How secure is W2K/WXP EFS?

[Magicthyse]

EFS - Encrypting File System that is.

I'm wondering if it's practically usable, or whether it can be easily cracked.

 

[Woodchuck2000]

Depends on the encryption you're using. Windows users either 52bit or 128bit encryption, and both are secure. Why would you need it anyway?

 

[Magicthyse]

IRS?

😀


I'd be using the 128bit version.

The question is, how susceptible would data be after say a server gets stolen? Would it be be at all possible for any decently-equipped party (say someone who has a few million to blow) to recover the data on the server which has been encrypted in EFS?

 

[Nothinman]

From MS' site:

EFS uses a randomly-generated symmetric key to encrypt file data. A new key is generated for each file that is encrypted. The data encryption algorithm that is used is DESX (a stronger version of Data Encryption Standard). No other algorithms can be configured.

The symmetric encrypting key is then encrypted using the public key derived from your EFS certificate. The resulting encrypted data, along with your display name and a hash of the certificate, is stored in a named stream in the file that contains EFS metadata. When EFS decrypts a file, it uses your private key to decrypt the symmetric encrypting key. EFS then uses the symmetric key to decrypt the data.

 

[Magicthyse]

Hmmmm... Not entirely sure what that means but is teh key recovereable?

 

[n0cmonkey]

Originally posted by: Magicthyse
Hmmmm... Not entirely sure what that means but is teh key recovereable?

You can back it up if thats what you are asking.

 

[Woodchuck2000]

Someone <could> crack it, given an awful lot of CPU time. But It'd be very tough.

 

[mikecel79]

Yes make sure you backup that key otherwise if you format any encrypted file will be lost. Oh yeah and you should know that using EFS will slow down opening of those files significatly.

 

[Woodie]

The encryption routines are quite strong, and because the key is unique for each file, brute force attacks are impractical.

That said, the weakness of EFS is the default configuration, which leaves the Recovery key right on the computer, where it can be (relatively) easily obtained by an attacker with physical access to the machine.

Read the FAQ here, and follow MS's recommendations:
1. BACKUP your private key on external media!!!
2. Backup the recovery key (default=Administrator or in a domain DOMAIN\Administrator) on external media!!!
3. Remove the recovery key from the Recovyer Agent (RA) on the machine.***
4. BACKUP your private key on external media!!!
5. Secure both private keys (RA + User) in different places. (Don't forget the passwords, either)
6. Don't try to encrypt ANY system files, including autoexec.bat.
7. BACKUP your private key on external media!!!
8. Be careful encrypting TEMP directories...applications that are installing may write files there, and then move the files. The encryption goes with the files, so no other users can access the binaries. 🙁
9. Do NOT encrypt \Docs & Settings\USERID--that encrypts the key, so you can't load it!
10. Did I mention: BACKUP your private key on external media!!!
11. Do encrypt \Docs & Settings\USERID\My Documents.

 

[NogginBoink]

Read Q223316 and understand it.

If you're in a domain environment, the recovery key is not on the local machine.

EFS can be *very* secure. The only known method of attacking it is through a brute force attack against the entire keyspace, which is computationally unfeasable for most, if not all, attackers.