Talk:Comparison of disk encryption software

message: Despite its considerable length, this article appears to be missing the most widely used contemporary disk encryption tools, including iOS device encryption, iCloud Keychain, and the Android built-in device encryption before and after changes in Android 5.0.  Will try to downgrade quality from B to C until these are covered. -- pde (talk) 18:55, 10 April 2015 (UTC)
thread_title:  Missing the most important disk encryption tools! 

message: Currently I only know of GBDE using per sector keys. Calling these pseudorandom might not be accurate enough. Two different keys are used for each sector. One key is used for encrypting the actual data, this key is generated every time the sector is written. There is nothing inherent in the GBDE design requiring these keys to be pseudorandom. On hardware supporting it, they could be truly random bits, which would also be the most secure. The one time key used fot the data is then encrypted under a per sector pseudorandom key, which remains fixed for the life time of the container. Kasperd 08:08, 27 December 2006 (UTC)
replies: text: Right, GBDE probably supports hardware random generators. Changed it to say "random per-sector keys". Or do you think that's not clear enough? -- intgr 11:22, 27 December 2006 (UTC)
replies: text: Maybe add a footnote saying something like: "GBDE use two keys for each sector, a fixed pseudo random key and a one time key" with a reference to the paper. Kasperd 13:50, 27 December 2006 (UTC)
replies: text: I added annotations for all the columns now, including this one; they're more visible now than footnotes ever were. -- intgr 16:55, 27 December 2006 (UTC)

text: Each sector actually have two keys. A pseudorandom key, which is fixed for the volumes lifetime, and a one time key, which changes every time the sector is written. The new key is generated using the systems random number generator. I don't know the details of the random number generator BSD uses, but I'd guess it use a combination of pseudorandomness and real randomness. If the pseudorandom number generator used to generate the fixed keys had been strong, the encryption would have been secure even with a fixed IV. Unfortunately that pseudorandom generator is a nonstandard one designed specifically for GBDE, and it has known weaknesses. Kasperd 20:28, 2 October 2007 (UTC)
thread_title:  Per sector keys 

message: Does anyone have ideas about how to sort the table entries? When I initially wrote the article, I figured that ordering by date might be a good idea since it gives at least some visual information, and has a precedent on comparison of file systems; however, I'm not too sure about that now, as exact release dates are not very easy to find for some software and tend to be ambiguous. Ideas? -- intgr 07:17, 2 January 2007 (UTC)
replies: text: I find the ordering by date to be confusing (esp. with dmcrypt not being side by side). A more similar article, Disk encryption software, is sorted alphabetically which is easier to read. -Etienne 19:47, 1 April 2007 (UTC)
replies: text: I agree - that it would make more sense. I'll start work on reordering it (though it's a big list!); if anyone wants to view it in a different order, they can always use the sort buttons H8gaR 18:58, 18 July 2007 (UTC)
thread_title:  Ordering 

message: loop-AES <http://loop-aes.sf.net> is missing, please whoever has the knowlegde about it please include.
— Preceding unsigned comment added by 84.176.118.76 (talk) 
other important crypt software that is missed in this comparision is CompuSEC (freeware)
http://en.wikipedia.org/w/index.php?title=Talk:Comparison_of_disk_encryption_software&action=edit§ion=5
:I have added loop-AES now. -- intgr 15:43, 23 April 2007 (UTC)
thread_title:  Missing 

message: The "modes of operation" table has been converted from a yes/no grid to a flat list in this edit; however, I think it dramatically reduces the readability and overview of the table. The edit comment states "Made the Modes of Operation chart more scalable (if a product supports 100 modes, there needs to be 100 columns, which is impractical)."; however, I don't think that's going to happen soon. If we ever do find such a product, I would rather decide then, and not hinder readability now.
In another edit, the previous column headers are removed, pointing to the modes of operation article. While indeed we cannot explain the values in depth on this article, I'd think that a brief explanation of what the values mean is very important for reference, just like all other tables have a column key.
I would like to revert both of these edits. I note that these edits were made to accommodate the addition of the CFB mode of operation whose properties are equivalent to CBC for the purposes of disk encryption; given this, I think we can put them both under a common column, the question relevant to disk encryption is whether PGPDisk uses public or private IVs -- e.g., whether it's susceptible to watermarking attacks. Can we come up with a good column title that would describe both CBC and CFB (and preferably also other "classic" modes)? -- intgr #%@! 22:43, 19 August 2007 (UTC)
thread_title:  Modes of operation table 

