 ENCRYPTION vs WINDOWS®
   - AN INTRODUCTORY TUTORIAL -

US export controls limit the workfactor ("cracking" resistance) of encryption that can be provided by globally marketed software.  Responsible firms comply by overtly leaking enough bits of the otherwise-too-strong encryption key.  Less responsible marketers merely use a weak cipher (encryption algorithm). This has led to less than full disclosure about what does, or does not, constitute strong encryption software.

The unintentional covert leaks in the Windows® operating system pose even greater threats.  Forensic software exploits those leaks for computer evidence recovery in law enforcement; for discovery in litigation; and for industrial espionage.  It can bypass any encryption, unless the cryptosystem includes specific functions to plug those leaks.

Many encryption software products, though they encrypt with strong ciphers, do not include such functions.  They were designed for e-mail COMmunications SECurity between secure systems, rather than for secure data storage on unsecure systems.

The underlying architecture of all Windows® PCs makes it fundamentally impossible for add-on products to transform one into a secure system. You can cryptographically secure your data, but only if the encryption can't be bypassed by forensic software.

The following tutorials outline our approach to the design of high-grade cryptosystems for the security-hostile Windows® environment, and guidelines for their secure use.

INFOSEC and WINDOWS®
COMPUSEC
TRUSTED SYSTEMS
CRYPTOGRAPHIC SECURITY
CRYPTOGRAPHIC STANDARDS
IMPLEMENTATION
OPERATING SYSTEM

CRYPTOSYSTEMS and KEYS
CODES  and CIPHERS
MODERN CIPHERS
DATA ENCRYPTION STANDARD
TRIPLE-DES CIPHER
EXPORT CONTROLS
KEY GENERATION

PASSPHRASES
VULNERABILITIES
YOUR CHOICE
SHARED SECRET  KEY SHARES

WINDOWS® SECURITY LEAKS
DELETE  DOESN'T
DEFRAGMENTING
DIGITAL SCRAPS
WRITE-BEHIND  CACHE LEAKS
FILENAME LEAKS
THE SWAPFILE
UNAUTHORIZED COPIES
SYSTEM CRASHES

CONFIGURING YOUR SYSTEM
YOUR TEMP  SPACE
YOUR SWAPFILE
OPERATIONAL SECURITY

Cerberus Systems, Inc. develops, manufactures and markets
software cryptosystems designed to meet or exceed level 1 of
FIPS PUB 140-1 on Windows® PCs.

The Cerberus logo and the ...Security Manager product names are trademarks of Cerberus Systems, Inc.
©Copyright 1997, all rights reserved


INFOSEC and Windows®
                        CHAPTER 1
         INFOSEC and WINDOWS®

The NSA's National Cryptologic School defines information security, or INFOSEC as a risk management program, of both technical and operational measures, taken to counter threats to sensitive information's confidentiality, integrity or availability.

COMPUSEC

INFOSEC concerning Computer Systems Security, or COMPUSEC is the responsibility of NSA's National Computer Security Center (NCSC).

NOTE:  The National Security Agency/Central Security Service is responsible for Signals Intelligence (SIGINT), including  Communications Intelligence, or COMINT.  In addition to traffic analysis, COMINT includes breaking the codes and ciphers used to protect targeted communications.  Cryptology, the science which underlies such cryptanalysis, also underlies the design of secure codes and ciphers - cryptography.  Thus, NSA also has the mission of providing cryptographic technology for Communications Security, or COMSEC.  COMSEC includes protecting data in transit between computer systems, and since cryptography can also be used to protect data while it's on a computer system, NSA is responsible for the combination of COMSEC and COMPUSEC - INFOSEC.

NCSC is responsible for certifying software operating systems that may be used in Automated Information Systems, or AISs.  This aids the accreditation of an AIS for a specific program's DoD Classified or Sensitive But Unclassified (SBU) information.

Access to DoD Classified information must be limited to individuals who both possess the appropriate Personal Clearance Level (PCL; i.e. Confidential, Secret or Top Secret/EBI/SBI), and have been Indoctrinated for that program.

NOTE:  The most sensitive information is compartmented, to restrict access to those indoctrinated for its program.  This has led to the popular misconception that there are "classifications higher than Top Secret."  Instead, each program has a Classified code name, consisting of a pair of randomly generated words, like Fragrant Emerald and an unclassified digraph, like BK.  Security personnel can check access lists to see if someone is cleared for Program BK, without themselves being cleared for need to know  Fragrant Emerald information (or the name, itself).  The fact that they have a Top Secret (TS) PCL, even if Fragrant Emerald is a TS program, doesn't permit them to see such data.

Such SCI (Sensitive Compartmented Information) or Special Access Programs may require more frequent repetitions of a person's Extended or Special Background Investigation to maintain his/her clearance.  The costs of such EBI/SBI investigations, and those of various INFOSEC measures, are weighed against the costs of compromise.  A 1991 Navy INFOSEC planning form listed nominal per-incident costs of $10,000 for Privacy Act data, $100,000 for Secret and $1,000,000 for generic Top Secret, in a hierarchy that extended further upwards to SIOP-ESI, SCI and National Cryptologic.

SBU information is a broad category of all other information whose security the US Government has a legal obligation to protect (under 15 USC 271-278h, for instance).

NOTE:  SBU information includes Federal Reserve FedWire funds transfers, DoD For Official Use Only (FOUO) information, Privacy Act data and proprietary information.

TRUSTED SYSTEMS

Under NCSC's Trusted Computer Systems Evaluation Criteria (DOD 5200.28-STD), Windows® operating systems are Class D, the lowest of its seven levels.

NOTE:  The increasing levels of "trust" in DOD 5200.28-STD are D, C1, C2, B1, B2, B3 and A.  Win3.1, Win3.11, WFW3.11 and Win95 are Class D.  WinNT 3.51 is certified as Class C2, as long as it's used on a PC with no floppy drive, no network or modem connection, and physical security measures adequate to maintain that configuration.

Even an AIS with a B2- or B3-certified operating system could fail accreditation for a particular program's sensitive information.  Nevertheless, Windows® PCs can even be accredited for Top Secret/SCI and similar Special Access Programs, if used in Dedicated Mode per DOD 5220.22-M.  The key is the embedding of the AIS in a physically and operationally secure environment while it contains sensitive data.

The DOS/Windows® architecture makes it fundamentally impossible for any software to deny a knowledgeable attacker access to a PC's system resources.

NOTE:  Commercial access control software which modifies the DOS/Windows® Master Boot Record on your hard disk can be circumvented by the copy of an MBR that accompanies the basic DOS files on an "emergency boot diskette."  BIOS passwords can be reset with jumpers or by shorting your CMOS setup memory's battery.  Removing the floppy drive can defeat these kinds of attacks on your system.  However, any  Windows® (or DOS) system can read your hard disk's data files.  One loaded with the kind of software used by law enforcement agencies can read files that you "deleted."  Consequently, any means of system access control can be made irrelevant by disconnecting your disk controller cable and reconnecting one from another PC (or laptop).  Any adversary who's unconcerned with your discovering such an attack can just steal your hard drive.

Consequently, add-on products cannot ensure COMPUSEC for a Windows-based system.  However, it is possible to cryptographically control access to your data.

CRYPTOGRAPHIC SECURITY

The only way you can protect your data while it's in use on an unsecure computer system is through physical and operational security measures.   The only way you can guarantee your data's availability is by the disciplined use of data back-ups to a (non-physically-co-located) secure storage medium.

However, high-grade encryption can protect your data's confidentiality from being compromised when your system is outside your operational or physical security perimeter.  Encryption can also enable you to determine whether your data's integrity has been compromised by tampering.

