I want my filenames to be secret

hi all,

I have a new problem to propose. I am writing a FS filter which should
crypt the names of the files contained in a specific folder. So far I
have found two viable strategies:

  1. Crypt names in the IRP_MJ_CREATE and decrypt them in the
    IRP_MJ_DIRECTORY_CONTROL. This approach normally works but it may fail
    when using short names. In fact when I crypt a filename, the FS builds
    a short name based on a hash which once decrypted does not map to the
    corresponding short name.
    The only solution I have found is to manually change the short name
    each time I change the long one. The problem is that, as far as I
    know, only Windows XP accepts a ZwSetInformationFile with the
    FileShortName option.

  2. Crypt the structure of a directory while the system is writing it.
    By filtering the IRP_MJ_WRITE, I have seen Windows writes the
    structure through a usual paging IO. The problem is how to recognize
    an operation that is concerned with the directory I want to crypt.
    Also I wonder if this approach might produce side effects I don’t see
    at the moment. I have seen the file objects that updates directory
    structure (and FAT) are not created through a IRP_MJ_CREATE; I guess
    they are built internally by the file system.

What is the best approach as far as you know?

Thanks.
Francesco Garelli, Ph.D.

Why ever crypting the names? Just use CryptGenRandom to invent them, as
IE’s cache does, this is enough.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Francesco Garelli”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, January 13, 2005 9:50 PM
Subject: [ntfsd] I want my filenames to be secret

> hi all,
>
> I have a new problem to propose. I am writing a FS filter which should
> crypt the names of the files contained in a specific folder. So far I
> have found two viable strategies:
>
> 1) Crypt names in the IRP_MJ_CREATE and decrypt them in the
> IRP_MJ_DIRECTORY_CONTROL. This approach normally works but it may fail
> when using short names. In fact when I crypt a filename, the FS builds
> a short name based on a hash which once decrypted does not map to the
> corresponding short name.
> The only solution I have found is to manually change the short name
> each time I change the long one. The problem is that, as far as I
> know, only Windows XP accepts a ZwSetInformationFile with the
> FileShortName option.
>
>
> 2) Crypt the structure of a directory while the system is writing it.
> By filtering the IRP_MJ_WRITE, I have seen Windows writes the
> structure through a usual paging IO. The problem is how to recognize
> an operation that is concerned with the directory I want to crypt.
> Also I wonder if this approach might produce side effects I don’t see
> at the moment. I have seen the file objects that updates directory
> structure (and FAT) are not created through a IRP_MJ_CREATE; I guess
> they are built internally by the file system.
>
>
> What is the best approach as far as you know?
>
>
> Thanks.
> Francesco Garelli, Ph.D.
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

May be I haven’t explain clearly.
Basically I want to crypt the name of
the files (for example in the folder Documents), so
that if you take out the hard disk from my pc,
you cannot see the original name of the files
unless you have the filter and a key.

Why ever crypting the names? Just use CryptGenRandom to invent
them, as
IE’s cache does, this is enough.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Francesco Garelli”
> To: “Windows File Systems Devs Interest List”
> Sent: Thursday, January 13, 2005 9:50 PM
> Subject: [ntfsd] I want my filenames to be secret
>
>
>> hi all,
>>
>> I have a new problem to propose. I am writing a FS filter which
>> should crypt the names of the files contained in a specific folder.
>> So far I have found two viable strategies:
>>
>> 1) Crypt names in the IRP_MJ_CREATE and decrypt them in the
>> IRP_MJ_DIRECTORY_CONTROL. This approach normally works but it may
>> fail when using short names. In fact when I crypt a filename, the FS
>> builds a short name based on a hash which once decrypted does not map
>> to the corresponding short name.
>> The only solution I have found is to manually change the short name
>> each time I change the long one. The problem is that, as far as I
>> know, only Windows XP accepts a ZwSetInformationFile with the
>> FileShortName option.
>>
>>
>> 2) Crypt the structure of a directory while the system is writing it.
>> By filtering the IRP_MJ_WRITE, I have seen Windows writes the
>> structure through a usual paging IO. The problem is how to recognize
>> an operation that is concerned with the directory I want to crypt.
>> Also I wonder if this approach might produce side effects I don’t see
>> at the moment. I have seen the file objects that updates directory
>> structure (and FAT) are not created through a IRP_MJ_CREATE; I guess
>> they are built internally by the file system.
>>
>>
>> What is the best approach as far as you know?
>>
>>
>> Thanks.
>> Francesco Garelli, Ph.D.
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

