Wikipedia

Comparison of disk encryption software

This is an old revision of this page, as edited by Intgr (talk | contribs) at 16:35, 27 December 2006 (→Features: column annotations). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Technical feature comparison of different disk encryption software.


Background information

Name Developer Introduced date Licensing Operating system support Development status
BestCrypt Jetico 1993 Commercial, limited source code Linux 2.6, Windows NT-based, Windows 9x, Windows 3.1, MS-DOS Maintained
PGPDisk PGP Corporation 1998 Commercial, closed source? Windows NT-based, Mac OS X Maintained
GBDE Poul-Henning Kamp 2002-10-19[1] Free, open source (BSD) FreeBSD 4.11+ Maintained?
cryptoloop ? 2003-07-02[2] Free, open source (GPL) Linux 2.5-2.6 Deprecated, known vulnerabilities
CGD ? 2003-08-14[3] Free, open source (BSD) NetBSD 2.0+ Maintained?
TrueCrypt TrueCrypt Foundation 2004-02-02[4] Free, open source (custom) Linux 2.6, Windows NT-based Actively developed
dm-crypt/cryptsetup ? 2004-03-11[5] Free, open source (GPL) Linux 2.6 Actively developed
FreeOTFE Sarah Dean 2004-10-10[6] Free, open source (custom) Windows NT-based, Pocket PC Actively developed
dm-crypt/LUKS Clemens Fruhwirth 2005-02-05[7] Free, open source (GPL) Linux 2.6 Actively developed
GELI Pawel Jakub Dawidek 2005-04-11[8] Free, open source (BSD) FreeBSD 6.0+ Maintained?

Features

  • Hidden containers: Whether hidden containers can be created for deniable encryption. Note that some modes of operation can be more prone to watermarking attacks than others.
  • Pre-boot authentication: Whether authentication can be required before booting the computer, thus allowing one to encrypt the boot disk.
  • Custom authentication: Whether arbitrary byte strings can be supplied as keys programmatically, that can be coupled with third party authentication mechanisms.
  • Multiple keys: Whether an encrypted volumes can have more than one active keys.
  • Passphrase strengthening: Whether key strengthening is used with plaintext passwords to frustrate dictionary attacks.
  • Hardware acceleration: Whether dedicated cryptography acceleration extension cards can be taken advantage of.
Name Hidden containers Pre-boot authentication Custom authentication Multiple keys Passphrase strengthening Hardware acceleration
BestCrypt Yes No No ? ? No
PGPDisk No Yes[9] ? Yes Yes[10] ?
GBDE No No[11] Yes Yes[12] No[12] No[11]
cryptoloop No Yes[13] Yes No No Yes
CGD No No Yes[14] Yes[15] Yes[16] ?
TrueCrypt Yes No No No Yes No
dm-crypt/cryptsetup No Yes[13] Yes No No Yes
FreeOTFE Yes No No No Yes No
dm-crypt/LUKS No Yes[13] Yes Yes Yes Yes
GELI No Yes[11] Yes Yes[17] Yes[17] Yes[11]

Layering

Further information: Encryption layer in storage stack
  • Whole disk: Whether the whole disk can be encrypted, including the partition tables. Note that this does not imply that the encrypted disk can be booted off of; refer to "pre-boot authentication" in the features comparison table.
  • Partition: Whether individual disk partitions can be encrypted.
  • Logical volume: Whether individual logical volumes can be encrypted.
  • File: Whether the encrypted container can be stored in a file (usually implemented as encrypted loop devices).
  • Swap space: Whether the swap space (called a "pagefile" on Windows) can be encrypted individually/explicitly.
Name Whole disk Partition Logical volume File Swap space
BestCrypt No ? No Yes Yes
PGPDisk Yes Yes ? Yes No
GBDE Yes Yes Yes ? Yes
cryptoloop Yes Yes Yes Yes Yes
CGD Yes Yes Yes No[16] Yes
TrueCrypt No No No Yes No
dm-crypt Yes Yes Yes Yes[18] Yes
FreeOTFE No Yes ? Yes No
GELI Yes Yes Yes ? Yes