Such encryption obviously requires strong (export-controlled) ciphers.  In addition, however, such encryption must be implemented in a high-grade cryptosystem that doesn't allow the operating system to circumvent the security of the encryption, and that doesn't compromise availability.

When combined with physical and operational security for your PC (and for your person), disciplined use of a high-grade software cryptosystem can provide high-level INFOSEC for your high-value data.

NOTE:  Disciplined use is not universal use.  If you feel that it's important to deny anyone else access to your particular copy of a publically available application program, our software cryptosystems are not for you.  They (and we) do not support mass-encryption of executables, dynamic link libraries and virtual device drivers.  Universal encryptors that intervene between Windows® and your disk may prevent your back-up software from working.  Decryption delays in accessing their various components can crash some programs, or Windows® itself.  More importantly, such disadvantages of mindless over-encrypting can discourage your using encryption to protect your high-value data files.  Our software cryptosystems are specifically designed to provide you with minimal discouragement from their proper use, within the limits of good INFOSEC practices.

CRYPTOGRAPHIC STANDARDS

Effective encryption requires strong ciphers (e.g. triple-DES), that are performed by a securely implemented cryptographic engine.  That cryptographic engine must meet the applicable standards for such ciphers; for their secure implementation; and for their secure modes of use (e.g. FIPS PUBs 46-2, 74 and 81).

Such a cryptographic engine must be integrated with secure key-generation, access control, and file overwriting functions (to standards like ANSI X9.17, FIPS PUB 180-1 and DOD 5220.22-M), to create a high-grade cryptosystem.

A high-grade cryptosystem must meet the Security Requirements for Cryptographic Modules (FIPS PUB 140-1).  It must not leak keying information or exhibit the other implementation insecurities covered by that standard's Derived Test Requirements.

A high-grade software cryptosystem must perform automatic self-tests, to verify its own integrity and assure its user that it remains free from tampering.

IMPLEMENTATION

A high-grade cryptosystem must be designed from the ground up.  Products originally designed to handle un-encrypted data may be riddled with security leaks;  adding encryption functions to them gives a false sense of security.  If products are globally marketed, US export controls will limit their encryption to weak ciphers.

NOTE:  Software to "crack" Lotus 1-2-3®, Lotus Symphony®, MS Excel®, MS Word®, Quattro Pro®, Quicken® and WordPerfect® encrypted files is available for from $99 to $185 from CRAK Software (http://www.crak.com on the Internet) and AccessData ("AccessData's software recovers passwords for PKZip, WinZip, Word, Excel, WordPerfect, Lotus1-2-3, Paradox, Q&A, Quattro-Pro, Ami Pro, Approach, QuickBooks, Act!, Access, Word Pro, dBase, Symphony, Outlook, Express, MSMoney, Quicken, Scheduler+, Ascend, Netware, and Windows NT server/workstation" - http://www.accessdata.com).  Non - export - controlled "encryption products" are similarly crippled.  Avoiding such products is not difficult with a little study, by leaving "secret design features" and "new encryption algorithms" for the unwary.  (See Matt Curtin's Encryption Snake Oil FAQ at http:// www.interhack.net / people / cmcurtin / snake-oil-faq.html )

Its implementation must not purchase your data's confidentiality at the expense of its integrity or its availability.  Power transients or system crashes in mid-encryption must not damage your data.  Encryption must not interfere with back-up software.

NOTE:  Our software cryptosystems are specifically designed to not interfere with the backup process, unlike automatic disk-encryptors.  They are also designed to avoid corrupting data if interrupted in mid-encryption by system crashes, whether such crashes are due to power transients or to Windows® reaction to what it perceives as other programs' Illegal Operations or General Protection Faults.

Pre-packaged, generic high-level software building blocks used to minimize programming effort can leak your passphrase.  Encryption software that directly uses passwords as keys, rather than using one-time keys from a cryptographically strong key generator, provides increased opportunity for cryptanalytic attack.

Such cryptosystem implementations are weak, regardless of the strength of the cipher used in the actual encryption subroutines.

OPERATING SYSTEM

Even without such implementation flaws, no cryptosystem can guarantee your data's security if your operating system bypasses it by writing extra copies of un-encrypted plaintext data into various locations on your hard disk.

The Windows® operating system can leak partial or complete copies of sensitive data around the strongest encryption.  These copies are readily scavanged with the forensic software used by law enforcement agencies and by data recovery specialists in legal discovery for law suits.  Such software is readily available to others, as well.

Any high-grade cryptosystem claiming the ability to protect your sensitive data on a Windows® PC must also provide the specific functions needed to plug those leaks.  Only such a cryptosystem can really offer Windows®-compatible encryption.

The following sections address the design and use of software cryptosystems to secure your data, even though you can't secure your system.  >>

Cerberus Systems, Inc. develops, manufactures and markets
software cryptosystems designed to meet or exceed level 1 of
FIPS PUB 140-1 on Windows® PCs.

The Cerberus logo and the ...Security Manager product names are trademarks of Cerberus Systems, Inc.
©Copyright 1997, all rights reserved


Cryptosystems and Keys
                        CHAPTER 2
      CRYPTOSYSTEMS and KEYS

By definition, a cryptosystem is the combination of three elements: an encryption engine, keying information, and operational procedures for their secure use.

In order to cryptographically secure high-value data on a hard disk (or on back-up media), it is necessary to employ a high-grade cryptosystem: one which even an attacker possessing both a copy of your encryption engine and knowledge of your operating procedures cannot break without your keying information.

NOTE:  A low-grade cryptosystem is one which an attacker can break by means of purely cryptanalytic attacks on the ciphertext  it produces, but which may delay him long enough for the period of time during which the corresponding plaintext  that it encrypted has value.  A medium-grade cryptosystem is one which cannot be broken in a useful time without the attacker possessing a copy of the encryption engine, which he can use in chosen plaintext attacks to help recover your key.  Both are useful in COMmunications SECurity, but they are of limited value in protecting data which must be stored  in encrypted form.

High-grade encryption has no "short cuts" to breaking it with less expense than would be required to repeatedly try decryption with different key values until one works. Its strength hinges on the degree to which an attacker cannot predict that certain values are more probable than others through knowledge of the key generation process.

CODES and CIPHERS

A code is a system of symbolic replacements for phrases, words and letters.  Its security can require maintaining the confidentiality of a large amount of data (e.g., a code-book).  If the lexical elements replaced are individual characters of an alphabet, rather than entire words, that burden is reduced. A letter-by-letter code is a cipher.

Julius Caesar encrypted his military field reports by replacing each letter of the Latin alphabet with the letter three characters farther down the list, "wrapped-around" by repeating after letter 'Z'.  ASCII text data is represented with an alphabet of sequential bytes.  Thus, in terms of the modern Roman alphabet, encryption in this Caesar cipher is merely the wrap-around (modulo-26) adding of three to each byte of plaintext data.

It's "key" is three, the modulo-26 list-number of the letter 'D'.  This can be generalized by using any number from 0 to 25 ('A' to 'Z').  Decryption is modulo-26 adding of 26-minus-the-key to each letter; this is the same as modulo-26 subtracting the key.

This simple monoalphabetic substitution cipher can be broken by "brute forcing" its 5-bit key; i.e. creating up to 26 different shifted messages until one makes sense.

To strengthen it against such exhaustive keysearch attacks, you could allow use of any scrambling (permutation) of the 26 letters as a substitution alphabet, not limiting yourself to the 26 shifted alphabets.  This many possible alphabets enlarges the key to an 89-bit number (26-factorial).  However, it can't defeat cryptanalytic attacks.

