I ordered some office supplied, and as usual they arrived with a flyer 
telling me about all the fabulous stuff I could be buying. (E.g., 
apparently you can now buy computer monitors for less than £100, which 
is impressive...)

One thing that caught my eye was a USB flash drivewith "AES 256-bit 
hardware encryption" and "high strength password enforcement".

Obviously, my first assumption was that this is snake oil. For example, 
I read a while back about a HD with "hardware AES-256 encryption", where 
all it actually did was XOR all the data with a fixed 32-bit mask, and 
then AES-encrypt that mask. So the /mask/ is encrypted with powerful 
encryption, but the actual /data/ is trivially XOR-encrypted.

The little "FIPS 140-2" tag is a nice touch. Presumably that's just the 
code number of the document that formally specifies the AES algorithm or 
something.

Obviously the supplier's website contains no technical data at all. Like 
most products, it's quite clearly been copied and pasted from somewhere 
else (complete with mis-encoded special symbols). Eventually I tracked 
down the product on the manufacturer's website. Apparently it /really 
has/ been sent to an independent lab for conformance testing, and 
there's actually a FIPS certificate number. I was eventually able to dig 
this up on the FIPS website.

It's unclear to me what was actually tested. (E.g., I'm almost certain 
they /didn't/ get professional cryptographers to try to crack the 
encryption and retried data out of it.) Probably they just tested that 
it implements AES correctly or something by comparing it against some 
known test vectors.

 From what technical details I can find, it appears that it stores the 
SHA-1 hash of a user-supplied password, and uses that for 
authentication. The AES encryption keys are apparently stored 
unencrypted inside the unit. Actual data is encrypted with these keys, 
running the cipher in CBC mode. (Not the strongest, but not the weakest 
either.) It uses a hardware RNG together with the ANSI X9.31 PRNG 
algorithm. And it sounds like physically it's fairly hard to get into 
the device.

The documents confirm that the device is certified to FIPS 140-2 level 2 
compliance. (The highest level is level 4, and it looks like it wouldn't 
be applicable to portable devices, only to complete systems.) It's using 
a sensible-looking set of algorithms, and it's been through some kind of 
verification process. So I'm reasonably confident that this device isn't 
/trivially/ hackable.

(I was, however, amused by the manufacturer's product advert. "This 
product is routinely used by the hospitals, banks, the police and the 
armed forces." Well, yes, technically that's probably true. And 
unencrypted floppy disks are also almost certainly used by the same 
people. Does that make unencrypted floppy disks count as "secure"? For 
that appears to be what they're trying to imply...)



My next step was to go to my supplier of choice and see what kinds of 
encrypted USB devices they could sell me, at what prices.

Prices start at £4 for a no-name 2GB flash drive. The cheapest 
"protected" device I could find was £6 for a drive with "optional 
password protection for added security". No word on how it's 
implemented. I imagine it isn't especially secure, it just stops curious 
individuals nosing through your files.

All of the cheapest "secure" drives mention the keyword "software". In 
other words, it's a normal USB drive, with some [probably Windows-only] 
software on it which asks you for a password, and won't let you access 
any files unless you type in the correct password. I severely doubt that 
any data is actually encrypted; instead, the supplied software merely 
refuses to let you look without the password. It's probably trivially 
easy to defeat such software. (Perhaps it's as simple as installing 
Linux...)

The first product to actually talk about /encryption/ comes in at £9 
(which is by no means "expensive" compared to the other products in the 
list). The fact that the system requirements claim that "2 unused drive 
letters" are required suggests that once again, this is a software 
solution. In other words, when you insert the thing, it runs some 
[Windows] software that transparently encrypts and decrypts data as it 
is transferred. Still, that's a small step up in security. Even if the 
software doesn't function, you can't get at the data. (Assuming it does 
something sensible with the encryption keys.)

Going up the price list, all the "secured" devices still talk about 
hardware (although they gradually shout louder and louder about AES). 
The cheapest product I could find which is definitely using /hardware/ 
encryption was £20. (Still not actually that much more expensive than 
other big-brand devices.) "Includes XYZ software to access the encrypted 
data." So you still need Windows to access it.

At £24 is an apparently rather popular device that has a 5-digit keypad 
on the casing that allows you to enter a PIN (from 4 to 10 digits). 
Apparently the LEDs change colour after you've unlocked it. When you 
unplug it from the PC, it locks again. It definitely uses AES-256, and 
it's probably implemented in hardware. 5^10 is roughly 10 million, and 
hence the PIN must be entered by hand, you aren't going to crack this 
too easily. (No word on whether the device disables itself given a 
number of access attempts.)

