分析EFS加解密的过程以及其存在的局限性.doc

分析EFS加解密的过程以及其存在的局限性
分析EFS加解密的过程以及其存在的局限性
EFS（Encrypting File System，加密文件体系）是Windows 2000/XP/VISTA所特有的一个实用功能，关于NTFS卷上的文件和数据，都能够直接被操作体系加密保管。若是硬盘上的文件现已运用EFS进行了加密，即便一个攻击者能拜访到硬盘上，因为没有解密的密钥，文件也是不可用的，在很大程度上提高了数据的安全性。这种特性关于移动用户、经过宽带衔接的用户、对敏感数据有更高安全需求的组织的长处是清楚明了的。
EFS ( Encrypting File System, the encrypting file system ) is a utility function for the typical Windows 2000/XP/VISTA, about NTFS volume of documents and data, can be directly by the operating system encryption storage. If the file on the hard disk has been using EFS for encryption, even if an attacker can visit to the hard disk, because there is no decryption key, the file is not available, greatly improve the security of data. The characteristics of mobile users, through a broadband connection, the user of sensitive data has higher security needs of the advantage is clear.
　　EFS能够被以为除NTFS外的第二层防护，为拜访一个被加密的文件，用户有必要有拜访到文件的NTFS权限。在关联NTFS权限的用户能看到文件夹中的文件，但不能翻开文件除非有相应的解密密钥。相同，一个用户有相应的密钥但没有相应的NTFS权限也不能拜访到文件。所以一个用户要能翻开加密的文件，一起需求NTFS权限宽和密密钥。
EFS can be considered the second layer of protection in addition to NTFS, to visit an encrypted file, the user need to visit to the file NTFS permission. The association of NTFS users can see the files in a folder, but the file could not be opened unless there is a corresponding decryption key. The same, a user has a corresponding key but no corresponding NTFS permissions cannot visit to a file. So a user can open the encrypted file, together with the requirement of NTFS access width and secret key.
　　EFS加密是根据公钥战略的。在运用EFS加密一个文件或文件夹时，体系首要会生成一个由伪随机数组成的FEK (File Encryption Key，文件加密钥匙)，然后将运用FEK和数据扩大规范X算法创立加密后的文件，并把它存储到硬盘上，一起删去未加密的原始文件。随后体系运用用户的公钥加密FEK，并把加密后的FEK存储在同一个加密文件中。而在拜访被加密的文件时，体系首要运用当时用户的私钥解密FEK，然后运用FEK解密出文件。
The EFS encryption is based on public key strategy. In the use of EFS encrypt a file or folder, the system first generates a composed of pseudo random number FEK ( File Encryption Key, file encryption keys ), and then by using FEK and data to expand the specification of X algorithm create encrypted files, and store it to the hard disk, delete the original unencrypted. File. Then the system using the user's public key encryption FEK, and put the encrypted FEK stored in the same file encryption. The encryption is in visiting files, system used in the first private key to decrypt the FEK when the user, and then use FEK to decrypt the file.
　　二、运用EFS的长处
Two the use of EFS.
　　EFS加密机制和操作体系紧密联系，因而不用为了加密数据装置额定的软件，节省了运用本钱。拜访一个加密的文件不需求用户任何的操作，而从前的第三方的文件加密东西需求用户每次拜访文件时键入口令，它们并没有与文件体系或操作体系进行无缝地集成。
EFS encryption mechanism and operation system are closely connected, so do not have to encrypt data device rated software, saves the use cost. Visit an encrypted file does not need any user operation, and the former third party file encryption things needs of users visit file type the password, they are not with the file system or operating system for seamless integration.
　　EFS集成进文件体系，因而一个歹意的用户不能绕过文件体系拜访到硬盘，并且，一切运转在内核方式的EFS驱动程序不能由用户直接拜访。
EFS integrated into the file system, so a user a baleful can not bypass the file system calls to the hard disk, and, all running in kernel mode EFS driver cannot be directly accessed by the user.
　　EFS加密体系对用户是通明的。若是某用户加密了一些数据，那么该用户对这些数据的拜访将是彻底答应的，并不会遭到任何约束。而其他非授权用户企图拜访加密过的数据时，就会收到“拜访回绝”的过错提示。EFS加密的用户验证进程是在登录Windows时进行的，只需登录到Windows，就能够翻开任何一个被授权的加密文件。
The EFS encryption system is transparent to the user. If a user to encrypt the data, then the user of these data will be completely to visit, and was not subject to any constraint. While other unauthorized users attempt to visit the encrypted data, will receive the " visit to " the fault tips. User authentication process of EFS encryption is performed in the login Windows, simply login to the Windows, you can open any authorized encrypted file.
　　EFS暗码组联系了对称加密（DESX）和非对称加密（RSA）的长处，数据运用对称加密进行加密，优于对数据运用非对称加密（用这种办法仅FEK被加密）。
EFS password group symmetric encryption ( DESX ) and asymmetric encryption ( RSA ) strengths, data encryption using symmetric encryption, is better than that of the data by using asymmetric encryption ( in this way, only FEK is encrypted ).
