Device Encryption for IGEL OS

If you want to strengthen the security of your endpoint device, you can deploy strong device encryption that is derived from a user password. The encryption is applied to all partitions that can contain user data, e.g. browser history or Custom Partitions.

Menu path: Security > Device Encryption

Device encryption mode

Possible options:

• Keep: The default encryption scheme is maintained. If a password has been set, it will remain unchanged.
• Activate: The device will be re-encrypted using strong encryption methods when the user enters the password for the first time. It is strongly recommended to enforce the use of a strong password; see Minimum Password Length and the subsequent password settings. The re-encryption may take about 10 to 60 seconds; the duration depends on the hardware performance and the size of the Custom Partition.

• Deactivate: The device will be re-encrypted back to the default device encryption scheme on the next boot. The re-encryption may take about 10 to 60 seconds.

  

  If you want to switch back to the default device encryption, you must have the password. If the password gets lost, you must reinstall IGEL OS 11 on the device, e. g. via OSC (see Installation).

Change password

Only applicable if device encryption is enabled. The user can change the password for device encryption.

Authentication type

Possible options:

• PW: Password authentication. In this version of IGEL OS, this is the only available authentication type.

Security level

Possible options:

• Auto, constant-time: The password aggregation function that fits best with the defined Target time delay (ms) is selected.
• Auto, at least level: The security level will be at least as high as the value selected by Password aggregation function; if the Target time delay (ms) allows for a higher security level, the higher security level will be used.
• Manual: The Password aggregation function can be set manually, irrespective of the delay time specified by Target time delay (ms).

Target time delay (ms)

Maximum time that should be consumed by the password aggregation function. This delay is effective when the user enters the device encryption password on boot or changes the device encryption password.

Password aggregation function

Security level of the encryption. 

Possible options:

• I: Argon2id, 8M/7 ops
• II: Argon2id, 128M/3 ops
• III: Argon2id, 256M/3 ops
• IV: Argon2id, 512M/3 ops
• V: Argon2id, 1024M/4 ops
• VI: Argon2id, 128M/4 ops

Minimum password length

Minimum number of characters the password must be composed of

Unwanted strings in password (comma separated)

Comma-separated list of strings that must not be contained in the password

The password must contain

Defines whether all of the subsequent minimum requirements (minimum amount of lower case letters etc.) must be fulfilled, or 2, or 3 of them.

• all
• 2 of
• 3 of

Minimum amount of lower case letters

The minimum amount of lower case letters

Minimum amount of upper case letters

The minimum amount of upper case letters

Minimum amount of numbers

The minimum amount of numbers

Minimum amount of special characters

The Minimum amount of special characters

Special characters allowed

List of all non-alphanumerical characters that are allowed in the password, without separators