u.trust LAN Crypt for Windows · 11.0.0 · English

Encryption

PDF herunterladen HerstellerquelleImportierter Dokumentationsstand – bitte Produktversion beachten.

Kapitel: Encryption

Transparent encryption

For the user, transparent encryption means that all data stored in encrypted form (in encrypted folders or drives) is automatically decrypted in main memory as soon as it is opened by an application (such as Office). When the file is saved, it is automatically re-encrypted. Transparent encryption covers all file operations. Because all processes run in the background, users don’t notice when they work with encrypted files.

Note

u.trust LAN Crypt cannot encrypt files, for which NTFS compression or EFS encryption is used under the NTFS file system of Windows. However, the wizard for initial encryption offers the possibility to decompress or decrypt NTFS-compressed and/or EFS-encrypted files during initial encryption, if an encryption rule exists. The files are then encrypted by u.trust LAN Crypt according to the encryption rules. Whether the user has the possibility to decompress NTFS-compressed files or to decrypt EFS-encrypted files, if necessary, must be determined by the Security Officer in advance.

Encryption does not depend on folders, but only on encryption rules. The encryption works as follows:

All files for which an encryption rule exists are automatically encrypted.
When files are moved or copied to an encrypted folder, they are encrypted according to the encryption rule defined for that folder. The Security Officer can define several encryption rules for different file types or file names located in the same folder via the u.trust LAN Crypt Administration. For example, you can encrypt Word files with a different rule than Excel files, even though both files are located in the same folder.
When you rename encrypted files, they remain encrypted (unless another encryption rule or no encryption rule exists for the new file name or extension).
If a user copies or moves encrypted files to a location where the previous encryption rule no longer applies, they are automatically decrypted.

Note

This does not apply if a user moves files to another folder within the same network share. In this case, the files remain encrypted, even if no encryption rule exists.

If the Security Officer or System Administrator has enabled the Persistent Encryption feature via the u.trust LAN Crypt Group Policy (GPO), encrypted files remain encrypted even if they are moved or copied to another folder or location for which no encryption rule exists (e.g., on an USB stick).
If a user copies or moves encrypted files to a location that has an encryption rule, the files are first decrypted and then encrypted using the other key defined for that location.

Access to encrypted data

If there is no key and no Encryption Rule in a user’s encryption policy for a specific folder, the user is not allowed to access the encrypted files in that folder. The user is not allowed to read, copy, move, rename, delete, etc. any encrypted file in that folder.

If the user has the key with which the files are encrypted, he can open them even if his encryption profile for that location or folder does not include an encryption rule.

Integration of u.trust LAN Crypt 2Go

Files that have been password encrypted by u.trust LAN Crypt 2Go can be opened and edited with u.trust LAN Crypt for Windows since version 4.2.0. This requires that the required key exists within the user’s encryption policy.

After viewing or editing the file, it can still be freely encrypted and decrypted with the same key by u.trust LAN Crypt 2Go and all other u.trust LAN Crypt applications that support u.trust LAN Crypt 2Go or password-based encryption and decryption.

Rename or move a folder

For performance reasons u.trust LAN Crypt does not change the encryption status when moving whole folders within a drive via Windows Explorer. This means that no encryption, un-encryption or re-encryption occurs when moving a whole folder.

If the files in such folders were encrypted, they will remain encrypted under the new folder name or in the new location. If the user has the corresponding key, he can work with these files as usual.

The behavior is different when moving files or folders to another partition or to USB storage devices for which no encryption rule has been set. If the u.trust LAN Crypt feature Persistent Encryption is not activated, the files will be decrypted when moved to such media. If the Security Officer or the System Administrator has activated Persistent Encryption for the clients, the files remain encrypted.

Note

However, this only applies if there is no encryption rule for the new storage location. If there is, however, the files will be encrypted according to the encryption rule applicable to the new storage location.

Secure move

u.trust LAN Crypt supports the secure moving of files and folders. When moving files through u.trust LAN Crypt, the files are encrypted, decrypted or re-encrypted at the new location according to the applicable encryption rules. Afterwards the source files are securely deleted.