Any monoalphabetic substitution cipher can be broken by comparing the relative frequencies of occurrence of the letters in intercepted ciphertext samples with the corresponding statistics for letters in plaintext examples of related writings.

The fact that such cryptanalysis can break any monoalphabetic substitution cipher with much less effort than exhaustive keysearch attacks means that monoalphabetic substitution ciphers can never provide high-grade encryption.

MODERN CIPHERS

You could sequentially use the letters of a key word as key letters for monoalphabetic substitution of sequential plaintext letters from separate substitution alphabets, equal in number to the number of letters in the key.  This polyalphabetic substitution cipher blurs the statistics of the letter frequencies to an almost flat probability distribution.

Its modern version is the byte-by-byte addition of a keystream to the plaintext - a Vernam cipher. For all its apparent complexity, however, if you sample its ciphertext at letter intervals equal to the length of the key, the old statistics jump out at you.  Friedman's brilliant index of coincidence statistic will betray that key length.

NOTE:  An excellent souce for understanding how many ways have been devised to break apparently clever ciphers is US Army Field Manual FM-34-40-2, Basic Cryptanalysis, the successor to TM 32-220.  It will quickly show you why professional creation of ciphers is restricted to those with proven experience in breaking the codes and ciphers of others.

To counter this attack, you must have a secret keystream as long as the message.  If it is used twice on messages of the same length, adding the two ciphertext streams will cancel it out, leaving non-uniformly distributed letters for statistical cryptanalysis.

To be unbreakable, the keystream must come from a onetime pad of length equal to all the data bytes encrypted.  All this keying material must be kept secret.

This horrendous keying materials management problem for the only proven-unbreakable cipher has led to searches for keying material generators which can substitute.  However, all such schemes are based on algorithms, and must therefore leave patterns in the keystreams for statistical analyses that can break them.

Their cryptographic strength is therefore a matter of degree (the cryptanalyst's workfactor), not an absolute.  However, that strength can still be formidable.

One technique for achieving it is the use of Feistal networks, that generate blocks of keystream from blocks of the message itself, through multiple rounds of groups of permutations and substitutions, each dependent on transformations of a key.  If they are specifically structured to thwart all the known statistical cryptanalysis methods, their cryptanalytic workfactor can be made as large as that for exhaustive keysearch.

DATA ENCRYPTION STANDARD

FIPS PUB 46-2, the Data Encryption Standard (DES) specifies and mandates the use of the standard cipher for encrypting SBU information on all US Government AISs. Its approved modes of use in encryption engines are specified in FIPS PUB 81, and its validation tests in Special Publication 500-20.  It is a 16-round, Feistal network cipher.

The DES cipher was reviewed for NIST (then the  National Bureau of Standards) by the NSA, in its COMSEC role (as opposed to its code-breaking COMINT role).  The values of the constants in the DES S-box substitution tables were specifically chosen to resist then-known-by-NSA cryptanalytic attacks, including the then-highly-classified concept of differential cryptanalysis.  Its key size was chosen to be secure for at least a decade, while allowing implementations in 1970s integrated circuit technology.

This 64-bit block cipher has successfully withstood public cryptanalysis for more than 20 years, a record matched by no other.  In that time, however, the cost of special-purpose key-search machines capable of brute force attacks on its 56-bit keyspace has dropped below levels feasible for most governments (and some corporations).

NOTE:  A thousand cooperating million-DES-encryptions-per-second machines, an array affordable by many governments and corporations, could perform the 2-to-the-55th-power trial encryptions required to search half the 56-bit keyspace of DES (the amount necessary, on average) in a year.  Ten thousand of them could do such an exhaustive keysearch in little more than a month.  With the speed-per-dollar of such machines doubling every year or so, DES can hardly be considered secure for long-term use.

Over two decades of unsuccessful cryptanalysis have shown the DES cipher's cryptographic strength to be, in practical terms, equivalent to the size of its key.  Thus, an obvious place to look for its replacement is a version with a larger key.

TRIPLE-DES CIPHER

Unlike the available alternative block ciphers, the DES cipher has been proven mathematically to not be an algebraic Group.  Consequently, unlike those alternatives, three-pass encryption with DES yields a product cipher with a keyspace dimension equivalent to the sum of the sizes of the independent keys used in those passes.  (Two-pass use of any block cipher is vulnerable to meet-in-the-middle attacks.)

Each additional key-bit doubles the size of the keyspace. This is a crude, but extremely effective approach to defeating exhaustive key-search attacks through many years of increased computing power evolution.

NOTE:  This type of product cipher can be attacked by two different types of key-search methods:

(1) the obvious one of searching a 168-bit (3x56 bits) key-space, requiring an average of 2-to-the-167th- power triple-DES encryptions to crack the key used for a particular ciphertext (half the keyspace); or
(2) pre-computing 2-to-the-56th-power DES decryptions and checking the stored table of results against an average of 2-to-the-111th-power double-DES encryptions.

The former attack requires a thousand million-DES-encryptions-per-second machines to run for 10-to-the- 31st-power millennia; the latter "only" requires them to run for 64 million-million millennia, if all one thousand machines can access the lookup table (which requires 500 million gigabytes of storage).  Neither attack is taken very seriously by professionals, who would attack the key (and all your other keys at the same time) by exploiting cryptosystem implementation weaknesses or operator mistakes.

EXPORT CONTROLS

The financial services and banking industry uses the DES cipher to secure trillions of dollars of transactions.  It has been moving toward standardizing on 112-bit (2-key) triple-DES as its successor for the next century.  (In 2-key triple-DES, the same key is used for the first and third encryptions, requiring less keying material generation.)

However, the US Government has thus far refused to provide the required export approvals, instead suggesting the use of its Escrowed Encryption Standard (FIPS PUB 185).  This mandates use of the now-declassified Skipjack cipher with an 80-bit key (16 million times the size of the 56-bit DES keyspace), and a Law Enforcement Access Field (LEAF) permitting key recovery without the user's cooperation.

NOTE:  The Skipjack cipher is used in the Fortezza and Fortezza Plus encryption engines for all SBU information in NSA's Multi-level Information System Security Initiative (MISSI) system.  NSA apparently considers this 64-bit block, 32-round, Feistal network's 80-bit key size to be adequate for fulfilling its SBU INFOSEC mission for the next decade or two.

Our software cryptosystems employ a full 168-bit (3-key) triple-DES algorithm in cipher block chaining (CBC) mode.  They incorporate neither a LEAF mechanism nor covert channels for key recovery. (The Professional versions do, however, provide you with the ability to generate secure split key shares that enable you to offer emergency access to your encrypted data by multiple trusted parties acting in concert.)

Since the Bureau of Export Administration will not grant export licenses for such cryptosystems, our products can only be made lawfully available within the United States (to US citizens or Resident Aliens) or Canada, per 15 CFR 730-774.

KEY GENERATION

Use of a strong encryption algorithm, such as 168-bit triple-DES (and using this cipher in outer CBC mode, rather than in a cryptanalytically weaker mode to implement the cryptographic engine) makes the strength of the cryptosystem the strength of the keys.  It maximizes that strength by minimizing the amount of cyphertext generated with each key.  What never exists can't be cryptanalyzed.

NOTE:  Our software cryptosystems generate one-time keys for each encryption with a DES-based ANSI X9.17 key generator, automatically rejecting both weak and semi-weak keys.  Each time, the generator is seeded by an SHA-1 secure hash of the least-significant bytes of all the millisecond time intervals between your keystrokes in each passphrase challenge dialog.  Your master key only encrypts one-time keys, and is generated from a secure hash on all the characters entered, iteratively triple-DES-encrypted to add further workfactor to dictionary attacks.  In both cases, both your name and passphrase are included in the hashes, making your master key different from that of another user using the same passphrase, and maximizing the entropy of the key generator seed.

