PGP disk encrypt approved by MoD for military use

whoopie

Its nice to know we're going to be paying a lot of tax money to PGP that we could have saved using the GPL'ed equivalents. Wouldn't want all that lovely money going to the bankers - best piss it up a different wall.

CESG

How can this recommendation be reported to the public?

These guys still run their systems under windows NT

http://www.cesg.gov.uk/find_a/cert_products/index.cfm?menuSelected=1&displayPage=152&id=16

.....

sshhh..it's a secret

The usual blurb from the Register that stuff at SECRET level isn't particurly interesting, spoken/written by someone that's probably had little to do with protectively marked data.

Au contraire mon ami, somestime stuff at lower levels *is* interesting but I can't tell you what, because I'd have to kill you.

You really need to ditch this attitude that the MoD is paranoid and protectively marks data when it doesn't need to be. However, I will admit, that some stuff at restricted shouldn't be marked so, but then again...some stuff should be.

I've got it on this laptop I'm using, now

Yeah, we could employ our own disc-encryption technicians, and use the original GPL-licensed products, and do it all ourselves - but in a way, you're just inventing your own brand of 'proprietary'. Support for disc encryption that does not seriously impact machine performance across thousands of laptops, of dozens of different models, across multiple international sites, is decidedly non-trivial.

How many of the commenters, on this story are typing on machines with full-disc encryption in place, I wonder? If you are (and you installed it all yourself from source) how long did it take? If you don't think it took you that long, then I have a proposition for you: we have 2,600+ laptop users, across nine different sites in the UK. Some of them have more than one laptop... Care to drop by and replace the PGP full-disc, on all of them, with your free alternative? We'll want at least three year's support thrown in. How about we start next Thursday at our Merseyside depot? I must tell you, if you are successful, we also have offices in Malaysia, Cyprus and California, among other places, with about another 1,500 laptops. Unfortunately, you won't get to see to much of the local nightlife, because you'll be too busy installing encryption software...

PGP may be expensive, but at least the actual source code is available on line, unlike Bitlocker. You offload the support overheads and reduce the 'bus-factor' inherent in employing your own specialists - and most importantly, you can assure any external auditing body that a stolen machine was secured using a recognised product, from a specialist supplier, rather than just some roll-your-own solution installed at your 'say-so'.

That company you keep hearing about having it's laptops stolen? That's us. You get to hear about our laptops being stolen, partly because we have so many of the damn things, but mostly because we can dare to own up to the fact that they've been stolen. Ironically enough, we're probably one of the few commercial companies, with a UK arm, that deploys the kind of hardware that could force-decrypt one of the things. Fortunately for the spooks, all our spooky hardware is too busy paying the payrolls and pensions schemes of Police forces, the NHS, county councils, and - yes - the military.

I certainly think this is a step up, in securing military laptops, from slinging them in the sea from the decks of cross-channel ferries!

The Delusional State of Military Affairs.

"experience suggests that in fact nothing terribly interesting is normally to be found in MoD files even at the SECRET level, let alone CONFIDENTIAL, and maybe they could relax a bit." .... Quite so, Lewis, but they do like to think of themselves as heroes rather than zeroes

"Restricted"

Runway resurfacing would be properly protected - it's commercially sensitive.

Restricted is just personal detail stuff - like the names, adresses, social security numbers and passport details of everybody who had ever expressed an interest in joining the army. Stuff that couldn't possibly be of use to the enemy.

This must now be PGP encrypted with the password (which should be either "password" or "secret") written on a post-it note and stuck onto the CD or laptop.

Closed source?

>MS is not closed source if you are a government or any company over a trivial size.

Yes you can get a license to view the source code yourself.

But not hand it out to every crypto researcher in every university to look for vulnerabilities.

You can't recompile and replace the signed code running in the windows kernel - so you have no idea if the source you have been given is the code that is running.

You don't know if the next windows update will replace the code with a version that has a backdoor.

Paranoid? Yes - it's also paranoid to think that somebody is going to attack you, but they still let the army have guns.

Security Levels

Any software, no matter what it's merits, is only as secure as the operating system.

If the OS is compromised, then so is the encrypted data.

It makes sense that a software only product has a maximum security rating. Making software stronger only means that the software is no longer the weakest link.

Higher security (above that of the windows OS) require hardware encryption.

All security products are vulnerable to physical access. An attacker can simply place a bug to record all passwords/fingerprints/etc. One time key generators are the only way to defeat these "bugs" and even these can be "burrowed" along with the machine.