This function is available via the entry u.trust LAN Crypt -> Secure move in the Windows Explorer context menu of u.trust LAN Crypt. Via a dialog you can then select where the files should be moved to.

Explicit decryption of files

To decrypt a file, you only need to copy or move it to a folder without encryption rules. The file is then automatically decrypted.

Prerequisites:

a corresponding encryption profile is loaded
the user has the required key
the active encryption profile does not contain an encryption rule for the new location
Persistent Encryption is not active

Note

u.trust LAN Crypt can also encrypt offline folders in Windows. However, problems can occur in connection with virus scanners. More detailed information about known problems with virus scanners can be found in the version information of the u.trust LAN Crypt Client.

Delete encrypted files

When your encryption rule is loaded, you can delete any encrypted file for which you have a key.

Note

Actually, deleting files is about moving the files to the Windows Recycle Bin. To ensure the highest security standard, the files encrypted with u.trust LAN Crypt remain encrypted even in the recycle bin. No key is necessary to empty the recycle bin.

Files and folders excluded from encryption

The following files and folders are automatically excluded from encryption, even if an encryption rule has been defined for them:

Files in the u.trust LAN Crypt installation folder.
Files in the Program Files and Program Files (x86) folders.
Files in the Windows installation folder.
Files in the Windows.old folder.
Policy file cache.

The location is specified in the u.trust LAN Crypt Administration and is displayed in the Profile tab of the dialog Status.

Root directory of the system drive. Subfolders are not excluded.
Indexed Locations (search-ms).
Files in folders which are defined in u.trust LAN Crypt with an exclude or ignore rule.

Persistent encryption

For u.trust LAN Crypt a Security Officer or System Administrator can configure the Persistent Encryption via a u.trust LAN Crypt Group Policy (GPO). Files are normally only encrypted if they are subject to an encryption rule.

For example, if a user copies an encrypted file to a folder for which no encryption rule is defined, the file is decrypted in the destination folder. However, if Persistent Encryption is enabled, files remain encrypted even if they are moved or copied to another location for which no encryption rule is defined.

Security Officers or System Administrators can set this behavior via a u.trust LAN Crypt Group Policy (GPO). If Persistent Encryption is deactivated, files are decrypted if they are copied or moved to a location for which there is no encryption rule. In this way, files can be decrypted, e.g., to be sent as an email attachment. However, it would be better to leave Persistent Encryption enabled and instead copy such files to a folder that has an ignore or exception rule. In this way, the protective function of Persistent Encryption could continue to be maintained and at the same time there could be a storage location in which users could explicitly decrypt files, for example to send them as e-mails.

The following rules apply to Persistent Encryption:

The u.trust LAN Crypt driver only keeps the name of the file without any path information. Only this name can be used for comparison and therefore will only catch situations where the name of the source and the target file is identical. If the file is renamed during the copy operation, the resulting file is considered to be a ‘different’ file and thus not subject to the Persistent Encryption.
When a user saves an encrypted file with Save As in a location not covered by an encryption rule, the file will be stored decrypted.
Information about files is kept for a limited time only. If the operation takes too long (more than 15 seconds), the newly created file is considered to be a different, independent file and thus not subject to the Persistent Encryption.

Note

Persistent Encryption uses the Windows Tunneling Cache. If a thread opens an encrypted file and then creates a file with the same name within the tunneling interval (default: 15 s), the new file will be encrypted automatically, regardless of the target path and even if no encryption policy exists for that location. This behavior is system‑dependent and should be considered when using LAN Crypt.

Persistent encryption vs. encryption rule

Persistent Encryption ensures that an encrypted file retains its encryption state, i.e., the original encryption key. This works well with Persistent Encryption if the file is copied or moved to a folder without an encryption rule. However, if the file is copied or moved to a location that has a different encryption rule, that encryption rule takes precedence over Persistent Encryption. The file is then converted according to the encryption rule for that location, using the encryption algorithm (for example, AES) and key defined for that location.

Persistent encryption vs. ignore path rule

An Ignore path rule overrides Persistent Encryption. This means that encrypted files that are copied to a folder with an applicable Ignore path are decrypted.

An Ignore path rule is primarily used for files that are accessed very frequently, and for files that do not have a particular reason to be encrypted. This improves system performance.

