[6082] in cryptography@c2.net mail archive
Re: a smartcard of a different color
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Wed Nov 17 11:22:13 1999
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: cryptography@c2.net, dbs@philodox.com
Reply-To: pgut001@cs.auckland.ac.nz
X-Charge-To: pgut001
Date: Thu, 18 Nov 1999 05:05:24 (NZDT)
Message-ID: <94285472419895@cs26.cs.auckland.ac.nz>
Robert Hettinga <rah@shipwright.com> writes:
>Subject: a smartcard of a different color
>From: Dan Geer <geer@world.std.com>
>
>Yesterday I saw a smartcard of a different color. In particular, it is the
>smartcard chip but in a key-ring thing that is more or less identical to the
>Mobil SpeedPass except that it has a USB connector on one end and a keyring
>hole on the other. Total length circa 1.25"; color purple; maker Rainbow
>Technologies. As my pal Peter Honeyman said in showing it to me, "There are
>already all the USB ports we'll ever need." I'd point out that without the
>7816 requirement for flex a whole lot more memory is a trivial add-on and
>that USB is not a bandwidth bottleneck.
>
>ref: http://www.rainbow.com/ikey/graphics/iKey_DS.pdf
Also http://ikey.rainbow.com/index.html, and more or less the same thing from
http://www.tokensecurity.com/etoken/index.html (the Aladdin version is somewhat
more versatile than the Rainbow one). In both cases though they're somewhat
limited, providing MD5, a PRNG, and some EEPROM. Aladdin advertise 1K RSA, but
there's a footnote in Flyspeck 4 indicating that it's done in software and not
on the token.
Overall it's a nice idea, but I'm doubtful it'll fly:
- Very limited capabilities (basically just a removable storage device when it
comes to crypto keys). This is a pity, because the fact that you're not
stuck with the awkward smart card form factor means you could put all sorts
of neat stuff in there (you could fit a 64K EEPROM, decent CPU, and hardware
RNG without any trouble). Looking through the plastic on the Aladdin one
there's all sorts of circuitry in there but from the specs it doesn't seem to
do much. To see something which avoids the smart card form factor and makes
good use of this, have a look at Datakey, http://www.datakey.com/ISS.HTM.
If you want to carry your PGP keyring around on your physical keyring,
there's stuff like http://www.datakey.com/PKF16M.htm (2MB flash memory
token).
- It's only usable with Win98 (and Win95 with various updates applied), not NT
or any Unix version.
- Crawling under your desk each time you want to plug it in is going to get old
quickly.
I have both Aladdin and Rainbow ones here. Some day I hope to find something
which will talk to them.
Peter.