The cheapest device I could find that is actually FIPS 140-2 certified 
(again, at level 2) was for £36. That's for a 4GB drive which is also 
physically quite rugged. Now, £36 is a lot more than the £5 for the 
cheapest 4GB drive. On the other hand, it's not drastically more than 
you'd pay for a 32GB drive (those start at £30). Sure, it *is* quite a 
lot more expensive. But it's not /drastically/ expensive, really. I 
would have expected to pay maybe £150 for a device with hardware AES 
encryption.

It's not so much that the encrypted drives are "expensive", more than 
the unencrypted ones are jaw-droppingly cheap. If you actually /needed/ 
encryption, £36 isn't really all that pricey.

On the other hand, for £0 you can download a copy of GPG and manually 
encrypt all your files before putting them onto an external storage 
device. Then you know /exactly/ which way it's been encrypted, and 
further more you can arrange it so that (for example) it's protected by 
a certificate rather than a password...

Post a reply to this message

On Wed, 17 Aug 2011 16:57:29 +0100, Invisible wrote:

> On the other hand, for £0 you can download a copy of GPG and manually
> encrypt all your files before putting them onto an external storage
> device.

Of course, file by file encryption makes the encryption obvious.  Try 
truecrypt instead. :)

Jim

Post a reply to this message

On 17/08/2011 06:05 PM, Jim Henderson wrote:
> On Wed, 17 Aug 2011 16:57:29 +0100, Invisible wrote:
>
>> On the other hand, for £0 you can download a copy of GPG and manually
>> encrypt all your files before putting them onto an external storage
>> device.
>
> Of course, file by file encryption makes the encryption obvious.  Try
> truecrypt instead. :)

Oh, GPG is quite capable of taking /multiple/ files and encrypting the 
entire lot as one binary blob. So all you know is that it's encrypted, 
and how big it is. You can't tell how many files are inside, nor what 
their uncompressed size is...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On 8/17/2011 8:57, Invisible wrote:
> The little "FIPS 140-2" tag is a nice touch. Presumably that's just the
 code
> number of the document that formally specifies the AES algorithm or som
ething.

No, it describes the algorithms and how hard it is to break into the devi
ce 
and so on. The trick is it's a standard, so the guy in charge of ordering
 
office supplies can say "Is it FIPS 140-2 compliant?" without having to 
understand how to evaluate that himself. Wikipedia is your friend in this
 case.

> The documents confirm that the device is certified to FIPS 140-2 level 
2
> compliance. (The highest level is level 4, and it looks like it wouldn'
t be
> applicable to portable devices, only to complete systems.) It's using a

> sensible-looking set of algorithms, and it's been through some kind of
> verification process. So I'm reasonably confident that this device isn'
t
> /trivially/ hackable.

Which device was this? I could use something to stick my passwords on.

> At £24 is an apparently rather popular device that has a 5-digit k
eypad on
> the casing that allows you to enter a PIN (from 4 to 10 digits). Appare
ntly
> the LEDs change colour after you've unlocked it. When you unplug it fro
m the
> PC, it locks again.

Kewl. And what was this one?

> It definitely uses AES-256, and it's probably
> implemented in hardware.

Note that AES in hardware just means they added a trivial processor core 
to 
the same core that runs the USB protocol. It's not like it's hard to do. 

It's just more transistors on the silicon that's already there.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Wed, 17 Aug 2011 18:57:23 +0100, Orchid XP v8 wrote:

> On 17/08/2011 06:05 PM, Jim Henderson wrote:
>> On Wed, 17 Aug 2011 16:57:29 +0100, Invisible wrote:
>>
>>> On the other hand, for £0 you can download a copy of GPG and manually
>>> encrypt all your files before putting them onto an external storage
>>> device.
>>
>> Of course, file by file encryption makes the encryption obvious.  Try
>> truecrypt instead. :)
> 
> Oh, GPG is quite capable of taking /multiple/ files and encrypting the
> entire lot as one binary blob. So all you know is that it's encrypted,
> and how big it is. You can't tell how many files are inside, nor what
> their uncompressed size is...

I haven't looked at GPG in a while, but didn't know it could do that.  
I'll have to have another look at it.

But with Truecrypt, you can encrypt the entire device and there's no 
indication of anything on it other than just random data.

Jim

Post a reply to this message

>>> Of course, file by file encryption makes the encryption obvious.  Try
>>> truecrypt instead. :)
>>
>> Oh, GPG is quite capable of taking /multiple/ files and encrypting the
>> entire lot as one binary blob. So all you know is that it's encrypted,
>> and how big it is. You can't tell how many files are inside, nor what
>> their uncompressed size is...
>
> I haven't looked at GPG in a while, but didn't know it could do that.
> I'll have to have another look at it.