message: I just switched to EncFS from loobback, has the great advantage of not having to preallocate space for encrypted partition. http://arg0.net/wiki/encfs  —Preceding unsigned comment added by Savuporo (talk • contribs) 07:44, 10 September 2007 (UTC)
replies: text: Please add http://www.arg0.net/encfs to the table. It works well and has an PAM module as well.--188.118.242.227 (talk) 01:55, 21 March 2014 (UTC)
thread_title:  EncFS 

message: Is it possible to add information about supported OS and Hardware-RAID? 12:12, 12 October 2007 (UTC)
thread_title:  RAID/OS support 

message: I've just changed the "layering" section entries for "AlertBoot Full Disk Encryption" to reflect that it's not clear what it does.
From their WWW site, it's not actually possible to determine conclusively what this program offers technically. From it's name and description, it seems like a pretty fair bet it's a full disk encryption system - but as for file and partition encryption? Not certain. It suggests it may offer a file based system via operation as SAN, but it's not clear how.
Please note: This product hasn't been launched yet! I'd suggest leaving the change I've put in place in place until it's released (apparently planned for sometime in Feb 2008). Better still, remove AlertBoot from the comparison completely; there's no reason to suggest it's in any way notable. Hell - they haven't even finished it yet! IMHO, its entry here just looks like spam Nuwewsco (talk) 22:17, 3 January 2008 (UTC)
replies: text: Right. I second your suggestion to simply remove it and will do so, as no reliable information can be found on this product (let alone independent or neutral). -- intgr [talk] 23:08, 11 January 2008 (UTC)
thread_title:  AlertBoot Full Disk Encryption 

message: How does one boot a system that allegedly does whole disk encryption - off an external USB device?  Or is this a false claim by various products? Socrates2008 (Talk) 11:48, 14 March 2008 (UTC)
thread_title: Whole disk encryption

message: This article seems to confuse the two products.  Also the OS support is out of date, but difficult to update as PGPDisk is bundled as part of other packages and is not a separate product. Socrates2008 (Talk) 01:44, 24 April 2008 (UTC)
replies: text: Also the PGP suite of software seem to have become somewhat changed since Symantec bought them, anyone could bring some clarity to that? CarlJohanSveningsson (talk) 12:44, 15 August 2011 (UTC)

text: I think PGP Disk was part of PGP Desktop which was renamed "Symantec Encryption Desktop", but seems to have been already discontinued in the meantime - in any case one does not seem to be able to buy it anymore. Instead, there is only "Symantec Endpoint Encryption", which seems to be full disk encryption only unlike PGP Disk / Symantec Encryption Desktop which mounts an encrypted file as virtual volume.   Kellerpm (talk) 10:55, 13 February 2015 (UTC)
thread_title: PGP Disk vs PGP Whole Disk Encryption

message: The comparison in the layering section is very misleading, as it's comparing software that protects physical disks, logical volumes (partitions) as well as software that creates new file-backed encrypted virtual volumes. Socrates2008 (Talk) 01:44, 24 April 2008 (UTC)
replies: text: Yes, that's the point of the section; many products offer several of these options. Why is it misleading? -- intgr [talk] 18:10, 19 September 2008 (UTC)
thread_title: Definition of "whole disk encryption"

message: Vendors of the software mentioned this article are encourage to note conflict of interest as well as suggestions for COI compliance. Socrates2008 (Talk) 21:54, 18 September 2008 (UTC)
thread_title: Conflict of interest

message: "Swap space: Whether the swap space (called a "pagefile" on Windows) can be encrypted individually/explicitly." What does this mean in English? Does it mean "Is the swap space encrypted?". If so, then it should be yes for freeCompusec. 75.91.99.108 (talk) 03:03, 15 February 2009 (UTC)
thread_title: Whatsis?