High-grade encryption eliminates your need to protect the security of a large number of bytes of high-value data scattered in a number of different files.  However, it replaces that need with the responsibility to protect a much smaller number of extremely high-value bytes: your keying information.

Three-key, triple-DES encryption requires 168 bits of keying information. It is often presented as 24 bytes, each containing a 7-bit value and an optional odd-parity bit. The strength of the encryption hinges on the uniformity of the probability distribution of the possible values. Since the parity bits are not independently random, the key size is not the entire 192 bits of the 24 bytes. Any biases in the method of selecting key values will similarly  reduce the number of bits of encryption-breaking workfactor.

However, 24-byte binary numbers (or 48-digit hexadecimal numbers) are not easy for human beings to remember. If such a key were written on a piece of paper, the entire strength of the encryption would rest on an attacker's difficulty in obtaining that piece of paper. Consequently, master keys are usually computed from a more memorable "secret," such as a password. Unfortunately, the number of bits of workfactor required to guess memorable passwords is only a tiny fraction of the size of the keyspace.

In order to make strings of bytes memorable, they are restricted to values that are ASCII text characters. The total of all upper-case and lower-case characters from the Roman alphabet, plus 10 decimal digits, is only 62. Including a hyphen and a space still only brings the number of permissible values for each 8-bit byte to 64, or 6 bits of entropy. To enhance memorability, further restrictions are placed on the characters that may fill subsequent slots in the password based on which characters have been selected for earlier slots. This reduces the number of bits of workfactor still further.

A 6-character password's maximum 36 bits of entropy requires only 2-to-the-36th guesses; a pathetically small fraction of the 2-to-the-168th permissible key values. The fact that each such guess requires 1000 triple-DES passes to generate a key to try in our software increases its DES workfactor to about 48 bits. In order to further increase workfactor while retaining memorability, we instead use a passphrase.  >>

Cerberus Systems, Inc. develops, manufactures and markets
software cryptosystems designed to meet or exceed level 1 of
FIPS PUB 140-1 on Windows® PCs.

The Cerberus logo and the ...Security Manager product names are trademarks of Cerberus Systems, Inc.
©Copyright 1997, all rights reserved


Passphrases
                        CHAPTER 3
                PASSPHRASES

The strength of a high-grade cryptosystem's cipher precludes practical cryptanalytic attacks.  However, localizing your keying information to a small-enough part of the keyspace would offer an attacker the possibility of only having to search a manageable part of that space, in order to hit the correct key value.  Such clues to changing the keyspace probability distribution, from one that is uniform to one that is highly "peaked," are the basis of modern code-breaking.

Avoiding presenting an adversary with such clues is the basis of your security.  Aside from rubber-hose cryptanalysis (finding yourself in a basement, assisting some large gentlemen with their inquiries), the most successful way for an adversary to obtain such clues is by social engineering your likely passphrases from other clues.

NOTE:  Our masterkey generation algorithm requires the sum total  of the number of characters in your name and the number of characters in your passphrase to be not less than 20, nor more than 126 characters.  The high redundancy of English text (so beloved by cryptanalysts seeking non-uniform distributions with which to crack codes) typically yields only 1.3 bits of entropy per character in a literary phrase.  Consequently, the 20 character minimum is really not contributing more than 36 bits of keying entropy, even though the SHA-1 algorithm spreads them throughout the keyspace.  Passphrases of from 15 to 30 characters work well for many people in balancing security versus the need to flawlessly type into a dialog box that has been "blinded" to prevent shoulder surfers from seeing your passphrase as you enter it. A 30-character literary phrase will provide approximately 39 bits of entropy which, combined with the 10 bits from our master key computation, yields an encryption-breaking DES workfactor of log2 (3) + 49 = 50.6 bits.

VULNERABILITIES

The reason for using passphrases is the avoidance of ever recording un-encrypted keying information, to prevent its compromise.  (Few people can memorize 24-byte hexadecimal numbers.)  Consequently, mnemonic devices are needed to avoid your ever recording your passphrase.

However, just because you haven't left it on a Post-It® note stuck to your monitor, doesn't mean that a clever adversary couldn't use those very mnemonic devices to successfully deduce your passphrase (or at least reduce the required length of the automated dictionary attack s/he may run on it).

Therefore, the means you employ to choose your passphrase (preferably of 15-to-30 characters) is of extreme importance to your data's security.

Knowledgeable adversaries (like the French intelligence service that targeted Texas Instruments) will target the weakest  part of your INFOSEC, not the strongest.

For instance, unplugging your disk and connecting it to a cable on their lap-top allows disk surfing, regardless of password programs or other obstacles to them running their scanning software on your computer.  If time doesn't permit, they can just steal the hard drive out of your machine.

If they can get it past your physical security, stealing the entire computer will leave you wondering if it was data theft, or simple burglary of a saleable machine.  (If the data was the latest geological evaluation of an oil field or gold mine, or your company's too-high-by-one-dollar bid for a big contract, you'd not wonder for long.)

Such adversaries are well-versed in the too-clever mnemonic tricks continually reinvented by amateurs, most of whom use them with easily guessed roots.

Technical people typing numerical values (such as Pi or Euler's constant) with the upper-case shift key depressed are particularly weak targets.  So are people typing obvious phrases with the keys adjacent to those for the actual characters.

YOUR CHOICE

Using the sentence on a professional reference book's line and page keyed to a memorable number does require an attacker (and you) to have physical copies of the book available.  This may be difficult for lap-top "road warriors," whose INFOSEC needs are often greater than those of people in secure, book-laden facilities.

NOTE:  It can, however, be an acceptable technique for secure passphrase exchange with another user of our cryptosystems who has the same book, provided that the communication doesn't give adversaries clues to which book you're both using.  This protocol  is, after all, just a variation on the primitive theme of book codes.

On the other hand, rooting your phrases in the context of your (truly) private life can make them totally obscure for attackers working in the context of your work life, while easily remembered by you.  (However, your family's names, your favorite sports team or other so-called "private" information available to your co-workers are worse than useless. They're most any knowledgeable attacker's starting point.)

NOTE:  Our software cryptosystems take the 160-bit SHA-1 digest of your passphrase and spread those bits over a 168-bit key by repeated triple-DES CBC encryptions.  They use the digest as the key, and perform 333 passes, plus however many more are needed to pass the weak/semi-weak key tests.  This increases the time required for each passphrase trial by 1000 triple-DES encryptions.  Even if reverse- engineering yielded the exact form of the algorithm, this substantially increases the work factor for a dictionary attack.  That is why your personal security must be factored into your plans,  to discourage adversaries from choosing an easier attack by rubber hose cryptanalysis.

Unless you're an accomplished amateur poet, generating memorable phrases not found in published literature will be a challenge.  If your passphrase is easy to reproduce, your adversaries may; if you can't reproduce it, your data is as secure from you as from them.  Only you can choose well against your adversaries.

If some of the words in a passphrase are restricted to those that will "go well" with the others, that reduces the scope of a required dictionary attack.  If you randomly choose each word, instead, your "secret" will be a nonsense-phrase that is still memorable, but harder to guess. If each word is independently selected by randomly addressing a list of 4096 words, each word adds 12 bits of entropy to the "phrase," regardless of wordlength. A typical English phrase contributes only 1.3 bits of entropy from each character. Thus, four 12-bit-addressed words would yield 48 bits, versus 39 bits for a 30-character literary phrase. The added entropy of our master key computation would then give those four words an encryption-breaking DES workfactor of log2 (3) + 58 bits.

