isec: excellence in engineering encrypted file system key recovery philip noble (520) 538-7608 or...
TRANSCRIPT
ISEC: Excellence in Engineering
Encrypted File System Key Recovery
Philip Noble(520) 538-7608 or DSN 879-7608,
[email protected] U.S. Army Information Systems Engineering Command
Fort Huachuca, AZ 85613-530027 Jul 11
ISEC: Excellence in Engineering
The introduction of Microsoft’s Encrypted File System has been a boon to file-level security within the DoD. If a laptop is lost, critical data such as HIPAA or PII is not readily recoverable by the finder provided the sensitive data was previously encrypted with either EFS or Bit Locker. Certain versions of the current Army operating system appear to be configured to require the use of the user’s Common Access Card (CAC) to encrypt the symmetrical session key that physically encrypts the user’s files. When the user has to get a new CAC, they discover that the files are no longer accessible. Even after the user’s old Email Encryption key is recovered, the user cannot recover the encrypted files because the user cannot use a software private key because of security settings.
The Problem:
ISEC: Excellence in Engineering
The following slides identify the procedure to enable the use of a software key to recover encrypted files.
The Solution:
The solution is to either:
•Install the software private key on a hardware token
•Request the responsible Key Recovery Agent decrypt the symmetrical key for the user
•Change the security settings to allow the use of a software private key.
The simplest choice is to permit the use of a Software private Key
ISEC: Excellence in Engineering
http://technet.microsoft.com/en-us/library/cc749610(WS.10).aspx
Microsoft Technet discusses the Group Policy Object that controls the use of hardware and software keys for EFS.
Use the Group Policy Management Console (gpedit.msc) or the Local Group Policy Editor (secpol.msc) to configure the EFS options. To view or change the options, expand the Public Key Policies node, right-click Encrypting File System, and then click Properties.
The Policy in question is: Require a smart card for EFS - If enabled, software certificates cannot be used for EFS.
Set this policy to disabled for use of a soft certificate to recover an EFS file system.
Software EFS Recovery
ISEC: Excellence in Engineering
Additional Notes:
1. After the setting is applied, the user may need to run "gpupdate.exe /force" or reboot the platform to inherit the new configuration. 2. The setting should only be temporarily modified for recovery purposes and then reset to require smart cards. 3. There is also a known issue with some versions of the enpasflt.dll and the import of the soft recovery certs.
Software EFS Recovery
ISEC: Excellence in Engineering
Software EFS RecoveryTo open encrypted files stored on a system partition after re-installing the operating system, follow the steps below to re-install your original certificate and key.
•Save the recovered Encryption key from the DISA ARA website
•Open Certificate Manager by clicking the Start button , typing certmgr.msc into the Search box, and then pressing ENTER.
•Click the Personal folder.
•Click the Action menu, point to All Tasks, and then click Import. This opens the Certificate Import wizard.
•Click Next.
•Type the location of the file that contains the certificate, or click Browse and navigate to the file's location, and then click Next.If you have navigated to the right location but don't see the certificate you are importing, then, in the list next to the File name box, click Personal Information Exchange.
•Type the password, select the Mark this key as exportable check box, and then click Next.
NoteDo not enable strong private key protection.
•Click Place all certificates in the following store, confirm that the Personal store is indicated, click Next, and then click Finish.
After you import the certificate, shut down and restart your computer (not a reboot), you should have access to the encrypted files.
ISEC: Excellence in Engineering
POC for Additional Information
Philip E. Noble USAISEC Information Assurance and Security Engineering Directorate (IASED) DSN 879-7608 CML 520-538-7608 FAX DSN 879-8709 CML 520-538-8709 [email protected] [email protected] [email protected]