Persistent encryption vs. exclude path rule

An Exclude path rule overrides Persistent Encryption. This means encrypted files that are copied to a folder with an applicable Exclude path are decrypted.

Limitations on persistent encryption

Persistent Encryption has some limitations.

Files that are supposed to remain plain are encrypted

Unencrypted files are copied to multiple locations with and without applying encryption rules.

If an unencrypted file is copied to several locations at the same time, with one location having an encryption rule applied, all copies of that file might be encrypted too.
If an unencrypted file is copied to an encrypted location the file is added to the encryption tool’s internal list. When a second copy of the file is created, the encryption tool finds the file name in its list and also encrypts the second copy.

Create a file with the same name after accessing an encrypted file

If an encrypted file is opened (accessed) and a new file with the same name is created shortly afterwards, the newly created file is encrypted with the same key as the first file.
This only applies if the same application / thread is used for reading the encrypted file as well as creating the new one.

For example: In Windows Explorer right-click in a folder with an encryption rule and click New -> Text document. Immediately right-click in a folder without an encryption rule and click New -> Text document. The second file is also encrypted.

Files are not encrypted

Multiple copies of a file are created

If copies of an encrypted file are created in the same folder as the original file, these copies are not encrypted. Since the created copies have different file names (for example doc.txt vs. docCopy.txt) the matching of the file name fails and therefore they are not encrypted by Persistent Encryption.

Client API and encryption tags for DLP products

If a Data Loss Prevention (DLP) product identifies data that needs to be encrypted, it can use the u.trust LAN Crypt Client API to encrypt these files. In u.trust LAN Crypt Administration (see Admin help), you can define different encryption tags that specify the u.trust LAN Crypt key to be used. The Client API can use these predefined encryption tags in order to apply special keys for different content. For example, the encryption tag \<CONFIDENTIAL\> to encrypt all files that are categorized as confidential by your DLP product.

Deactivating / activating transparent encryption

If transparent encryption is deactivated in the u.trust LAN Crypt User menu, files that are accessed after deactivation of transparent encryption are no longer encrypted and decrypted automatically. Newly-generated files also remain unencrypted, even if the user’s encryption profile includes an encryption rule for them.

Note

The settings, which functions or elements can be selected via the user menu, can be set by the Security Officer or System Administrator via the u.trust LAN Crypt Group Policy (GPO). This way the client can be configured in such a way that the user cannot deactivate the transparent encryption.

In comparison, disabling Persistent Encryption causes encrypted files to be decrypted when they are copied / moved to a location or folder where no encryption rule exists. The rule-based automatic encryption and decryption function for folders and files (see Transparent Encryption) remains in effect when you deactivate Persistent Encryption. The configuration of the Persistent Encryption is also done by the Security Officer or System Administrator via a u.trust LAN Crypt Group Policy (GPO).

If you have the Persistent Encryption feature enabled, encrypted files remain encrypted even if they are copied or moved to a location or folder without an encryption rule. If you use Persistent Encryption , it is not necessary to disable transparent encryption before copying encrypted files to another location. Persistent Encryption ensures that files remain encrypted even if they are accidentally moved to another folder or if the user forgets to disable encryption before moving or copying. You must restart your computer for any changes made to the Persistent Encryption (enabled or disabled) to take effect.

Note

If Persistent Encryption is enabled and a user moves or copies a file to a folder to which an Ignore or Exclude rule applies, this will result in the file being decrypted. Also note that changing the Persistent Encryption setting requires a restart of the client computer. The previously defined setting remains valid until the computer is restarted.

Transparent encryption and file-compression tools

File-compression tools open files, read the file contents and compress it. If transparent decryption / encryption is enabled, file-compression tools will receive the decrypted files and the files will be compressed. The files in the resulting archive are no longer encrypted. If the archive is stored in a directory for which no encryption rule exists, all stored files are decrypted.

If Persistent Encryption is enabled, the files will not be compressed in encrypted form. However, the archive file itself remains encrypted and can only be read by a user who has the necessary key. A prerequisite for this is, however, that archive files are also subject to an encryption rule.

