Imagine a phone that stays locked while background services keep working. File-based encryption protects individual files or file classes, allowing protection to reflect whether the device is locked or turned off. section 13.2.4
The basic contrast is:
- File-based encryption encrypts individual files. section 13.2.4
- Full-disk encryption encrypts the whole disk as an all-or-nothing approach, but may keep a data-encryption key available while the computer is locked. section 13.2.4
- Both approaches can suffer serious implementation weaknesses, including insecure solid-state-drive and phone-encryption solutions. section 13.2.4
Locked-phone protection
Modern phones can encrypt different types of files depending on whether the phone is locked or turned off, rather than treating every file identically. section 13.2.4
Figure 13.3 A chip implementing the TPM 2.0 standard, plugged into a motherboard. This chip can be called by the system’s motherboard components as well as user applications running on the computer’s OS. Photo from Wikipedia (http://mng.bz/Q2je).
A TPM 2.0 chip illustrates the hardware-security context: secure processors can protect encryption keys by keeping them inside the chip and performing cryptographic operations there. section 13.2.4