message: Mobile Armor has a product called Data Armor that should be included perhaps?
--Risacher (talk) 20:52, 6 April 2009 (UTC)
thread_title:  DataArmor / MobileArmor 

message: I've done some work with evaluating encryption software, and it's very very frustrating how difficult it is to find out if tokens are actually supported. As for level of security, PKCS#11 would seem to be the only relevant standard, and then proper keys, not objects like those Truecrypt supports.
Truecrypt has for a long time now obfuscated that they do not in fact (correct me if I'm wrong) support non-stealable keys over PKCS#11, but still use those "keyfiles". At least partially defeating the main purpose of a token. I'd appreciate if someone with insight, possibly together with me, could help fix the matter at least in this table, to the very least with a footnote regarding Truecrypt token support.
Oh and PS, if someone could direct me to a simple and good software to do my file/archive encryption (not full disk) using PKCS#11 tokens, I'd be most grateful! :-D CarlJohanSveningsson (talk) 12:51, 15 August 2011 (UTC)
replies: text: Doxbox says it supports  PKCS#11 but dont know if it supports it fully L33tgirl (talk) 18:21, 15 February 2015 (UTC)
thread_title:  Hardware tokens 

message: There's no evidence I can find that this product exists, though the table lists it.  Symantec's client compatibility page makes no mention of any OS X compatibility:
http://www.symantec.com/products/sysreq.jsp?pcid=pcat_info_risk_comp&pvid=endpt_encryption_1
As such, I'm changing this to a "No".
Edrarsoric (talk) 03:07, 15 March 2012 (UTC)
thread_title:  Symantec Endpoint Encryption for Mac 

message: In the article clicking footnote 71 correctly goes to footnote 71.
Clicking 74 incorrectly goes to 72.
And uses of footnotes 72 and 73 cannot be found in the article but do exist as footnotes.
Ftgoodoa (talk) 19:58, 3 May 2012 (UTC)
thread_title:  Footnotes not linking correctly 

message: RedHat has RealCrypt. Search the web for it.  — Preceding unsigned comment added by 89.235.246.98 (talk) 15:18, 4 November 2012 (UTC)
thread_title:  Add RealCrypt 

message: 'Yes' to what does not encrypt partition table. --211.127.228.179 (talk) 13:52, 1 June 2014 (UTC)
thread_title:  Whole disk including the partition tables  

message: Designed to look identical to Truecrypt.  — Preceding unsigned comment added by Gary84 (talk • contribs) 16:51, 26 July 2014 (UTC)
thread_title:  Add VeraCrypt 

message: Can someone please update this article to add a reference to DoxBox (https://t-d-k.github.io/doxbox/ ) which is a relaunch of FreeOTFE. I am the maintainer of DoxBox.  — Preceding unsigned comment added by Squte (talk • contribs) 00:01, 31 August 2014 (UTC)
thread_title:  DoxBox 

message: I am changing the entry for freeotfe to say it supports hardere acceleration, the freeotfe manual says it uses libtomcrypt 1.17 and libtomcrypt says it uses hardware acceleration http://www.libtom.org/?page=changes  — Preceding unsigned comment added by L33tgirl (talk • contribs) 15:14, 20 September 2014 (UTC)
thread_title:  FREEOTFE hardware acceleration 

message: Hello fellow Wikipedians,
I have just added archive links to  on Comparison of disk encryption software. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive https://web.archive.org/20050302202315/http://www.infoworld.com:80/cgi-bin/displayArchive.pl?/99/25/c05-25.48.htm to http://www.infoworld.com/cgi-bin/displayArchive.pl?/99/25/c05-25.48.htm
When you have finished reviewing my changes, please set the checked parameter below to true to let others know.
Cheers.—cyberbot IITalk to my owner:Online 20:37, 18 January 2016 (UTC)
thread_title:  External links modified 

