The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
Caume Data Security Engine is a REST API platform for storing and processing files in uncontrolled environments. It provides a Free Software solution which allows the creation of reasonably secure and isolated workspaces to process and store sensitive data within uncontrolled environments. With concepts such as "the cloud" and "bring your own device", as well as an increasing demand for mobile devices, it has become clear that the way in which companies operate is changing dramatically, and, with it, the way in which we secure information and the infrastructure which supports business processes. CaumeDSE has been designed as a service platform which provides security to data by using free, well-known, and robust cryptographic software, as well as open and simple data structures and interfaces to make portability and extensibility easy.
jEncrypt is a commandline file encryption archiver. Files are encrypted with the AES-CTR mode, which was recommended by the National Institute of Standards and Technology in 2001 (NIST SP 800-38A). AES-CTR mode only provides confidentiality. It requires a message authentication code such as CBC-MAC to ensure an encrypted message is not accidentally modified or maliciously tampered with, which jEncrypt currently does not provide.
MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.
haveged is a daemon that feeds the /dev/random pool on Linux using an adaptation of the HArdware Volatile Entropy Gathering and Expansion algorithm invented at IRISA. The implementation attempts to be self-tuning on a wide variety of hardware and includes runtime validation testing. The tarball uses the GNU build mechanism and includes a devel sub-package, self test targets, init system options, and spec file samples for building an RPM. haveged may be used independently of the /dev/random interface through the filesystem at the command line. haveged functionality may be incorporated directly into other components directly through the devel sub-package.
Tin Hat is a Linux distribution derived from hardened Gentoo. It aims to provide a very secure, stable, and fast desktop environment that lives purely in RAM. Tin Hat boots from CD, or optionally USB pen drive, but it is not a LiveCD in that it does not mount any file system from the boot device. Rather, Tin Hat employs a massive squashfs image which expands into tmpfs upon booting. This makes for long boot times, but remarkable speeds during human-computer interaction.
EncFS is an encrypted pass-through filesystem which runs in userspace on Linux (using the FUSE kernel module). Similar in design to CFS and other pass-through filesystems, all data is encrypted and stored in the underlying filesystem. Unlike loopback filesystems, there is no predetermined or pre-allocated filesystem size.