data exists. For example, supp

I think there are some situations where there might be a difference: ones where the adversary does not know for sure whether the data exists. For example, suppose you work in the IT department of a law firm, something fishy is going on and you want to be a whistle blower, and you need a way to exfiltrate some evidence. You are getting rid of some obsolete laptops, and standard procedure is to wipe the drives before selling them. Management has its suspicions about you because you've been asking too many questions. So they get another IT person to check the drives you were supposed to wipe. If the drives have the data on them with a LUKS header, you've been caught (or at least they think you were too lazy to wipe the drives). If it's indistinguishable from random data, then you've given them no reason to suspect you.

marcinzm 6y ago
Sure in that scenario but I feel that's an edge case scenario. More commonly a machine you use is acquired by an adversary. Thus the machine is expected to have a working installed OS on it. If that laptop lacks an un-encrypted partition then the adversary will assume it is encrypted. They don't need to mathematically prove it.
na85 6y ago
If I suspected an employee was up to something and they wanted to dispose of old laptops, I would send another employee to physically destroy the drives with a drill or a saw.
phkamp 6y ago
This scenario suffers from what I call "IT-Dude-Syndrome". IT-Dude-Syndrome is when IT-people come up with scenarios which hinge on "IT-Dude" being smarter than everybody else in the whole world. First, if you're suspected of anything in a law firm, you're out until the issue is resolved, you don't get to "destroy old laptops" or anything of that sort. In a high-security operation you don't even get to touch a laptop, and you will be handed a loaner-phone, while your own phone is turned off, signed, sealed and stored in a safe until the matter is resolved. Second, if "standard procedure" in that law firm is to "wipe the drives before selling them", that law firm is not following best, or even minimum, security practices for the business they are in, and that is what the whistle-blower should report to the relevant authority. Third and most significant, IT-dude is smarter than the obviously junior IT-dude called in to "check the drives" IT-dude "were supposed to wipe" ? You know what, he's not. In such scenario you can be damn sure, that whoever is called in to check is several levels smarter than IT-dude. And you know what super-IT-Dude will do when she see the disks full of high entropy data ? She will point to the final step in the official procedure for wiping disks, which is to write all zeros to the entire media to prove that there is nothing hidden. She will write in the report that IT-dude did not follow a trivial procedure to the letter, and point out that the most likely, in fact the only credible, explanation for skipping a trivial step in the procedure, was that IT dude were trying to exfiltrate data.
viraptor 6y ago
> If it's indistinguishable from random data, then you've given them no reason to suspect you. It depends on the IT person really, your company, and your opsec. Does your shell history contain luks commands? Are your logs clean from any trace of mounting? Are dirty blocks on the disk free of that data too? Are your machines centrally managed with logs shipped out? Do your local logs look like they've been only continuously appended to, or are there likely uneven rewrites? Does your system contain encryption software you're not using in normal operation? If you really want to hide that information, the encryption itself looks like the smallest issue.

marcinzm 6y ago

Sure in that scenario but I feel that's an edge case scenario. More commonly a machine you use is acquired by an adversary. Thus the machine is expected to have a working installed OS on it. If that laptop lacks an un-encrypted partition then the adversary will assume it is encrypted. They don't need to mathematically prove it.

na85 6y ago

If I suspected an employee was up to something and they wanted to dispose of old laptops, I would send another employee to physically destroy the drives with a drill or a saw.

phkamp 6y ago

This scenario suffers from what I call "IT-Dude-Syndrome". IT-Dude-Syndrome is when IT-people come up with scenarios which hinge on "IT-Dude" being smarter than everybody else in the whole world. First, if you're suspected of anything in a law firm, you're out until the issue is resolved, you don't get to "destroy old laptops" or anything of that sort. In a high-security operation you don't even get to touch a laptop, and you will be handed a loaner-phone, while your own phone is turned off, signed, sealed and stored in a safe until the matter is resolved. Second, if "standard procedure" in that law firm is to "wipe the drives before selling them", that law firm is not following best, or even minimum, security practices for the business they are in, and that is what the whistle-blower should report to the relevant authority. Third and most significant, IT-dude is smarter than the obviously junior IT-dude called in to "check the drives" IT-dude "were supposed to wipe" ? You know what, he's not. In such scenario you can be damn sure, that whoever is called in to check is several levels smarter than IT-dude. And you know what super-IT-Dude will do when she see the disks full of high entropy data ? She will point to the final step in the official procedure for wiping disks, which is to write all zeros to the entire media to prove that there is nothing hidden. She will write in the report that IT-dude did not follow a trivial procedure to the letter, and point out that the most likely, in fact the only credible, explanation for skipping a trivial step in the procedure, was that IT dude were trying to exfiltrate data.

viraptor 6y ago

> If it's indistinguishable from random data, then you've given them no reason to suspect you. It depends on the IT person really, your company, and your opsec. Does your shell history contain luks commands? Are your logs clean from any trace of mounting? Are dirty blocks on the disk free of that data too? Are your machines centrally managed with logs shipped out? Do your local logs look like they've been only continuously appended to, or are there likely uneven rewrites? Does your system contain encryption software you're not using in normal operation? If you really want to hide that information, the encryption itself looks like the smallest issue.