[14154] in cryptography@c2.net mail archive
Re: fyi: bear/enforcer open-source TCPA project
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Thu Sep 11 10:54:50 2003
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Fri, 12 Sep 2003 00:53:36 +1200
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: bear@sonic.net, rsalz@datapower.com
Cc: cryptography@metzdowd.com
Rich Salz <rsalz@datapower.com> writes:
>Second, if the key's in hardware you *know* it's been stolen. You don't know
>that for software.
Only for some definitions of "stolen". A key held in a smart card that does
absolutely everything the untrusted PC it's connected to tells it to is only
marginally more secure than a key held in software on said PC, even though you
can only steal one of the two without physical access. To put it another way,
a lot of the time you don't need to actually steal a key to cause damage - it
doesn't matter whether a fraudulent withdrawal is signed on my PC with a
stolen key or on your PC with a smart card controlled by a trojan horse, all
that matters is that the transaction is signed somewhere.
Peter.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
