<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Ioannis Vranos pravi: <blockquote cite="mid:4A6079AD.3090203@freemail.gr" type="cite"> <pre wrap="">Blaž Repas wrote: </pre> <blockquote type="cite"> <pre wrap="">Ioannis Vranos pravi: </pre> <blockquote type="cite"> <pre wrap="">Blaž Repas wrote: > </pre> <blockquote type="cite"> <pre wrap=""><a class="moz-txt-link-freetext" href="https://help.ubuntu.com/community/EncryptedFilesystemHowto">https://help.ubuntu.com/community/EncryptedFilesystemHowto</a> </pre> </blockquote> <pre wrap=""> I can't find any definite answer there for my question. </pre> </blockquote> <pre wrap="">[quote] OK, which encryption engines does the DeviceMapper support? You can choose all those provided by the crypto-modules of your kernel. The Ubuntu-Kernels come with the full set, including *Twofish, AES, DES and others.* Which of those engines should I choose? I recommend AES. It is reasonably fast and believed to be secure. Avoid DES, it is considered too weak to offer decent protection nowadays. How many bits should the key used by the algorithm have? This depends on your needs for security: A longer key is more secure, but it takes longer to de-/encrypt data using it. With a good crypto algorithm a attacker must use brute force: He has to generate each key and then has to try to unlock the encrypted data with it. So the number of possible keys directly gives the average time needed to break the encryption. So let us play a bit with some numbers: A 256bit key gives about 10^77 (a 1 followed by 77 zeros) different keys while a 128bit key has "only" about 10^38 (a 1 followed by 38 zeros). At the moment a PC can generate and test about 3*10^5 (3 followed by 5 zeros) keys per second. So breaking a 128bit key will take about 10^25 years (1 followed by 25 zeros), which is longer than the universe exists. That should be secure enough for most users. To understand how secure 128 bit keys are, you may read this analogy <a class="moz-txt-link-rfc2396E" href="http://www.interesting-people.org/archives/interesting-people/200607/msg00058.html"><http://www.interesting-people.org/archives/interesting-people/200607/msg00058.html></a> by Jon Callas: “Imagine a computer that is the size of a grain of sand that can test keys against some encrypted data. Also imagine that it can test a key in the amount of time it takes light to cross it. Then consider a cluster of these computers, so many that if you covered the earth with them, they would cover the whole planet to the height of 1 meter. The cluster of computers would crack a 128-bit key on average in 1,000 years.” Even if you don't believe that the NSA has another planet devoted to key cracking, you still may want to use a longer key. If a weakness in your chosen crypto-module is found, it may limit the keyspace that needs to be tested, and you will then have an effectivly shorter key. Using a 256 bit key will keep your data secure much longer if that should happen. [/quote] Hope this helps clearing up your question. And it was in the document, by the way ;-) :-D Have a nice day! </pre> </blockquote> <pre wrap=""> If I am not missing something, when we setup encrypted Private directory, or encrypted partition/encrypted home directory during installation, there are no options for choosing an algorithm. </pre> </blockquote> Hmmm.. interesting... I'll look around and maybe try it. But i guess it's one of the more common ones (3des, des, aes). Have a nice day! Blaž </body> </html>