Microsoft has been busy espousing the security of its new hard drive functionality in Vista. However, it appears to have something of a confused message.
Vista includes Bitlocker technology. It uses a Trusted Platform Module - hardware built into the motherboard - to encrypt and decrypt data coming from the hard drive. If you remove the hard drive, you lose the decryption key on the motherboard and the data is totally secure, enabling the secure disposal of hard drives.
The data is secured with AES (Advanced Encryption Standard), which is used commonly in computing applications including e-commerce.
Nick McGrath, speaking at the Infosec 2006 conference, said that the technology was "100% secure." Despite rumours to the contrary, there will be no 'backdoor' to allow the government access, Nick confirmed.
However, Steve Lamb, a Microsoft engineer, then asserted that Bitlocker would not help criminals / terrorists / paedophiles / music pirates by allowing them to safeguard their data from police authorities. "You can always break an encryption algorithm if you throw enough horsepower at it," he explained.
So wait... is this 100% secure or not?
From our own knowledge of security, 128-bit or 256-bit AES encryption is so secure, there's virtually no chance of ever decrypting it, even if you took every computer in the world and threw it at the task.
The security of Bitlocker in Vista, then, will depend on how Microsoft implements AES. With 256-bit, there's virtually no chance of anyone ever getting at the data - unless the government has got some super secret AES-breaker that the world at large does not possess.
Is Microsoft doing the right thing in bringing stronger encryption to the mass market? Is this great for privacy freaks or bad for the security of our country? Let us know what you think over in the forums.