Modes of operation

Further information: Disk encryption theory
Name Plain CBC[19] CBC with ESSIV LRW Random per-sector keys
BestCrypt Yes No No No
PGPDisk ? ? ? ?
GBDE No No No Yes[12]
cryptoloop Yes No No No
CGD Yes[20] No No No
TrueCrypt Yes No Yes[21] No
dm-crypt Yes Yes Yes[22] No
FreeOTFE Yes Yes No No
GELI No Yes[23] No No

Notes and references

  1. ^ "gbde(4) man page in FreeBSD 4.11". GBDE manual page as it appeared in NetBSD 4.11. Retrieved 2006-12-24.
  2. ^ Initial cryptoloop patches for the Linux 2.5 development kernel: http://uwsg.iu.edu/hypermail/linux/kernel/0307.0/0348.html
  3. ^ "cgd(4) man page in NetBSD 2.0". CGD manual page as it first appeared in NetBSD 2.0. Retrieved 2006-12-24.
  4. ^ "TrueCrypt version history". Retrieved 2006-12-24.
  5. ^ dm-crypt was first included in Linux kernel version 2.6.4: http://lwn.net/Articles/75404/
  6. ^ "FreeOTFE version history". Retrieved 2006-12-24.
  7. ^ Clemens Fruhwirth. "LUKS version history". Retrieved 2006-12-24.
  8. ^ "geli(8) man page in FreeBSD 6.0". GELI manual page as it first appeared in FreeBSD 6.0. Retrieved 2006-12-24.
  9. ^ "PGP Whole Disk Encryption FAQ". PGP Corporation. Retrieved 2006-12-24.
  10. ^ PGP private keys are always protected by strenghtened passphrases
  11. ^ a b c d "FreeBSD Handbook: Encrypting Disk Partitions". Retrieved 2006-12-24.
  12. ^ a b c Poul-Henning Kamp. "GBDE - GEOM Based Disk Encryption" (PDF). GBDE design document. Retrieved 2006-12-24.
  13. ^ a b c dm-crypt and cryptoloop volumes can be mounted from the initrd before the system is booted
  14. ^ Poul-Henning Kamp (2005-03-02). "FUD about CGD and GBDE". freebsd-hackers mailing list post. Retrieved 2006-12-24.
  15. ^ Federico Biancuzzi (2005-12-21). "Inside NetBSD's CGD". interview with Roland Dowdeswell. ONLamp.com. {{cite web}}: Text "accessdate-2006-12-24" ignored (help)
  16. ^ a b Roland C. Dowdeswell, John Ioannidis. "The CryptoGraphic Disk Driver" (PDF). CGD design paper. Retrieved 2006-12-24.
  17. ^ a b "geli(8) man page in FreeBSD-current". GELI manual page in current FreeBSD. Retrieved 2006-12-24.
  18. ^ dm-crypt can encrypt a file-based volume when used with the losetup utility included with all major Linux distributions
  19. ^ "Plain CBC" means that the CBC initialization vectors are statically derived from the sector number and and not secret; that is, they are re-used when overwriting a sector and can easily be guessed by an attacker.
  20. ^ "man 4 cgd in NetBSD-current". NetBSD current manual page on CGD. 2006-03-11. Retrieved 2006-12-24.
  21. ^ New containers created with TrueCrypt versions 4.1 and up use LRW, old containers use plain CBC
  22. ^ Starting with Linux kernel version 2.6.20, CryptoAPI supports the LRW mode: http://lwn.net/Articles/213650/
  23. ^ "Linux/BSD disk encryption comparison". Retrieved 2006-12-24.


See also

 

This cryptography-related article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=Comparison_of_disk_encryption_software&oldid=96758997"