message: Since the fall of TrueCrypt, a project called TCnext was quick to claim themselves as a TrueCrypt alternative. Their website is truecrypt.ch. I visited this page to learn more but I see they are not mentioned.  67.0.34.219 (talk) 23:06, 10 August 2016 (UTC)
thread_title:  TCnext - Please add and vet 

message: DiskCryptor was last updated about 3 and a half years ago and their forum has gone dead silent. No response from anyone behind the project at all. Maybe it's time to change "Maintained: Yes" to "Maintained: No"? 2A03:8600:1001:4013:0:0:0:100A (talk) 17:14, 8 January 2017 (UTC)
thread_title:  DiskCryptor is no longer maintained 

message: Hello fellow Wikipedians,
I have just modified 2 external links on Comparison of disk encryption software. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Corrected formatting/usage for http://www.infoworld.com/cgi-bin/displayArchive.pl?%2F99%2F25%2Fc05-25.48.htm
*Added  tag to ftp://ftp.software.ibm.com/pc/pccbbs/thinkcentre_pdf/rr30mst.pdf
*Added archive https://web.archive.org/web/20150923202446/http://www.checkpoint.com/products/full-disk-encryption/DS_FullDisk_Encryption_120614.pdf to http://www.checkpoint.com/products/full-disk-encryption/DS_FullDisk_Encryption_120614.pdf
*Added  tag to http://macmarshal.com/images/Documents/mm_wp_102.pdf
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 16:57, 11 August 2017 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified 7 external links on Comparison of disk encryption software. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20080820034450/http://www.checkpoint.com/press/2007/protectdataacquisition011107.html to http://www.checkpoint.com/press/2007/protectdataacquisition011107.html
*Added archive https://web.archive.org/web/20081211101509/http://otfedb.sdean12.org/cgi-bin/pub_factsheet.cgi?SYSTEM_ID=46 to http://otfedb.sdean12.org/cgi-bin/pub_factsheet.cgi?SYSTEM_ID=46
*Added archive https://web.archive.org/web/20061225094038/http://luks.endorphin.org/dm-crypt to http://luks.endorphin.org/dm-crypt
*Added archive https://web.archive.org/web/20080224023214/http://technet2.microsoft.com/windowsserver2008/en/library/ce4d5a2e-59a5-4742-89cc-ef9f5908b4731033.mspx?mfr=true to http://technet2.microsoft.com/windowsserver2008/en/library/ce4d5a2e-59a5-4742-89cc-ef9f5908b4731033.mspx?mfr=true
*Added archive https://web.archive.org/web/20100529120057/http://diskcryptor.net/wiki/Main_Page/en to http://diskcryptor.net/wiki/Main_Page/en
*Added  tag to http://www.becrypt.com/us/downloads/DISK%20Protect%204.2_US.pdf
*Added archive https://web.archive.org/web/20101217175911/http://mcafee.com/us/resources/data-sheets/ds-endpoint-encryption.pdf to http://www.mcafee.com/us/resources/data-sheets/ds-endpoint-encryption.pdf
*Added archive https://web.archive.org/web/20060823075648/http://americas.utimaco.com/encryption/TPM-Technology-Comes-Of-Age.html to http://americas.utimaco.com/encryption/TPM-Technology-Comes-Of-Age.html
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 16:27, 20 September 2017 (UTC)
thread_title:  External links modified 

message: In the "features" section, maybe include a new feature in the table: in-RAM encryption of passwords/keys. This feature is supported in VeraCrypt.
I believe other disk encryption software can avoid unencrypted passwords or keys in RAM, such as TRESOR.
This feature could be called something like "cold boot mitigation" (link to cold boot attack page) or "encrypted passwords and keys in RAM". MetalFusion81 (talk) 14:53, 11 January 2020 (UTC)
thread_title:  In-RAM encrypted passwords/keys or cold boot protection 

message: This should be set straight. -- Alexey Topol (talk) 00:35, 28 July 2022 (UTC)
thread_title:  Windows 9x is amiss from the supported OS list 

message: Too many listed Greatder (talk) 16:46, 7 August 2022 (UTC)
thread_title:  Shrinking Operating System/OS count