4 ms·

TrueCrypt has portable volume images. It's nice to make a container on Mac OS and give it to a Windows user and know it will mount as a filesystem or drive.

by gcv 12y ago

tptacek 12y ago
This is an abuse of FDE. If you're moving archives from one OS to another, use userland file-level encryption. There are a bunch of reasons for this: you'll get better crypto primitives, you get cryptographic integrity protection (XTS can't offer that), and the crypto code you'll be using will be simpler and thus easier to audit.
- TheLoneWolfling 12y ago
  Can you give an example of a file encrypter / decryptor that has a portable version and is cross-platform? Also, file encryption / decryption fails massively for some things. What I want is something that implements a filesystem. As otherwise things with many files get... annoying. Not to mention less secure. If there's a better way to do this then let me know.
  - minopret 12y ago
    You can use 7zip to archive, compress, and AES-256 encrypt. You can also use GnuPG or openssl to encrypt a file or a disk image. Lately I took a look at actual filesystems for cross-platform use. I didn't find a great one, but depending on which OS you want to burden with an extra driver, pretty good ones include exFAT, NTFS, and UDF specifically version 2.01. Like you, I am curious whether better answers are available.
    - TheLoneWolfling 12y ago
      Again, those don't work for filesystem purposes. One of the nice things about TC is that it not only is cross-platform, but that it functions as an mountable directory across all of them.
  - __david__ 12y ago
    PGP/GPG.
    - TheLoneWolfling 12y ago
      Does GPG actually support mounting directories without installation?
  - gcv 12y ago
    When the brouhaha about TrueCrypt started, I wrote a zsh wrapper for "mounting" GPG-encrypted tarballs as directories: https://gist.github.com/gcv/b7d72023a851f2edf951 https://gist.github.com/gcv/b7d72023a851f2edf951 It works well as a TrueCrypt replacement for me personally, but has a couple of warts. Secure rm is slow on cleanup, and the user needs to be careful about the hidden files it uses to keep track of volume metadata.
    - TheLoneWolfling 12y ago
      > and is cross-platform That's not Windows-compatible, as far as I know. Still interesting though.
      - gcv 12y ago
        I consider the zsh scripts a proof-of-concept more than production code. It should be a relatively simple matter to rewrite the gpgd scripts in a portable manner, provided gpg and tar are available. I'm sure Windows has some kind of secure rm equivalent, too.

TrueCrypt has portable volume images. It's nice to make a container on Mac OS and give it to a Windows user and know it will mount as a filesystem or drive.

by gcv 12y ago

TrueCrypt has portable volume images. It's nice to make a container on Mac OS and give it to a Windows user and know it will mount as a filesystem or drive.

tptacek 12y ago

This is an abuse of FDE. If you're moving archives from one OS to another, use userland file-level encryption. There are a bunch of reasons for this: you'll get better crypto primitives, you get cryptographic integrity protection (XTS can't offer that), and the crypto code you'll be using will be simpler and thus easier to audit.

TheLoneWolfling 12y ago
Can you give an example of a file encrypter / decryptor that has a portable version and is cross-platform? Also, file encryption / decryption fails massively for some things. What I want is something that implements a filesystem. As otherwise things with many files get... annoying. Not to mention less secure. If there's a better way to do this then let me know.
- minopret 12y ago
  You can use 7zip to archive, compress, and AES-256 encrypt. You can also use GnuPG or openssl to encrypt a file or a disk image. Lately I took a look at actual filesystems for cross-platform use. I didn't find a great one, but depending on which OS you want to burden with an extra driver, pretty good ones include exFAT, NTFS, and UDF specifically version 2.01. Like you, I am curious whether better answers are available.
  - TheLoneWolfling 12y ago
    Again, those don't work for filesystem purposes. One of the nice things about TC is that it not only is cross-platform, but that it functions as an mountable directory across all of them.
- __david__ 12y ago
  PGP/GPG.
  - TheLoneWolfling 12y ago
    Does GPG actually support mounting directories without installation?
- gcv 12y ago
  When the brouhaha about TrueCrypt started, I wrote a zsh wrapper for "mounting" GPG-encrypted tarballs as directories: https://gist.github.com/gcv/b7d72023a851f2edf951 https://gist.github.com/gcv/b7d72023a851f2edf951 It works well as a TrueCrypt replacement for me personally, but has a couple of warts. Secure rm is slow on cleanup, and the user needs to be careful about the hidden files it uses to keep track of volume metadata.
  - TheLoneWolfling 12y ago
    > and is cross-platform That's not Windows-compatible, as far as I know. Still interesting though.
    - gcv 12y ago
      I consider the zsh scripts a proof-of-concept more than production code. It should be a relatively simple matter to rewrite the gpgd scripts in a portable manner, provided gpg and tar are available. I'm sure Windows has some kind of secure rm equivalent, too.