Hibernate vs. regular boot
- Ustvarjalec teme Jernej
- Začetni datum
Ni vseeno, ob zagonu je to logično nadaljevanje, ob hibernaciji, bom rekel po domače, pa mora it zopet na začetek iskati nekaj da bo potem šel nazaj na disk, sektor in glava in to odkodiral. Rekel bi da se mora "malo bootati"!
Sa je je tudi kriptirni algoritem, ki je bil v ramu, sedaj zakriptiran s celo ostalo hibernirano vsebino. In kako naj pa potem ve kakšen je algoritem, če ga ne gre najprej poiskati in prebrati z začetka diska!
Sa je je tudi kriptirni algoritem, ki je bil v ramu, sedaj zakriptiran s celo ostalo hibernirano vsebino. In kako naj pa potem ve kakšen je algoritem, če ga ne gre najprej poiskati in prebrati z začetka diska!
Nazadnje urejeno:
SDE -Sophos Disk Encryption razlaga takole: po inštalaciji, ob naslednjem zagonu, se ustvari na disku sektor z označeno napako (zato da ga drugi programi pustijo na miru), na katerega aplikacija zapiše originalni MBR in še svoj MBR na katerega preusmeri boot.
Uporabnika povpraša za geslo s katerim potem po asimetrični metodi zakriptira kodirni ključ s katerim nato po simetrični metodi zakriptira celoten disk in/ali particijo (uporabljen je 256 bitni AES), naredi še nekaj stvari. Vse to se shrani v ta "zanič sektor".
In potem sledi nadaljevanje procedure nalaganja XP-jev, ali česarkoli že.
Ko gre računalnik v hibernacijo, se vsebina celotnega RAM-a zapiše zakriptirano na disk, pc se ugasne. Ob naslednjem zagonu te zopet pozdravi "preBoot" okno, in te povpraša po geslu, itd..., nato se onfly dekriptira hibernacijska datoteka in se zopet celotna naloži v RAM. V naslednjem hipu si zopet tam kjer si končal. Ker pa je hibernacijska datoteka hitro lahko velika 1,5GB ali več, to lahko malo traja. Seveda govorim o rangu 5 do max 10 sekund. Torej računalnik mora izvesti "en majhno" boot proceduro.
Uporabnika povpraša za geslo s katerim potem po asimetrični metodi zakriptira kodirni ključ s katerim nato po simetrični metodi zakriptira celoten disk in/ali particijo (uporabljen je 256 bitni AES), naredi še nekaj stvari. Vse to se shrani v ta "zanič sektor".
In potem sledi nadaljevanje procedure nalaganja XP-jev, ali česarkoli že.
Ko gre računalnik v hibernacijo, se vsebina celotnega RAM-a zapiše zakriptirano na disk, pc se ugasne. Ob naslednjem zagonu te zopet pozdravi "preBoot" okno, in te povpraša po geslu, itd..., nato se onfly dekriptira hibernacijska datoteka in se zopet celotna naloži v RAM. V naslednjem hipu si zopet tam kjer si končal. Ker pa je hibernacijska datoteka hitro lahko velika 1,5GB ali več, to lahko malo traja. Seveda govorim o rangu 5 do max 10 sekund. Torej računalnik mora izvesti "en majhno" boot proceduro.
Pri defragmentaciji diska sem ugotovil, da je hibernacijska datoteka dejansko velika toliko, kolikor imaš RAMa (po eni strani logično, saj si OS s tem vnaprej rezervira in zagotovi prostor na disku).
