[117450] in Cypherpunks
Re: Project: Hardening Crypto Against Big Brother's "BlackBag" Intrusions
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Fri Sep 3 11:12:20 1999
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: cypherpunks@cyberpass.net
X-Charge-To: pgut001
Date: Sat, 4 Sep 1999 02:57:13 (NZST)
Message-ID: <93637063304652@cs26.cs.auckland.ac.nz>
Reply-To: pgut001@cs.auckland.ac.nz (Peter Gutmann)
Martin Minow <minow@pobox.com> writes:
>You might look at the TINI internet interface from Dallas Semiconductor
><http://www.ibutton.com/TINI/index.html>. You should be able to put the non-
>secure code on the TINI board and the secure code on a crypto iButton (also
>from Dallas Semiconductor). The Dallas Semiconductor folk put a lot of work
>into making the iButton secure from physical, power, and timing attacks. You
>can program both in Java.
That's one of the problems with this, it's rather nice to play with, but the
fact that you have to throw away all your existing code and start again from
scratch in Java isn't going to help much. The advantage of using an embedded
PC module is that you can use code which has been out there and stable for a
long time. I also suspect that comparing the performance of (say) a 300 MHz
PII card with 64 or 128MB of RAM (although typically you'd want to go with a
cheaper 486 and 16MB) with a Java chip and barely enough memory is somewhat
unfair :-).
>The crypto iButton can't be exported without a license.
That's another big problem, it won't help you much unless you're in the US.
The neat thing about what I've proposed is that you can take a freely-
available piece of COTS hardware, drop the crypto on it, stick it in a die-
cast aluminium case, and you've got a (effectively) FIPS 140-1 level 2 crypto
device which would otherwise be impossible to export from the US in that
form. I tried to make this as generic as possible so you're not dependent on
a single supplier, non-public software, or export controls.
(I'm not criticising Dallas here, they have some cool products but they're
also hamstrung by various political issues which make their stuff slightly
less useful, particularly to non-US people).
Peter.
