I’m sitting here working out of the library (it’s closer to the bars for happy hour), when a headline on Slashdot catches my eye:
Undocumented Bypass in PGP Whole Disk Encryption“PGP Corporation’s widely adopted Whole Disk Encryption product apparently has an encryption bypass feature that allows an encrypted drive to be accessed without the boot-up passphrase challenge dialog, leaving data in a vulnerable state if the drive is stolen when the bypass feature is enabled. The feature is also apparently not in the documentation that ships with the PGP product, nor the publicly available documentation on their website, but only mentioned briefly in the customer knowledge base. Jon Callas, CTO and CSO of PGP Corp., responded that this feature was required by unnamed customers and that competing products have similar functionality.”
OMG!!!! WTF!!!! Evil backdoors in PGP!!!! Say it ain’t so!!!!
Oh, wait a moment. It’s just the temp bypass feature that every single enterprise-class whole disk encryption product on the market supports.
I love Slashdot, it’s one of the only sources I read religiously, but on occasion the hype/bias gets to me a little. The CTO of PGP responded well, and I’ll add my outsider’s support.
Full disk encryption is a must-have for laptops, but it does come with a bit of a cost. When you encrypt the system, the entire OS is encrypted and you need a thin operating system to boot when you turn on the PC, have the user authenticate, then decrypt and load the primary operating system. Works pretty well, except it interferes with some management tasks like restoring backups and remote updates. Thus all the encryption companies have a feature that allows you to turn off authentication for a single boot- when you need to install an update and reboot the user logs the system in, updates are pushed down and installed, the system reboots without the user logging in, and the bypass flag cleared for the next boot. Otherwise the user would have to sit in front of their machine and enter their password on every reboot cycle. Sure, that would be more secure, but much less manageable- and the risk of data leaking at just the right moment is pretty small.
A few vendors, notably Credent, don’t encrypt the entire drive to deal with this problem, but I don’t consider this issue significant enough to discount whole disk encryption solutions like PGP, CheckPoint/Pointsec, Utimaco, etc.
This isn’t a back door or a poorly thought out design feature- it’s a reasonable trade-off of risk to solve a well-known management problem. PGP kind of pisses me off sometimes, but I have to support them on this one.
In short, yes- it’s a security risk, but it’s a manageable risk and not significant enough to warrant the hype. Especially since you can disable (or simply not use) the feature in high-security situations.