Arnold Reinhold's DiceWare web-site at http://world.std.com/~reinhold/diceware.html includes a list of 8,192 words for use with his dice-rolling method of random addressing, producing 13 bits of entropy per word.

The Professional versions of our software cryptosystems include a pseudo-random passphrase generator.  It incorporates a dictionary of 16,384 5-to-10-character words (average length 7.4 characters), selected with pseudo-random addresses generated by our ANSI X9.17 keystream generator. One of its four-word nonsense-phrases contributes 56 bits of entropy.  Our masterkey computation's 1000 recursive 3DES encryptions of the phrase's SHA-1 hash yields a DES workfactor of almost 68 bits.

SHARED SECRET KEY SHARES

The Professional versions of our software cryptosystems give you the optional capability to Create key share diskettes for emergency access without knowledge of your passphrase.  If you keep two key share diskettes in separate secure locations, they will provide an emergency access if you forget your passphrase.

NOTE:  The 24-byte master key is used as the vertical intercept of a line with slope equal to an ANSI X9.17-generated 24-byte number.  Each key share is a point on that line, so that any two of them can be combined to regenerate the master key.  Knowledge of any one of them conveys zero information about the master key.  Only two such shared secret  key shares created at the same time will work, however.  Obviously, they will only work until you change your passphrase, generating a different master key.

However, the real purpose of this feature is to allow you to encrypt data which you have an obligation to preserve for others, in the event of your incapacity or death.  For instance, you could provide your wife, your accountant and your attorney with single shares, so any two of them could recover encrypted information in such an event.  If the data belonged to your employer, you could give one share, each to your immediate supervisor, to the director of personnel and to the corporate attorney.

Unfortunately, unless a cryptosystem is specifically designed with features to thwart it, Windows® can leak your passphrase.  In fact, unless prevented, Windows® can bypass encryption, leaving leaked copies of your plaintext scattered on your disk.  >>

Cerberus Systems, Inc. develops, manufactures and markets
software cryptosystems designed to meet or exceed level 1 of
FIPS PUB 140-1 on Windows® PCs.

The Cerberus logo and the ...Security Manager product names are trademarks of Cerberus Systems, Inc.
©Copyright 1997, all rights reserved


Windows® Security Leaks
                        CHAPTER 4
       WINDOWS SECURITY LEAKS®

The Windows® family of personal computer operating systems are the most widely employed operating systems in the world.  However, Windows® was not designed for security, nor were the IBM®-compatible personal computers on which it runs.

Forensic software exploits Windows® security leaks for computer evidence recovery and for electronic discovery in litigation. This is usually the real method by which "the suspect's encryption was cracked." It is also used by criminals and industrial spies.

- The basic Windows® multi-tasking capability, that allows you to run several programs at once, will leak your documents; your passwords; and even your encryption keys.

- Every time you print a sensitive document, Windows®  will leave un-encrypted copies of it on your hard disk, even though you carefully encrypt your copy.  Many application programs you use to work with your data will also leak such plaintext copies.

- The Windows 95 file system can ignore encryption software's attempts to overwrite sensitive data after encryption, leaving the un-encrypted data available on your disk (as some users of PGP® have discovered).

- Wiping all the free space on a disk can't erase sensitive data that Windows® has scavanged into the slack spaces of other files.

- Wiping the tail slack of files can't erase data scavanged into the interior slack of the compound files made by programs like Word® and Excel®.

Unless these data leaks are plugged, any encryption can be bypassed.

DELETE DOESN'T

The DOS/Windows® delete command does not delete your file's data bytes from your disk.  It merely deletes its own record of the fact that the area of the disk they occupy is unavailable for other uses.  It merely unlinks the file by changing the first character of its name to a special byte.

Consequently, the DOS/Windows® undelete command merely has to change that mark back (with a character it prompts you to provide) in order to recover any deleted file that hasn't been overwritten by subsequent save commands.  (The Win95 Explorer even leaves deleted files overtly available in a Recycle Bin.)

As a consequence of this "recovery feature," your deleted data's confidentiality depends on subsequent save commands that may (or may not) overwrite other data on top of (some of) those data bytes.

The format command doesn't format your disk; it merely formats a brand-new DOS/Windows® file record for that logical drive, declaring all areas available.  You can't depend on it, either.  (Modern hard drives don't allow low-level formatting of the disk.)

NOTE:  Our software Sanitizes any file it discards, by multiple overwriting of its contents, per DOD 5220.22-M.  The file's record entry is then also overwritten with ANSI X9.17-generated random characters to obliterate its name, and its size set to zero.  Only then are the overwritten disk clusters unlinked (deleted) from the DOS/Windows® file record.  The Destroy command allows you to do this Sanitizing of any file you select.

Unless and until they are overwritten, all data bytes from a sensitive file that has been deleted are available to be read by any software that can talk to your disk drive.

Such forensic software is widely used by governmental authorities; by "data recovery specialists" performing electronic discovery for lawsuits; and by other disk surfers.

Whether disk surfers run such forensic software on your DOS/Windows® computer, or run it on one of their own to which they connected your disk drive's controller cable plug, is as irrelevant as Windows® "access control software."

Being denied "access" to your particular one of the millions of copies of Windows® is hardly an insurmountable obstacle to reading your disk.

Windows®-compatible encryption must Sanitize, not delete sensitive plaintext.

DEFRAGMENTING

When files are created (or expanded) on a well-used disk, their contents may be scattered into disparate chunks in whatever areas of disk are labelled as unoccupied.  If these areas are widely separated, such fragmented files will be slow to read or write, due to disk drive seek times between the separated areas.

Consequently, there are "defragmenting" utilities that rearrange your entire disk into contiguous files, to maximize system performance.  This obviously involves some (undetermined amount of) overwriting.

Windows 95 includes one in the system tools section of its accessories folder, accessable from the Programs start button.  Windows 3.1, Windows 3.11 and Windows for Workgroups 3.11 require you to exit to DOS (not use a DOS window) in order to run a program called defrag.exe.  (You should never run this older defragmenter under Win95, where it can corrupt your filename structure.)

You should defragment your disk(s) often, as a matter of "good housekeeping" for system performance.  As an added benefit, it may overwrite some sensitive data left-overs, but defragmenting isn't sanitizing

DIGITAL SCRAPS

Hard disk controllers are block-transfer devices, reading or writing blocks of data bytes from or to multi-byte sectors on the magnetic disk's individual tracks.  If a 512-byte sector is overwritten with new data of less than that number of bytes, the small sector tail of leftover bytes will still retain the original data.

However, Windows® reads disk files conforming to the 16-bit DOS file-system, for purposes of backward compatibility.  The DOS File Allocation Table (FAT - in the disk's first sector) uses 16-bit numbers as pointers to record the locations of clusters of 512-byte disk data sectors.  Thus, the FAT can only distinguish between 65,536 (2-to-the-16th-power) separate data clusters on each drive.

Consequently, each cluster is an all-or-nothing allocation of however many bytes into which the disk's total capacity can be so divided.  For instance, a disk larger than 256MB, but less than 512MB, is accessed in 16-sector clusters of 8KB, each.  On a 1GB to 2GB disk, the 16-bit FAT must allocate at least 32KB of disk space to even the smallest file, because it can't deal in smaller quantities.