Vprašanje pa je, ali OS dejansko nalaga celotno datoteko nazaj v RAM, tudi če le-ta ni bil v celoti zaseden
Če ja, potem je jasno zakaj se tako dolgo boota (in potem TC ni kriv za to)
Vprašanje pa je, ali OS dejansko nalaga celotno datoteko nazaj v RAM, tudi če le-ta ni bil v celoti zaseden
Če ja, potem je jasno zakaj se tako dolgo boota (in potem TC ni kriv za to)
Zanimiv je tale odstavek:
The boot key problem
One issue to address in full disk encryption is that the blocks where the operating system is stored must be decrypted before the OS can boot, meaning that the key has to be available before there is a user interface to ask for a password. Most Full Disk Encryption solutions utilize Pre-Boot Authentication by loading a small, highly secure operating system which is strictly locked down and hashed versus system variables to check for the integrity of the Pre-Boot kernel. Some implementations such as BitLocker Drive Encryption can make use of hardware such as a Trusted Platform Module to ensure the integrity of the boot environment. This ensures that authentication can take place in a controlled environment without the possibility of a known operating system vulnerability being used to bypass the encryption.
With a Pre-Boot Authentication environment, the key used to encrypt the data is not decrypted until an external key is input into the system.
Solutions for storing the external key include:
Username / password
Using a smartcard in combination with a PIN
Using a biometric authentication method such as a fingerprint
Using a dongle to store the key, assuming that the user will not allow the dongle to be stolen with the laptop or that the dongle is encrypted as well.
Using a boot-time driver that can ask for a password from the user
Using a network interchange to recover the key, for instance as part of a PXE boot
Using a TPM to store the decryption key, preventing unauthorized access of the decryption key
Use a combination of the above
All these possibilities have varying degrees of security, however most are better than an unencrypted disk.
na naslovu: http://en.wikipedia.org/wiki/Full_disk_encryption
The boot key problem
One issue to address in full disk encryption is that the blocks where the operating system is stored must be decrypted before the OS can boot, meaning that the key has to be available before there is a user interface to ask for a password. Most Full Disk Encryption solutions utilize Pre-Boot Authentication by loading a small, highly secure operating system which is strictly locked down and hashed versus system variables to check for the integrity of the Pre-Boot kernel. Some implementations such as BitLocker Drive Encryption can make use of hardware such as a Trusted Platform Module to ensure the integrity of the boot environment. This ensures that authentication can take place in a controlled environment without the possibility of a known operating system vulnerability being used to bypass the encryption.
With a Pre-Boot Authentication environment, the key used to encrypt the data is not decrypted until an external key is input into the system.
Solutions for storing the external key include:
Username / password
Using a smartcard in combination with a PIN
Using a biometric authentication method such as a fingerprint
Using a dongle to store the key, assuming that the user will not allow the dongle to be stolen with the laptop or that the dongle is encrypted as well.
Using a boot-time driver that can ask for a password from the user
Using a network interchange to recover the key, for instance as part of a PXE boot
Using a TPM to store the decryption key, preventing unauthorized access of the decryption key
Use a combination of the above
All these possibilities have varying degrees of security, however most are better than an unencrypted disk.
na naslovu: http://en.wikipedia.org/wiki/Full_disk_encryption
Pri mojem je bil problem hibernacije v Turbo memory, ki ga je bilo 2GB, RAMa pa 4GB. Potem je v W7 prislo do zmede in prepisovanja levo desno ... ponavadi se sploh ni pobral.
Zdaj dam masino v standby in je. Za hibernacijo niti nimam potrebe. Je pa fino na mac-ih
Zdaj dam masino v standby in je. Za hibernacijo niti nimam potrebe. Je pa fino na mac-ih
Res ja, na macu ne rabim hibernacije, stand by zdrži teden ali več, zbudi pa se v dveh sekundah. Dodatni bonus pa je tole, Windowse imam na virtualni mašini in ko zaprem pokrov, gre mac v sleep. Ko ga odprem, so Windowsi takoj uporabni, ker niso ne spali ne hibernirali. Mac je torej najhitrejša varianta za zbudit WIndowseCitat:
Uporabnik magnum pravi:
Zdaj dam masino v standby in je. Za hibernacijo niti nimam potrebe. Je pa fino na mac-ih
