Encrypting File System
|
|
- This article is about the Microsoft Windows file system, for the old IRIX file system, see EFS (IRIX).
The EFS or Encrypting File System is a file system available in Microsoft's Windows 2000, Windows XP, and Windows Server 2003 operating systems. The technology transparently allows files to be stored encrypted on NTFS file systems to protect confidential data from attackers with physical access to the computer.
User authentication and access control lists can protect files from unauthorized access while the operating system is running, but are easily circumvented if an attacker gains physical access to the computer. A solution is to store the files encrypted on the disks of the computer. EFS does this using public key cryptography, and aims to ensure that decrypting the files is practically impossible without the correct key. However, EFS does not prevent brute-force attacks against the user account passwords. In other words, file encryption doesn't provide much protection if the account password is easily guessed.
Operation
Files and folders that are to be encrypted by the file system must be marked with an encryption attribute. As with file permissions in NTFS, if a folder is marked for encryption then by default all files and subfolders that exist in the folder are also encrypted. When files are copied to another volume that is formatted with another file system (for instance FAT32) then the files and/or folders and decrypted before copying them over to that file system. The only exception is when files are backed up, in which case the files are not decrypted.
EFS works by encrypting a file with a bulk symmetric key (also known as the File Encryption Key, or FEK), which is used because it takes a relatively smaller amount of time to encrypt and decrypt large amounts of data than if an asymmetric key cipher is used. The symmetric key that is used to encrypt the file is then encrypted with a public key that is associated with the user who encrypted the file, and this encrypted data is stored in the header of the encrypted file. To decrypt the file, the file system uses the private key of the user to decrypt the symmetric key that is stored in the file header. It then uses the symmetric key to decrypt the file. Because this is done at the file system level, it is transparent to the user.
External links
- EFS in Windows 2000 (http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/Default.asp?url=/resources/documentation/windows/2000/server/reskit/en-us/distrib/dsck_efs_XHKD.asp)
- Overview of EFS in Windows XP (http://www.microsoft.com/resources/documentation/windows/xp/all/reskit/en-us/prnb_efs_awzg.asp)de:Encrypting File System