Since all block transfers must start at the beginning of a cluster, a cluster tail can easily hold several 2500-byte pages of plaintext from the last file that "owned" it.  In addition to this slack space at the end of all files, the interior slack spaces of the compound files created by applications such as Word® and Excel® can also hold sensitive data scavanged by the reallocation of "deleted" clusters to those files.

NOTE:  Our software records the size of a file as it is decrypted, so that the greater of that size and the current size is used in Sanitizing the plaintext after re-encryption.  This assures the overwriting of any data tail left from possible editing of the un-encrypted file that shortened it.  The Sanitize (multi-overwrite) and Clear (single overwrite with zeros, or zeroize) routines also query the operating system for the size of clusters on whatever drive contains the file to be overwritten (since different-sized drives will have different-sized clusters), and adjust all overwrites to cover complete clusters.

NOTE:  Our Clear a file's slack space instruction Clears the tails of non-sensitive files that you suspect may have scavanged sensitive data deleted during previous editing. Unlike other products that claim to "wipe file slack," it also Clears the interior slack space of OLE container files. Clear a disk's file slack does this for every file on the selected drive.

Sensitive data scavanged into file slack spaces are analogous to the unburned scraps of incriminating paper recovered from fireplaces by fictional detective heroes.  They can be "recovered" with the kinds of forensic software employed by real law enforcement agencies, or by data recovery consultants employed by attorneys in discovery for law suits.  Such software is commercially available to other potential disk surfers, as well.

Windows®-compatible encryption must overwrite ALL plaintext - including that left in free clusters and that scavanged into all file slack spaces, not just the tails.

WRITE-BEHIND CACHE LEAKS

Some encryption programs that supposedly provide Sanitizing functions (sometimes called "secure delete," a marketing term almost as meaningless as "military grade encryption") can be defeated by Windows® mechanisms for caching file data.

Their generically implemented "file wiping" routines don't take this caching behavior into account.  This can result in Windows® ignoring their instructions to overwrite data and merely deleting (unlinking) the file clusters, which remain available to disk surfers.

Windows 3.1 and 3.11 deal directly with the File Allocation Table in 16-bit emulated-8086 mode, whether or not 32-bit disk access is enabled.  Windows for Workgroups 3.11 and Windows 95 use a 32-bit virtual device driver (VxD) called VFAT, to deal with copies of the FAT in memory to provide their faster 32-bit file access.

Windows® caches recently-used data in memory, to minimize the need to reload it from disk.  There is also read-ahead caching of the next likely block of data from disk.  Win3.1 and Win3.11 use a 16-bit DOS terminate-and-stay-resident program (TSR) called SMARTDRV, while WFW3.11 and Win95 use a 32-bit VxD called VCACHE.

Both VCACHE and SMARTDRV are also capable of write-behind caching.  This allows Windows® to gain some performance, by waiting until the last operation on cached data is completed before writing it to disk, and allowing programs to exit before all disk writing has finished.  Under Windows 3.x, this can defeat all but the last of any multiple overwritings of each buffer-full of data, unless the cache is explicitly flushed.

The Windows 95 version of VCACHE is actually "smart" enough to not bother with any of the overwrites of the last buffer-full from a file that is subsequently deleted, unless the cache is flushed.  Except for large files, this can be the entire file, as users of the Windows® version of the e-mail encryption program PGP® have discovered.

Even more insidious is the fact that Win95's VCACHE ignores cache flush calls from 16-bit Windows® or DOS programs. Consequently, even the well-written DOS version of PGP® (which does include explicit cache-flushing instructions in its file-wiping subroutine) can't reliably overwrite files when run in a DOS window under Win95.

NOTE:  Our 32-bit software flushes VCACHE after each overwrite of each buffer-full of file data, forcing the multiple overwriting of the disk clusters (including their tails).  This is so on Windows 95 systems, or on Windows 3.x systems, on which they will run with the free Win32s upgrade installed.  Our older (and slower) 16-bit versions must, of course, rely on 16-bit cache-flushing functions.  Consequently, our 16-bit software will refuse to run on Windows 95 systems, which are insecure for 16-bit overwriting.

Any "encryption software" that doesn't cache-flush can't prevent Windows® from leaking your data.  Under Windows 95, 16-bit software cannot Sanitize.

FILENAME LEAKS

The long filename features in Win95 are implemented in such a fashion that even though the file may be overwritten, its name may still be recoverable by disk surfers.

VFAT in Win95 (but not VFAT in WFW) will only be purged of all traces of the name when the spaces it occupies in both DOS (8+3 byte) format and in long filename format are overwritten when VFAT needs to accomodate enough additional names.

This is a potential leak for people who use sensitive filenames under Windows 95.  If you are concerned about such name fragments, running the Windows 95 Disk Defragmenter will result in most such fragments being overwritten.

However, it's bad INFOSEC practice to expend the effort to encrypt most of a file's sensitive contents, and to then leak some of them yourself by including them in plaintext form in the filename.  Disk surfers thrive upon this kind of stupidity.

INFOSEC includes your operational security.  Don't leave clues in filenames.

THE SWAPFILE

Windows® is a multi-tasking operating system. This means that when switching the context in which it services application programs from one to another, un-encrypted data that the first program was working with in memory may be swapped-out to a disk swapfile.  Once Windows® is finished with them and swaps their contents back to RAM, these disk clusters will be declared available for re-writing with other swap data.

Unfortunately, unless they actually are overwritten, their sensitive contents will remain available for possible later scavenging by disk-surfers.

NOTE:  Our software was written in C (the language in which Windows® was written) to the raw Windows® API.  It includes no foundation classes or other visual programming building blocks to obscure possible information leaks.  It stalls the message queue for the duration of those operations during which un-encrypted passphrase or keying information is in memory.  All memory used for passphrase or keying data is zeroized before release.

An extremely important, but sometimes-overlooked source of sensitive data leaks to the swapfile is the Clipboard, the basis for all cutting and pasting of data between (or  within) Windows® programs.  If you have any other programs running while you use a Windows® application to work on a sensitive file in plaintext (un-encrypted) form, it is quite likely that portions of it will be found in the swapfile.

This kind of leak can allow the file to be compromised, even though you have carefully re-encrypted it with a program that Sanitized your copy of the plaintext with multiple overwrites.   Otherwise-strong cryptosystems can still be bypassed by the swap file.

NOTE:  The free DOS version of Pretty Good Privacy, PGPv2.62, is often run in a DOS box by any of a large number of Windows® front-end programs, to make it less intimidating for users uncomfortable with command-line interfaces.  Unfortunately, this can introduce INFOSEC vulnerabilities, while lulling the user into a false sense of security.  While the PGP program itself is a well-written DOS cryptosystem, Windows' multi-tasking between such a DOS-box and other programs carries the possibility of your passphrase being captured in the swapfile, above and beyond whatever other passphrase leaks may be present in the front-end program.  Furthermore, 16-bit DOS overwrite calls will be ignored by the Windows 95 version of VCACHE.

When your computer is inside a physical security perimeter, you don't have to worry about disk surfers.  You don't need encryption, or any other feature of our software (assuming your complete trust in every person who might get inside that perimeter).

However, if you ever take your computer outside such a perfect perimeter (or it becomes imperfect), you might not remember not having allowed our software to automatically Clear the Windows® swapfile when it offered you the option on exit.

Windows®-compatible encryption must Clear the swapfile. Don't circumvent it.

UNAUTHORIZED COPIES

Another class of potential security leaks are associated with the convenience features of many application programs.  Like an over-eager-but-security-unaware typist trying to anticipate your needs, they make extra copies of your sensitive data, in order to be more "efficient."

