Protecting information on CD-ROM

[disintegration]

Hi, I'm trying to find the best solution for protecting sensitive data on a CD, without trading off a whole lot of accessibility on the end-user end who will be accessing it. Basically, we'll be shipping data to a consultant and I want to put some sort of encryption/password on the data in case it gets lost in transit or otherwise in the wrong hands.

My best idea has been to wrap the data up in a zip file and password protect it. Any better ideas out there?

-----
Space travel's in my blood.

 

[Sympology]

Zip and passsword? Nope, far two easy to crack. What you need is to encrypt the data. Basically you encrypt the file and send of the cd. You let your consultant know the key and provided the tools to decrypt the file.

The difference between encrytion and password protection is a fairly basic on.

Password Protection:
The file is in no way changed, you just need to type in box to unlock access it.

Encryption.
The file is scrambled using various techniques. You then need the same "key" to unscramble the file. So simply not only do you need a password, but the software to do it as well. Look for bit strength, the higher the better. However the strength you use can depend on your countries laws as many ban the use of 256bit and only allow 64 or 128 bit.

For more info on this do a google on PGP (Pretty Good Privacy). There are loads of commercial and free programs out there.

Stu..

Only the truly stupid believe they know everything.
Stu.. 2004

 

[pansophic]

Zip now uses 128-bit or 256-bit AES encryption when password protecting files (Note that this is WinZip, not the built-in file compression in Windows).

AES 128-bit is at least as good as your SSL connection into your bank account, except on the CD there aren't as many people watching your data go by.


pansophic

 

[disintegration]

Thanks for the tip. I ended up using the built-in support for encrypting a cd with Roxio Easy CD Creator--it utilizes 128-bit encryption as well. Very nice feature!

-----
Space travel's in my blood.

 

[Sympology]

Of course don't do the daft thing that we've seen soooo many times, that is sending the means to unlock with the data. Lost count of how many people send emails with protected files and the password in the same message!

Only the truly stupid believe they know everything.
Stu.. 2004

 

[disintegration]

..of course not.

-----
Space travel's in my blood.

 

[it2hill]

Good Day,

I have always been interested in this sort of thing. We used PGP where I used to work, so when I saw this post it got me thinking. So I did a little research. The following white paper

http://eprint.iacr.org/2004/078.pdf

has some good information on WinZip and alternatives. I am by no means bashing WinZip, nor are they; but it did get me to think twice about using their encryption for sensitive data. It is a good read and worthwhile if you need to secure information.

Hope it helps some.

 

[disintegration]

I looked at PGP in my intial round of assessing how to do this. I never downloaded it, but I understand there's a free version available for a single desktop. How difficult is it to use? ..and how hard is it for the end-user to extract the files?

Thank you for your time.

-----
Space travel's in my blood.

 

[it2hill]

The version we used was a command line based application. We had the encrypt version on the client machines and the decrypt in the office.

The setup was not a problem and it was extremely easy to use. It does require some setup as far as the public / private key goes. Most of the framework was setup before I started. We did have a client who wished to use their own keys and I had to add them to our token.

There is plenty out there on google on the use of these tools, throw a little google-fu on it and you should be up and running in no time.

 

[disintegration]

google-fu. hilarious.

-----
Space travel's in my blood.