However, if you also want to use compression programs to pack encrypted files into an archive file, transparent encryption must be disabled before using such programs. This procedure is usually only necessary if no encryption rule exists for the archive file to be created.

However, if such an encryption rule exists, the files within the created archive file would be unencrypted, but the archive file itself would be encrypted according to the encryption rule defined for this purpose, and thus securely protected against unauthorized access.

Another way to ensure that files are packed into an archive file in encrypted form is to define compression programs as an unhandled application. If necessary, this can be configured by the Security Officer (MSO / SO) or System Administrator via the u.trust LAN Crypt Group Policy (GPO).

Cloud synchronization

Major cloud synchronization applications, including Microsoft OneDrive, Google Drive, and Nextcloud, are configured to automatically register themselves upon installation. By default, these applications, along with any associated child processes, are prevented from accessing the contents of encrypted files.

If you wish to extend this restriction to additional cloud applications and their child processes, preventing them from reading encrypted file contents, you can do so by making modifications to the system registry as described below:

Key: HKLM\SYSTEM\CurrentControlSet\Services\cplcdt2\Parameters

Setting: IgnoredCloudSyncApps

Type: REG_MULTI_SZ

Initial encryption and explicit encryption

After u.trust LAN Crypt has been installed, you need to perform initial encryption process. During this process, all files are encrypted using the loaded encryption profile. This initial encryption can be performed using:

the u.trust LAN Crypt system tray icon, see User application
u.trust LAN Crypt Explorer extensions, see Explorer extensions
the lcinit.exe tool, which also supports Unattended mode, see Initial encryption in Unattended mode

In addition to performing the initial encryption of entire folders, the lcinit.exe command line tool, together with the Explorer extensions, can also be used to encrypt, decrypt and re-encrypt individual files.

Note

During initial encryption, the files are displayed lexicographically sorted.

Targeted explicit encryption, decryption or re-encryption might be necessary in these cases:

If plain (unencrypted) files are located in a directory for which an encryption rule exists.
If encrypted files are located in a directory for which no encryption rule exists.
If files in an encrypted directory are encrypted with the wrong key.
If the encryption rules in the encryption profile have changed.
If files are encrypted with several keys.

The initial encryption wizard

The initial encryption tool, lcinit.exe , offers a wizard with a graphical user interface. This wizard supports

encrypting, decrypting and re-encrypting files
checking the encryption status of files -even in folders and subfolders

You can start this wizard

by clicking the Taskbar icon
by going to Start/u.trust LAN Crypt Client/Initial encryption
by double-clicking on lcinit.exe in the u.trust LAN Crypt Program folder.

Note

The encryption, decryption and re-encryption processes are always performed in accordance with the encryption profile. That is why you have to load an encryption profile.

Performing initial encryption

Step 1: Start the wizard, see User menu.

Step 2: Select the Perform initial encryption option in Step 1 / 5.

Step 3: Click Next. Step 4: Now define how files are to be handled in Step 2 / 5.

Encrypt files in accordance with profile: If you select this option, the files will be encrypted according to the rules contained in the user’s profile (default setting). If the system finds already encrypted files, they will be ignored.
Re-encrypt files in accordance with profile: If you select this option, files encrypted with a different key than the one defined in the profile will (also) be decrypted and encrypted with the correct key.

Note

A prerequisite for this procedure is that the key which has been used for encrypting the file(s) in the first place is contained in the user’s profile.

Step 5: Click Next. Step 6: Now specify in step 3 / 5 the drives, folders and subfolders that you want to include in the initial encryption or decryption process. Folders that are specified in the rules can be selected with the Profile Rules button.

Selected drives and folders are marked with a check mark. A checkmark with an additional “+” sign next to a folder indicates that there are other subfolders in the folder that are not being processed, that means, where no encryption/encryption of files is performed. If these are also to be processed, they must also be marked with a check mark by a mouse click.

Click Profile Rules to automatically select all the directories for which the user’s profile contains encryption rules.

Click Advanced to access extra options:

Note

The settings which can be changed by the user depend on the configuration of the u.trust LAN Crypt Client. The Security Officer defines the configuration centrally.