One example are the history files maintained by some application programs for your convenience in undoing changes or deletions.  If you use such a program to edit an un-encrypted document, any sensitive data you cut or delete in editing will be stored in the history file, in plaintext form for possible recovery by an adversary.  If you fail to re-secure the document, because you believe that it no longer contains sensitive information, you could be made rudely aware of this vulnerability.

NOTE:  In  DOE Master AIS Security Plan, section 9.3, the Department of Energy (responsible for US nuclear weapons programs) mandates disabling the Undo/Redo History function in WordPerfect for Windows® version 6.1, for precisely this reason.  Users of Microsoft Word® may also discover fragments of their un-encrypted documents in the clear space at the beginning of unrelated Word® files created after working on them.  Such fragments are not displayed by Word®, but may be seen with simple file editors.  This problem has been linked to pre-1996 versions of the Object-Linking and Embedding (OLE) dynamic link libraries scavanging portions of the swapfile into this supposedly unused space, and you should download free OLE-upgrade files from Microsoft.

Many application programs (especially those doing disk-to-disk compression or similar operations) may also create workspace files in your TEMP directory.  These "temporary" files are merely deleted.  Their remains must be overwritten to avoid leaks.

In addition, Windows® application programs don't really talk to your printer.  They merely write their formated print-out data to temporary files to be read by the print-spooler utility provided by the operating system.  This enables the application program to serve you, while the print spooler feeds the printer in the background.

Unfortunately, this means that "temporary" copies of anything you print-out are made in TEMP space files, which the print-spooler then deletes.  Consequently, every time you print a decrypted document with your computer, leaked copies will appear on the drive containing your TEMP directory.

Our software clears all free sectors on the drive containing your TEMP directory with the Clear TEMP space command on the Disk-wiping utilities sub-menu of your System Menu.  This overwrites all free clusters on that drive with all-zeros, per DOD 5220.22-M.  Unless you have our software configure your system's TEMP directory on a drive with little free space, this process can take 5 minutes per gigabyte on Ultra DMA disk drives, and longer on older ones.  For this reason, although Clear TEMP space is performed automatically on exit, it can be canceled or interrupted.

NOTE:  In compliance with the Derived Test Requirements for FIPS PUB 140-1, our software's cryptographic services can't be user-interrupted.  This includes the file Sanitizing function.  However, the disk free-space overwriting functions can be, in order to permit using the [Esc] key in an emergency, to terminate the sometimes lengthy operations to Clear TEMP space, or to Clear or to Sanitize a disk's free space.

You can eliminate the TEMP file problem entirely, by having our software configure your TEMP space as a RAM disk that automatically Clears with power off.  However, some programs may make temporary files in their own folders, rather than in the TEMP directory.  For these, you must use the Clear disk free space command.

If you haven't configured your system to use a RAM-disk for TEMP space, it's very important that you Clear TEMP space after sensitive print-outs.

SYSTEM CRASHES

Our software encrypts a plaintext file into a temporary file.  It then Sanitizes the plaintext original by multiple overwriting, per DOD 5220.22-M, and replaces it with the temporary file.  This is an availability measure.

Our design intentionally avoids the faster method of encrypting directly into the source file.  Thus, if a power transient crashes your system during encryption, your document will be undamaged.

Similarly, it decrypts a secured document to a working file, copies it over the encrypted file, and then Sanitizes the working file.  This method ensures that your document's confidentiality is not purchased at the expense of its availability.

However, if your system crashes during a decryption operation, partially-decrypted plaintext may be left in a temporary file in your TEMP Space.

Upon start-up, our software automatically looks for and Sanitizes any such file.  It is essential after such a crash that you let it do so as quickly as possible, unless you have allowed it to configure your system to use a RAM-disk for your TEMP Space, which would result in automatic Clearing of TEMP space by power interruption.

Windows®-compatible encryption must withstand system crashes.

The speed of (and need for) TEMP Space Clearing, and the effectiveness of Swap File Clearing can be affected by how you configure your system.  >>

Cerberus Systems, Inc. develops, manufactures and markets
software cryptosystems designed to meet or exceed level 1 of
FIPS PUB 140-1 on Windows® PCs.

The Cerberus logo and the ...Security Manager product names are trademarks of Cerberus Systems, Inc.
©Copyright 1997, all rights reserved


Configuring Your System
                        CHAPTER 5
        CONFIGURING WINDOWS®
                        FOR CRYPTOGRAPHIC SECURITY

Our products automatically analyze your system configuration for potential security leaks, and will warn you of advisable modifications that they can perform for you, if you choose to authorize them to do so.  (Neither our products nor their installers will unilaterally change your system settings.)   We believe that these security features uniquely differentiate our products, and offer the following guidance for their use.

YOUR TEMP SPACE

The only way to know whether a particular application program makes "temporary" copies of your data for itself is to use File Manager or the Windows 95 Explorer to inspect the contents of whatever directory your autoexec.bat file specifies in its SET TEMP=  line, while the program is open and after using it for a while.  Notepad will allow you to inspect such TEMP Space files to see if they contain text from the document on which the program is working.

All Windows® programs send their print jobs to the Windows® print spooler utility, so any printing of a document by any program will create and then delete (not Sanitize or Clear) TEMP space files with ".tmp" name extensions containing your text and some printer formatting data.  For this reason, after any use of your PC to print-out a copy of one of your un-encrypted documents, you should use the Clear your TEMP space command on the Disk security utilities sub-menu of the System Menu.

The only way to Clear your TEMP space is to overwrite the entire disk containing that directory.  If you have everything on one disk, and it has several hundred megabytes of free space, it all must be overwritten.

Consequently, if you have two hard disks (or have partitioned one into multiple logical drives, transfer data to one from the other(s) until it has less than 200MB of free space, and put your TEMP space there.  This should keep the time needed to Clear your TEMP space to a couple of minutes or less.  (Few people need more than 10MB of TEMP space; 2-to-4 is sufficient for most.  However, you'd have to continually defragment the drive to maintain performance with less than 25-50MB of free space.)

NOTE:  To assign your TEMP space to the drive with the least free space, select System configuration from the sub-menu that pops-up when you select Disk security utilities on the System Menu; check the "Configure my smallest fixed drive as TEMP" checkbox in the TEMP space section of the dialog that pops-up; click OK and allow the program to reboot your computer when it asks your permission.

If you create a RAM-disk and define the TEMP directory on it, merely shutting-off power will Clear its contents for you, automatically eliminating the entire question of TEMP file leaks.  If you have 16MB of RAM, setting aside 2-4MB for a RAM disk will work well under Win3x, since even the 32-bit Windows for Workgroups has a footprint of only 3 MB.  However, the 14MB footprint of Windows 95 makes this a marginal proposition without at least 24 or 32MB of RAM.

NOTE:  To do so, select System configuration from the sub-menu that pops-up when you select Disk security utilities on the System Menu; accept the recommended size in the TEMP space section of the dialog that pops-up or enter a different number of megabytes; check the "Configure a __MB RAM disk as TEMP" checkbox; click OK and allow the program to reboot your computer when it asks your permission.

Further compounding the potential for scattered copies of leaked documents is the fact that some programs define their own "temp" subdirectories for their working copies.  In addition, Win95 provides the ability for custom environment settings for application programs.  If these "temp" directories are on different logical drives than the TEMP directory, you must also Clear a disk's free space on those drives after such programs have been used to work on un-encrypted copies of your documents, or your sensitive information may be vulnerable to disk surfers.

YOUR SWAPFILE

If you use a permanent swapfile, our software's automatic CLEAR SWAPFILE? exit option will defeat any software-based attacks that scan it for sensitive data fragments. Windows® may re-establish a temporary swapfile in some of the same disk clusters, but you've no guarantee.

