On Mon, 17 Feb 2003, Seth Arnold wrote: > On Mon, Feb 17, 2003 at 05:40:23PM -0800, Richardson, John wrote: > > 1. On laptops, setting the BIOS password can also be used to have the disk > > controller perform disk encryption. I don't know how strong it REALLY is, <snip> <snip> > > 2. On XP, and Win2K also, if you use EFS (Encrypting File System) the OS > > will decrypt the files for users with access to the keys. Does this <snip> > As I recall the EFS design, the keys are encrypted with the NTLM hash > of the login password for the user in question. Changing the password > outside of the system may very well cause all the data encrypted by the > account in question to be lost. (Changing the password back to its old > value will probably result in a different NTML hash, otherwise dictionary > attacks would probably be far easier, so I'd bet changing the password > back to the original password would not restore the data.) Just to offer some corrections to the above. EFS does NOT use the NTLM has of the login password to encrypt data. The system creates a unique public/private key pair for each individual user (along with onefor the system itself, and a few other things). This public key is NOT used to encrypt the file however, a separate is key is created for each individual file and that key is used to encrypt the file. Then the user's public key is used to encrypt the file's unique key. So in short here's the deal. user--[has a]-->Public Key--[encrypts]-->File's key--[encrypts]-->File I won't go into the details of why the do this (has to do with recovery), but that's how its done. here's the whitepaper. http://www.microsoft.com/windows2000/techinfo/howitworks/security/encrypt.asp So you can most definitely change your password, login name, user description and everything else about a user providing that you do not delete the account (even if you recreate w/ the same name/password, think sids). Once you delete the account you're screwed (time for the Recovery Agent). -Jacob
This archive was generated by hypermail 2b30 : Tue Feb 18 2003 - 11:06:07 PST