Hello and welcome to this fundamentals of cryptography course and the previous video we talked about,
one of the applications up symmetric encryption, namely ensuring the security of bulk data in transit
as it moves through a network.
In this video, we're going to be talking about the security of data rest and how symmetric encryption
can be used for secure data storage.
We'll start out this discussion by talking about the why and why it's important that we encrypt data
at rest to protect it against data leaks, exfiltration, et cetera.
After that, we'll talk about why symmetric encryption is a good solution for performing encryption
of data at rest, sitting on our devices when not at use.
And finally, we'll talk about some of the security challenges associated with full disk encryption,
namely how it's possible for an attacker to get access to the secret key used to protect the data on
a encrypted device.
And so let's get started by talking about the why of secure data storage.
You're probably aware people are increasingly dependent on mobile devices instead of desktop computers,
servers, etc. We're using laptops, smartphones, tablets, smartwatches, all of these very small,
very powerful and very portable devices.
And while the portability of these devices is useful, it also makes it easy for them to be lost or
stolen.
You take out a laptop to a coffee shop, you're working there and it's entirely possible for someone
to snatch it and run off.
And so what happens that.
If someone has physical access to your device, it's possible to read the data stored in its memory.
Full disk encryption can help to eliminate this risk by ensuring that someone with physical access to
the device can't use it or get access to any of the data that it contains unless they've got your password.
And so full disk encryption is implemented using symmetric encryption and symmetric encryption is actually
an ideal solution for full disk encryption.
It's more efficient than symmetric cryptography, as we talked about in the previous video.
And this data source and destination are the same.
One of the big challenges with symmetric cryptography for securing data in transit is you need to make
sure that both the sender and the recipient have the same secret key, which requires establishing a
secure channel for sending that key in advance of the transmission with data at rest.
You're the data starting and ending at the same location on your computer or phone.
And so there's no need for that secure channel to share the data from the sender to the recipient.
And so how full disk encryption normally works is the data on the device is encrypted with a secret
key.
And that secret key is stored, encrypted on the device using the user's password.
So when you authenticate to the computer, the password is transformed into a decryption key, which
decrypts the secret key, which decrypts the device.
And so this makes it possible for all of the data on the device to be decrypted for use after a user
authenticates to the system.
But when they're not logged in, everything's stored by default in an encrypted state.
And so this is all well and good, but sick full disk encryption is not a perfect security solution.
And the reason why is that encryption so is dependent on the security of the secret key.
And there's one simple way that this secret key can be compromised.
If you're using a weak password or one that you've put on a sticky note on your computer, then it's
not going to be that hard for an attacker to learn that password and authenticate successfully to the
system decrypting your data.
But let's assume that your mobile phone password isn't zero zero zero zero or something similar if that's
the case.
There still are potential ways for an attacker to defeat full disk encryption.
One of these is taking advantage of cold boot attacks without getting too deep into the technical details.
Your temporary randt memory, random access memory and Deran is designed to store data for a short period
of time.
But unless after your computer's been shut down, that memory is suppose to be wiped.
Essentially, the electrical charge stored in it goes away.
Over time, however, it goes away more slowly.
If the device is cold, meaning physically placed in a freezer or similar cold environment.
And so it's possible to take advantage of this by an attacker.
If they take your phone, put it in an ice box and then try to read the information stored on RAM or
DRM, because somewhere in that memory is the encryption key to decrypt your laptop.
And so if that's the case, then it's possible to extract the key after you've turned off the laptop
and everything's encrypted, allowing them to decrypt the drive.
However, this makes the assumption that they can take your laptop and get it in a freezer quickly enough
that the memory doesn't degrade.
And so definitely some assumptions there.
A potentially more realistic threat to full disk encryption is taking memory dumps of virtual machines,
and so virtual machines are computers that are running on other computers like cloud computing.
And so as virtual machines become more common, it's more likely that you might have a full disk encryption
system running on a VM.
If that's the case, then a VM running on a host machine is completely accessible from the host machine.
All of the memory that the VM has is actually memory on the host machine.
Therefore, if an attacker takes over that host and reads through its memory, it might find the decryption
key for the full disk encryption solution used on the guests to be.
And so, honestly, both of these situations probably aren't going to affect you or your smartphone.
However, it's useful to think about ways that encryption can be bypassed.
Things like code boot attacks that then try to use memory dumps to find encryption keys are examples
of side channel attacks, which are attacks that work outside of the crypto system.
Instead of breaking the algorithm, you find something, whether it's power, emissions or timing,
delays, et cetera, that affect how securely the data is processed and an attacker's ability to steal
the secret key.
And so these are also another good reason why you don't want to implement your own cryptography, because
trying to write your own cryptography without putting in protections against cold boot attacks or VM
memory dumps or side channel attacks increases the probability that your application using encryption
could be compromised by an attacker.
Much better to use an accepted solution that has built-In protections if they exist for any applicable
attacks.
And so this concludes this discussion of the use of symmetric encryption for secure data storage and
more generally.
Our discussion of symmetric encryption in this course, in the next section, instead of videos, we're
going to be talking about asymmetric or public key cryptography, how it works.
Algorithms used and their applications.
Thank you.