encrypting system files to prevent malware?

[sdowney717]

I just had a thought.
Could the entire file system be encrypted with private keys?
That would mean updates and installs would need to become encrypted.

Then when files are executed, a decryption is needed for them to run.
Malware could not run as it would not have been encrypted by your private key..
So run thru the decrypter, the file is trashed.
Would this be too slow to work?

 

[soho1]

Not sure what you envision. If a decryption is required to run, how would you provide the decryption keys for all the thousands of program executions the OS would normally perform?

This doesn't sound like it would necessarily prevent a change to a key'd file, just that it was now a non-key malware file. Sorry if I don't follow.

 

[sdowney717]

Everyone would have a private key unknown to anyone else, including the malware.
Means you could not share a program file like an exe or dll to another system unless it was decrypted by you first.
A non keyed malware file could not run as all files that will run must run a decryption event on them.

Malware that rides along installing other programs would have to know your private key to encrypt the addition malware it installs by itself, otherwise the malware installed could not execute as a file.

Not saying any of this would work at all.

 

[LMiller7]

I am sure you are not the first to have this idea. To me it sounds like a good idea on the surface but falls apart when you get into the details. I can see a number of issues but they are not easily described and I will not try.

 

[logicearth]

You know Microsoft was already looking at ways to secure the boot process and the system files from such things. Use of Digital Signatures haven't really taken off like they hopped. Then when trying to secure the boot they used UEFI's SecureBoot method. We saw how that went down. Everyone was in a tizy over nothing. But encrypting the files isn't going to do anything really.

Summary of a Digital Signature:
Create a hash of the source material, use your private key to encrypt the hash.
Send the file and the newly created signature to the recipient.
The recipient creates a hash of the material, then decrypts the signature with your public key.
You use that method to determine if the material was forged or tampered with.