Decrypt EFS encrypted files if necessary: Select this option to decrypt and re-encrypt EFS encrypted files. Note an encryption rule must apply to them. If you do not select this option, the Initial Encryption Wizard will ignore EFS encrypted files. They will not be re-encrypted by u.trust LAN Crypt, even if an encryption rule has been specified for them.
Decompress NTFS compressed files if necessary: Select this option to decompress NTFS compressed files and encrypt them. Note an encryption rule must apply to them. If you do not select this option, the Initial Encryption Wizard will ignore NTFS compressed files. They will not be encrypted, even if an encryption rule has been specified for them.
Decrypt/re-encrypt files encrypted with several keys: Select this option to re-encrypt files that were encrypted with several keys. The files are encrypted with one key only. Note an encryption rule must apply to them.

Note

This option is only available if Encrypt files in accordance with profile or Re-encrypt files in accordance with profile was selected in step 2/5. Otherwise, this option is greyed out.

Include only the following file types: Select the file types to which you want to restrict the initial encryption process (for example .docx, .pdf, txt). This setting only applies to files for which an encryption rule exists. If there are files of different types in the folder, they will not be processed during initial encryption. They will only be encrypted when the user opens and saves them. To specify several file types, use a list separated by semicolons.

Step 7: Click Next. Step 8: Now define which files are to be included in the initial encryption report in Step 4 / 5. For the initial encryption report the user can select between the following options:

Report errors only: The status report will only include files for which errors occurred during encryption.
Report modified files and errors: The status report will include all files which have been modified and for which errors occurred during encryption.
Report all files: The status report will include all files.

Step 9: Click Next. The Result of the encryption, the key name of the key used and the encryption algorithm will be shown for each file in Step 5 / 5.

In case encryption has failed for individual files, you can immediately try again to encrypt those files by pressing the Retry button.

You can sort the results alphabetically by clicking the column header. Furthermore, you can save the status report as an XML file at a file location of your choice ( Export button). Using the status report, you can later retry to encrypt the files for which encryption has failed.

Step 10: Click Finish. The wizard will be closed.

Verifying encryption state

Step 1: Start the wizard.

Step 2: Select the Verify encryption states option in Step 1 / 5.

Step 3: Click Next.

Step 4: Select all the drives and folders you want to verify in Step 2 / 5.

Step 5 Select drives and folders by marking with a tick.

A “+” sign indicates, that the folder contains subfolders which will not be processed, and therefore the encryption state is not checked.

Click Profile Rules to automatically select all the directories for which the user’s profile contains encryption rules.

Click Advanced to restrict the verification to specific file types:

Include only the following file types: If you specify specific file types here (e.g.: .txt, .docx, .pdf), only files of the specified types will be checked. If a folder also contains files of a different type (which has not been specified here), they will not be taken into account. To specify several file types, use a list separated by semicolons.

Step 6: Click Next.

The Result of the verification, the key name of the key used and the encryption algorithm will be shown for each file in Step 3 / 5.

You can sort the results alphabetically by clicking the column header.

Click Export to save the status report. as an XML file at a file location of your choice.

Step 7: Click Finish. The wizard will be closed.

Decrypting files

Files encrypted by u.trust LAN Crypt can be decrypted, if there are no longer any encryption rules applying to them. If initial encryption was required to be performed again, for example due to modified encryption rules in the user’s profile, the files for which encryption rules no longer exist can be decrypted via this wizard.

To decrypt files:

Select Perform initial encryption in Step 1 / 5 of the wizard.
Under Decryption in Step 2 / 5, select Decrypt files with selected keys.
Afterwards you can select the keys.

Only files encrypted with the keys selected will be decrypted. However, they will only be decrypted, if there is no longer any encryption rule applying to them.

Note

u.trust LAN Crypt only decrypts files for which no encryption rule applies.

Example: The Initial Encryption Wizard is started because the user profile has been changed. To ensure that all files have the intended encryption state after closing the Initial Encryption Wizard, proceed as follows:

Enable Encrypt files in accordance with profile: All files are encrypted according to the new encryption.
Enable Re-Encrypt files in accordance with profile: If files are to be encrypted with a different key according to the new rules, they will be re-encrypted.
Enable Decrypt files with selected keys and then select all keys: Encrypted files, for which no longer any encryption rule exists, will be decrypted. u.trust LAN Crypt only decrypts files for which no encryption rule exists. Therefore, selecting all keys will not cause any problems.