I would suggest that this falls more in the realm of a custom file
system, rather than a file system filter driver, since your goal has now
become to protect the file system meta data itself - something that
really requires cooperation with the file system.

Of course, this assumes you want a file system level solution at all - a
more practical solution is probably just to encrypt the entire logical
block device (volume) or physical block device (disk/partition). Then
nobody can read those directory contents without the appropriate keys.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the Next OSR File Systems Class April
4, 2004 in Boston!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Francesco
Sent: Friday, January 14, 2005 3:43 PM
To: ntfsd redirect
Subject: Re:[ntfsd] I want my filenames to be secret

May be I haven’t explain clearly.
Basically I want to crypt the name of
the files (for example in the folder Documents), so
that if you take out the hard disk from my pc,
you cannot see the original name of the files
unless you have the filter and a key.

Why ever crypting the names? Just use CryptGenRandom to invent
them, as
IE’s cache does, this is enough.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Francesco Garelli”
> To: “Windows File Systems Devs Interest List”
> Sent: Thursday, January 13, 2005 9:50 PM
> Subject: [ntfsd] I want my filenames to be secret
>
>
>> hi all,
>>
>> I have a new problem to propose. I am writing a FS filter which
>> should crypt the names of the files contained in a specific folder.
>> So far I have found two viable strategies:
>>
>> 1) Crypt names in the IRP_MJ_CREATE and decrypt them in the
>> IRP_MJ_DIRECTORY_CONTROL. This approach normally works but it may
>> fail when using short names. In fact when I crypt a filename, the FS
>> builds a short name based on a hash which once decrypted does not map
>> to the corresponding short name.
>> The only solution I have found is to manually change the short name
>> each time I change the long one. The problem is that, as far as I
>> know, only Windows XP accepts a ZwSetInformationFile with the
>> FileShortName option.
>>
>>
>> 2) Crypt the structure of a directory while the system is writing it.
>> By filtering the IRP_MJ_WRITE, I have seen Windows writes the
>> structure through a usual paging IO. The problem is how to recognize
>> an operation that is concerned with the directory I want to crypt.
>> Also I wonder if this approach might produce side effects I don’t see
>> at the moment. I have seen the file objects that updates directory
>> structure (and FAT) are not created through a IRP_MJ_CREATE; I guess
>> they are built internally by the file system.
>>
>>
>> What is the best approach as far as you know?
>>
>>
>> Thanks.
>> Francesco Garelli, Ph.D.
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

> ----------

From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Tony Mason[SMTP:xxxxx@osr.com]
Reply To: Windows File Systems Devs Interest List
Sent: Friday, January 14, 2005 9:51 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] I want my filenames to be secret

Of course, this assumes you want a file system level solution at all - a
more practical solution is probably just to encrypt the entire logical
block device (volume) or physical block device (disk/partition). Then
nobody can read those directory contents without the appropriate keys.

I’d agree. Similarly, it is possible to use an encrypted virtual drive; data are stored in a file which is mounted as a volume. There are several such products available and it is (much) easier to develop it then custom filesystem.

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]

>I’d agree. Similarly, it is possible to use an encrypted virtual drive; data
are stored in a file which

is mounted as a volume. There are several such products available and it is
(much) easier to
develop it then custom filesystem.

Yes, much easier, unless you want to encrypt HIBERFIL.SYS

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Maxim S. Shatskih wrote:

Yes, much easier, unless you want to encrypt HIBERFIL.SYS

Not that this is even relevant, but NEITHER approach (FS filter or
“ordinary” disk block filter) will allow you to encrypt hibernation or
crash file data when it’s written.

Peter
OSR