NOTE:  There are products claiming to wipe your swapfile by providing an option for wiping all the free space on its drive, in order to overwrite clusters that it has released.  Clearly, this can work with temporary swapfiles (and only with temporary swapfiles), if done after exiting Windows® to ensure that all virtual memory pages have truly been released.  Otherwise, it can only overwrite clusters that were probably released by Windows® after you closed the application that used the sensitive data.  We don't believe that "probably" is a sound basis for INFOSEC.  The minimum virtual memory allocation - a 4096-byte page - can hold a lot of keys or passphrases in its tail.

Consequently, if your system is configured to use a temporary swapfile, our software will detect that fact as it starts, and automatically warn you.  If you accept its suggestion to establish a permanent swapfile, it will automatically pop-up its System configuration dialog.  To establish a permanent swapfile, accept the recommended size or enter a different number of megabytes; check the "Configure a __MB permanent swapfile" checkbox in the Swapfile section of the dialog; click OK and allow the program to reboot Windows® when it asks your permission.

NOTE:  If the recommended size (based on the amount of RAM in your system) proves inadequate for the number of programs you like to simultaneously keep open, you may get "insufficient memory" warnings when starting additional programs.  Just manually select the System configuration option from the sub-menu that pops-up when you select Disk security utilities on the System Menu, and repeat the procedure with a different size.  If you use Win95's control panel instead, you must be sure that the maximum and minimum swapfile sizes match, since the minimum number is the amount that will actually be wiped.

OPERATIONAL SECURITY

The set of procedural disciplines followed to counter security threats is called Operational Security, or OPSEC.

When it is not encrypted, your sensitive data's confidentiality, its integrity and its availability can only be protected by physical security for your entire computer.  That physical security is dependent on your personal OPSEC discipline.

Leaving your sensitive data in unencrypted form on an unattended machine outside your physical security perimeter is obviously not good OPSEC.  However, many otherwise competent people never clearly analyze and define for themselves exactly what their physical security perimeter is.

The most secure guarded facility offers no protection, whatever from untrustworthy co-workers or visitors who are inside it with you.  Having one do shoulder surfing while you enter your passphrase, or sit at your machine while you get a cup of coffee, can render all your INFOSEC efforts fruitless.

The key share diskettes that our Professional versions can generate for emergency access are individually useless to an attacker.  However, if you leave two of these diskettes in the same desk drawer, you're asking for trouble.

When your sensitive data is properly encrypted and all plaintext copies have been removed from your disk, even theft of that disk or of the entire computer can't compromise its confidentiality.  However, even when encrypted, your data's availability depends on your maintaining up-to-date backup copies in a physically secure location that is separate from your computer.

An attacker may be quite content to not be able to read your sensitive data if he can make it unavailable to you, also.  Your only real defense against such denial of service attacks is to always backup changed sensitive data before leaving your machine.

That obviously applies to all your encrypted files, in their various locations on your disk.  It applies even more so to your Document Inventory file that Document Security Manager uses to keep track of all of their locations, their security states and the one-time keys used to last encrypt them.

This allows not only their locations, but all file names and extensions to remain unchanged by encryption.  It is intended to prevent traffic analysis of which files or folders on your disk you consider important enough to protect with encryption.

While you can always decrypt a file without the Document Inventory, you will have to remember what folder it's in on your disk.  The Inventory file allows decryption by merely remembering your current passphrase (or by possessing two of the latest key share diskettes).  It also encrypts the labels you use to remind yourself of their contents, or to access them by category (Professional version, only).

If you exit the program after any operations that change the Inventory in any way, you'll be warned if you haven't done an Inventory backup.  Do so.

If you've decrypted any documents and attempt to exit without re-encrypting them, you'll be warned and given the opportunity to do so.  This warning should also only be ignored under extreme time limitations.

However, our products will only warn - never force you to wait for some lengthy automatic procedure.  You're responsible for your own OPSEC.

Read your Windows® documentation and remember: your diskette drive, your modem and your network connection all provide adversaries with access ports to your data.

- Keep your documents secured, while connected to any other machine or network;
- don't give clues to their contents, with carelessly chosen filenames; and
- beware of trojan horse programs, that can capture your passphrase keystrokes.

As the NSA's National Cryptologic School says: practice safe computing.

Cerberus Systems, Inc. develops, manufactures and markets
software cryptosystems designed to meet or exceed level 1 of
FIPS PUB 140-1 on Windows® PCs.

The Cerberus logo and the ...Security Manager product names are trademarks of Cerberus Systems, Inc.
©Copyright 1997, all rights reserved


order form
                                                     CERBERUS SYSTEMS, INC.
                    ORDER FORM
             FOR EXPORT-CONTROLLED ENCRYPTION SOFTWARE

Software cryptosystems incorporating high-grade ciphers without a user-independent mechanism for key recovery are considered encryption items - Category EI in the Commerce Control List, 15 CFR 774. Under the Export Administration Act, 50 USC 2401 the penalty for unlicensed export from the USA is a fine, not to exceed $1,000,000 and/or prison term, not to exceed 10 years for each offense.

Our export-controlled products can only be lawfully licensed to customers who are either:

1. A citizen of the United States of America or person who has been lawfully admitted for permanent residence in the USA under the Immigration and Naturalization Act, who is requesting delivery in the USA and plans to install the product(s) only on computers located in the USA, and who agrees to comply with all applicable US export control regulations and pay all applicable state sales taxes for delivery outside Massachusetts; or

2. A citizen of Canada, who is requesting delivery in Canada and plans to install the product(s) only on computers located in Canada, and who agrees to comply with all Canadian law regulating the export from Canada of strong cryptographic software obtained from the USA and pay all applicable provincial sales taxes.

If you wish to place an order meeting all of the conditions in either category 1 or category 2, please print a copy of this form and fill it out completely, either by typing or block lettering, and sign it.  Mail it with either US or Canadian postmark, with enclosed payment by credit card or check in either US$ or C$ to:

Cerberus Systems, Inc.
3 Whispering Pines Drive
Andover, MA 01810-3421

Upon receipt of the Basic License Fee and US$10-per-copy Registration Fee(s), after verification of the US or Canadian location of the Internet domain name for requested e-mail delivery, we will send you a self-extracting e-mail attachment of less than 100K in size that will convert your installed copy of the 32-bit or 16-bit demonstrator into the corresponding fully-functional, individually-licensed cryptosystem. (Basic License Fees are as posted by us at  http://www.cerberus-sys.com/~infosec/products/index.htm.)

If we are unable to confirm the domain name location we will so-notify you by e-mail.  In that case, or if you have requested physical media, we will mail 1.44MB diskettes to your US or Canadian residence upon payment of the US$10-per-copy Media Fee and applicable Shipping Charges.

                                                                                            LICENSEE's NAME
PRODUCT                                                                         (exactly as printed on
DESIRED _______________________________              credit card or check) _______________________________________

BASIC LICENSE FEE: US$_________________             STREET ADDRESS ________________________________________

REGISTRATION FEE: US$_________10.00____             TOWN OR CITY  __________________________________________

MA RESIDENTS +5%: US$_________________              STATE OR PROV________  ZIP/POSTAL CODE________________

  TOTAL ENCLOSED:  US$_________________              E-MAIL ADDRESS  ________________________________________

  MULTIPLY x1.50 FOR  C$_________________               AMEX CARD NO.______________________  EXP.DATE__________

I hereby warrant that I understand and accept
the License Agreement and that this order fully
complies with the conditions of category #___: SIGNATURE________________________________ DATE_______