[144988] in cryptography@c2.net mail archive
Re: Security of Mac Keychain, File Vault
daemon@ATHENA.MIT.EDU (Greg Thompson)
Mon Oct 26 21:53:19 2009
From: Greg Thompson <gregth@gmail.com>
In-Reply-To: <538BE49A-C3DF-49EF-9D3B-FC63C2FB2860@lrw.com>
Date: Sun, 25 Oct 2009 21:30:05 -0400
To: Cryptography List <cryptography@metzdowd.com>
On Oct 24, 2009, at 5:31 PM, Jerry Leichter wrote:
> The article at http://www.net-security.org/article.php?id=3D1322 =20
> claims that both are easily broken. I haven't been able to find any =20=
> public analyses of Keychain, even though the software is open-source =20=
> so it's relatively easy to check. I ran across an analysis of File =20=
> Vault not long ago which pointed out some fairly minor nits, but =20
> basically claimed it did what it set out to do.
The white paper for Mac Marshal =
(http://macmarshal.atc-nycorp.com/mac/MacMarshal_WhitePaper_102.pdf=20
) leads me to believe that the so-called vulnerability in File Vault =20
is that the encryption is based on the user's chosen login password:
"So, FileVault is not as secure as simple 128-bit AES. Any means of =20
obtaining the user=92s login password or the FileVault Master recovery =20=
keychain will allow access to the FileVault image."
Does this surprise anyone?
-Greg=
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