After completing the process successfully and closing the wizard, all files have the correct encryption state.

Explicitly decrypting files can be of importance if Persistent Encryption is activated. In this case, files will not be automatically decrypted when they are copied / moved from a directory for which an encryption rule applies to a directory without any encryption rule.

Initial encryption in unattended mode

If you want to run the lcinit.exe tool in Unattended mode, you must call lcinit.exe from the command line with specific parameters, from the folder in which it is located (for example, C:\Program Files\Utimaco\u.trust LAN Crypt\Apps\).

Command line syntax:

LCInit \<startpath | %Profile\>[/S]
{-DIgnoreDirectory}[/Tv][/Te][/Tr][/Td]
[/Tdk {GUID}][/Dc][/De][/Dm][+FFiletype][/V1|/V2|/V3|/V4] [/X]
[/LLogfile]

Parameters:

Start path

This results in either a single file that is to be encrypted, decrypted or re-encrypted (for example, C:\Data\sales.docx), or a folder in which encryption, decryption or re-encryption is to be performed (for example, D:\Data). The default setting is for subfolders not to be included in this process!

%Profile

Processes all rules with an absolute path in the loaded encryption profile. Encrypts / decrypts or re-encrypts files if necessary.

Note

Before a file can be decrypted, the profile must contain an EXCLUDE rule for it.

Includes all subfolders from the start path.

/h or /?

Opens a window which displays help about the syntax used in lcinit.exe.

-DIgnoreDirectory

Ignores this folder.

/Tv

Task mode: v = Shows the encryption status of the files.

/Te

Task mode: e = encrypts files in accordance with the encryption profile, if necessary.

/Tr

Task mode: r = re-encrypts files in accordance with the encryption profile, if necessary.

/Td

Task mode: d = decrypts files in accordance with the encryption profile, if necessary.

/Tdk

Task mode: dk= decrypts the files that were encrypted using the pre-defined keys. You must enter the GUID for the keys.

Note

All task mode parameters can be used together in one command call.

/Dc

This option decompresses NTFS compressed files and encrypts them afterwards. If this option is not set, NTFS compressed files are ignored.

/De

This option decrypts EFS encrypted files and encrypts them again afterwards. If this option is not set, EFS encrypted files are ignored.

/Dm

This option decrypts files encrypted with several keys and encrypts them again afterwards. As a result, the files are encrypted with one key only.

+Ffiletype

If you specify file types with this option (e.g., +Ftxt+Fdocx), only files of the relevant type are processed. This setting only affects files for which an encryption rule exists.

If a folder also contains files of a different file type, that is not specified with this option, they are not taken into account during initial encryption. They will only be encrypted when the user opens and saves them.

Example: The file “123.pdf” is not encrypted because files of the type “PDF” in the above example are not to be encrypted in the initial encryption. If the user opens this file, e.g., with a PDF editor, and saves this file in the same folder, the file is encrypted. The file is also encrypted if the user copies such a file out of this folder and then copies it back in. However, this is only possible if the encryption rule defined for the folder also applies to files of the type “PDF”.

/V0

Verbose mode 0: No reporting.

/V1

Verbose mode 1: Lists error messages.

/V2

Verbose mode 2: Lists modified files.

/V3

Verbose mode 3: Lists all files.

/V4

Verbose mode 4: Lists plain files.

Stop on error.

Initial encryption without displaying a window.

/LLogfile

Writes output to the specified file.

Note

The /Td parameter should only be combined with %Profile when the files you want to decrypt are listed in the profile with an exclude rule. Otherwise, you should use /Td together with the start path.

lcinit.exe %PROFILE -DC:\ignore /S /Te /Tdk {1234ABCD-1234-1234-1234-1234ABCD} {5678EFGH-5678-5678-5678-5678EFGH} /V1 /LC:\logfile.xml>

lcinit.exe D:\data /S /V4

Lists all plain files in D:\data and its subfolders.