[117085] in Cypherpunks
RE: Project: Hardening Crypto Against Big Brother's "BlackBag"
daemon@ATHENA.MIT.EDU (duncan.watson@aladdin.de)
Thu Aug 26 05:27:53 1999
From: duncan.watson@aladdin.de
To: cypherpunks@cyberpass.net
Message-ID: <412567D9.00348048.00@saturn.aladdin.de>
Date: Thu, 26 Aug 1999 10:30:40 +0100
Mime-Version: 1.0
Content-type: text/plain; charset=us-ascii
Content-Disposition: inline
Reply-To: duncan.watson@aladdin.de
Regarding iKey, I have access to an internal report evualating it.
Some notes from the info:
- Contains MD5 in firmware
- Has on-board RNG
I don't know how good the RNG is, but it would aid secure use. As does MD5
in firmware.
Currently the rest of the product is memory based but that is slated to
change.
eToken ( http://www.aks.com/etoken/index.html )
is a similar product that supports on-board PKCS#11 and also has MD5 in
hardware. Do you own checking on this product since it is produced by the
company I work for. Note the dev team wants to make a demo where you can
store your private key from pgp on the device. I think they want to work
it by putting a keyring in its memory which they access securely. Nice if
they do it.
Note that neither of these products are available yet.
RFideas is available now but I don't have any details on the encryption it
uses to secure it's communication.
-Duncan
On 26.08.99 6:42:59 Kurt Buff wrote:
>
>-----BEGIN PGP SIGNED MESSAGE-----
>
>Agree with your comments, but the site does mention a 12MHz processor
>and 128bytes(?!) of RAM, and a physical fuse to prevent file readout.
>All sounds like a good start, but needs good verification to be sure.
>
>Your website seems to be down, bummer.
>
>Kurt
>
>| -----Original Message-----
>| From: Sunder [mailto:sunder@brainlink.com]
>| Sent: Wednesday, August 25, 1999 13:24
>| To: kurtbuff@lightmail.com
>| Cc: cypherpunks@cyberpass.net
>| Subject: Re: Project: Hardening Crypto Against Big Brother's
>| "BlackBag"
>| Intrusions
>|
>|
>|
>|
>| Kurt Buff wrote:
>|
>| > -----BEGIN PGP SIGNED MESSAGE-----
>| > Hash: SHA1
>| >
>| > These two products are steps in the right direction...
>| >
>| > http://www.rainbow.com/ikey/index.html
>|
>| Interesting stuff. Not too clear on how these work. But, if
>| the values
>| stored on these keys are static, they won't need to do much
>| work to capture
>| them, just like a keyboard sniffer, one could write a USB
>| dongle sniffer and a
>| wrapper around the USB drivers of the machine to insert the
>| same data without
>| actually having the dongle.
>|
>| These suckers need to generate different data when they're
>| connected. Data
>| that can't be replicated/forged.
>|
>| Again, what's needed is a tamper proof device (tampering by
>| physical access to
>| the device or by some means to bypass the device in the
>| software of the
>| computer it's inserted in). This would require that the key
>| do it's own on
>| board crypto and not rely for ANYTHING coming from the host
>| PC, other than a
>| communication channel.
>|
>| If the PC can copy the data in the key, you're fucked. i.e.
>| they need to be
>| their own crypto engines, they can't just be ROM keys.
>|
>| > http://www.rfideas.com/
>|
>| This one looks a bit more like it would do this, but I've not
>| found full info
>| on these to confirm that.
>|