　　Windows 的CryptoAPI体系答应用户在智能卡上存取他们的私钥，这比将钥匙放在硬盘或软盘上更为安全，这也使多个方位拜访成为能够。
Windows CryptoAPI system allows the user in a smart card access their private key, this ratio will be the key on the hard disk or floppy disks is more safe, it also makes a range of visit to become.
　　三、怎么运用EFS加密
Three, how to use EFS encryption
　　当一个用户运用EFS去加密文件时，有必要存在一个公钥和一个私钥，若是用户没有，EFS效劳将会主动发作一对。关于初级用户来说，即便他彻底不懂加密，也能加密文件，能够对单个文件进行加密，也能够对一个文件夹进行加密，这样一切写入文件夹的文件将主动被加密。
When a user uses EFS to encrypt the file, it is necessary to have a public key and a private key, if the user does not have EFS service, will take the initiative to attack a pair. On the primary users, even if he is not completely understand encryption, can encrypt files, can encrypt files, can also encrypt a folder, and all write folder file will automatically be encrypted.
　　一旦用户发布指令加密文件或企图增加一个文件到一个已加密的文件夹中，EFS将进行以下几步：
Once the user issued a command file encryption or attempt to add a file to an encrypted folder, EFS will carry out the following steps:
　　第一步：文件被复制到暂时文本文件，当复制进程中发作过错时运用此文件进行康复。
The first step: the file is copied to a temporary file, when rehabilitation using this file replication during fault.
　　第二步：文件被一个随机发作的Key加密，这个Key叫作文件加密钥匙（FEK），FEK的长度为128位（仅US和Canada），这个文件运用DESX加密算法进行加密。
The second step: the file is a random attack Key encryption, the Key called document encryption key ( FEK ), the length of the FEK is 128 bits ( US and Canada ), this paper uses DESX encryption algorithm for encryption.
　第三步：发作数据加密区域Data Decryptong Field（DDF），这个区域包括了运用RSA加密的FEK和用户的公钥。
The third step: Data Decryptong Field attack data encryption area ( DDF ), this region includes the use of RSA FEK and the user's public key encryption.
　　第四步：若是体系设置了加密的署理,EFS一起会创立一个数据康复块Data Recovery Field（DRF)，然后把运用康复署理密匙加密过的FEK放在DRF。这个区域的意图是为了在用户解密文件的进程中能够解密文件不可用（丢掉Key、脱离公司等）。
The fourth step: if the system set up encrypted proxy, EFS will create a data recovery block of Data Recovery Field ( DRF ), and then the application of rehabilitation acting key encryption of FEK on DRF. The region 's intention is to be able to decrypt the file is not available in the user declassified documents process ( lost Key, out of the company .).
　　第五步：包括加密数据、DDF及一切DRF的加密文件被写入磁盘。
The fifth step: including the encrypted data, DDF and DRF all encrypted file is written to disk.
　　第六步：在第一步中创立的文本文件被删去。
The sixth step: founded in the first step of the text file is deleted.
　　下面的进程在数据被解密时发作：
The following process is decrypted when data attack:
　　第一步：运用DDF和用户的私钥解密FEK。
The first step: the use of DDF and the user's private key to decrypt the FEK.
　　第二步：运用FEK解密文件。
The second step: the use of FEK declassified documents.
　　在康复署理康复文件的进程中，相同的进程发作，除了在第一步中运用DRF而不是DDF。
In the rehabilitation acting rehabilitation file in the process, the same process occurs, in addition to the use DRF instead of DDF in the first step.
　　此外还能够在指令行方式下用“cipher”指令完结对数据的加密宽和密操作，至于“cipher”指令更具体的运用办法则能够经过在指令符后输入“cipher/?”并回车取得。
Also can use the " cipher " command in the command line mode of data over Gamikwan and close operation, as for the " cipher " command more specific usage can through the input " cipher/ directive? " and press enter to obtain.
　　注意事项：若是把未加密的文件复制到具有加密特点的文件夹中，这些文件将会被主动加密。若是将加密数据移出来，若是移动到NTFS分区上，数据照旧坚持加密特点；若是移动到FAT分区上，这些数据将会被主动解密。被EFS加密过的数据不能在Windows中直接同享。若是经过网络传输经EFS加密过的数据，这些数据在网络上将会以明文的方式传输。NTFS分区上保管的数据还能够被紧缩，不过一个文件不能一起被紧缩和加密。Windows的体系文件和体系文件夹也无法被加密。
Note: if the copy is not encrypted files to the folder with encryption features, these files will be active encryption. If the encrypted data is moved out, if the move to the NTFS partition, data encryption features still adhere to; if the move to the FAT partition, these data will be automatically declassified. Be EFS encrypted data can not be directly share in Windows. If the network transmission by EFS encrypted data, the data will be transmitted direct way in the network. Keeping the NTFS partition data can also be tight, but a file cannot be compression and encryption. The system file Windows and the system folder cannot be encrypted.