PGP can encrypt a bunch of files as a self-decrypting executable file. 
Then again, PGP [now] costs money. AFAIK, GPG doesn't have this feature.

> But with Truecrypt, you can encrypt the entire device and there's no
> indication of anything on it other than just random data.

Sure. There is that. In fact, I'm told there's a number of freeware 
whole-drive encryption products. They're usually applied to HDs, but I 
suppose they should apply equally to portable ones.

I also imagine that such products have to be /installed/ on any machine 
before they can be used. GPG has the advantage that it's just a single 
executable. I mean, the whole point of portable storage is to be, you 
know, /portable/. If I encrypt all my stuff and put it on a flash drive, 
and put a copy of GPG on there as well, I can decrypt on any PC I might 
visit. (Especially if I include a Linux binary as well as a Windows 
one.) If I use Truecrypt or similar, any time I visit another PC I have 
to spend time installing and configuring software before I can access my 
data.

The same advantages apply to drives with hardware encryption, of course...

Post a reply to this message

On 17/08/2011 07:28 PM, Darren New wrote:
> On 8/17/2011 8:57, Invisible wrote:
>> The little "FIPS 140-2" tag is a nice touch. Presumably that's just
>> the code
>> number of the document that formally specifies the AES algorithm or
>> something.
>
> No, it describes the algorithms and how hard it is to break into the
> device and so on. The trick is it's a standard, so the guy in charge of
> ordering office supplies can say "Is it FIPS 140-2 compliant?" without
> having to understand how to evaluate that himself. Wikipedia is your
> friend in this case.

Oh yeah, I know what FIPS 140-2 is *now*. I meant before I looked it up 
I assumed it was going to be the designation for AES or something.

> Which device was this? I could use something to stick my passwords on.

...the irony... it burns...

>> At £24 is an apparently rather popular device that has a 5-digit
>> keypad on
>> the casing that allows you to enter a PIN (from 4 to 10 digits).
>> Apparently
>> the LEDs change colour after you've unlocked it. When you unplug it
>> from the
>> PC, it locks again.
>
> Kewl. And what was this one?

OK, for anyone else wanting to duplicate my results:


http://www.ebuyer.com/223405-extra-value-2gb-usb-flash-drive-ev-usb2gb

Cheapest drive. (2GB, £4)


http://www.ebuyer.com/132692-fujifilm-2gb-usb-2-0-secure-and-splash-memory-card-n079050a

Cheapest drive with "security" features. (2GB, £6, trivial password 
protection.)


http://www.ebuyer.com/180530-kingston-datatraveler-locker-4gb-usb-flash-drive-with-encryption-100-privacy-dtl-4gb

Cheapest drive which mentions "encryption". (4GB Kingston-branded, £9, 
appears to use Windows software to do the encryption.)


http://www.ebuyer.com/159024-kingston-2gb-datatraveler-vault-usb-flash-drive-hi-speed-with-dtv-2gb

Cheapest drive with "hardware encryption". (2GB Kingston-branded, £20, 
uses Windows software to access the drive.)


http://www.ebuyer.com/196586-corsair-flash-padlock-2-8gb-usb-flash-drive-with-256-bit-aes-cmfpla8gb

The drive with a physical keypad. (8GB Corsair-branded, £24, uses a 4 to 
10 digit PIN to, 5 unique digits, lights up when unlocked, locks when 
unplugged. Claims to be AES-256 encrypted.)


http://www.ebuyer.com/159010-kingston-datatraveler-blackbox-4gb-usb-flash-drive-dtbb-4gb

Cheapest FIPS certified drive. (4GB Kingston-branded, £36, FIPS 140-2 
level 2 certified.)


Some of the even more expensive drives boast about using AES in XTS 
mode, which is stronger than CBC. Well, whatever...

>> It definitely uses AES-256, and it's probably
>> implemented in hardware.
>
> Note that AES in hardware just means they added a trivial processor core
> to the same core that runs the USB protocol. It's not like it's hard to
> do. It's just more transistors on the silicon that's already there.

Not necessarily. I'm pretty sure you can buy off-the-shelf components 
that run crypto primitives like AES.

(Also, doesn't the USB protocol require a processor core already? In 
which case, all you have to add is firmware for performing AES.)

Fundamentally though, it doesn't matter whether AES is in special 
hardware or in firmware. The point is, the encryption is transparent to 
the host PC. And *that* means that the host PC can't screw it up! ;-) It 
also means you can't actually access the ciphertext at all, without 
taking the device apart.

Post a reply to this message

GPG and Truecrypt don't have to be “installed” but can be used directly
from USB drive, sure.

But: If you have sensitive data on your USB drive you never ever should
decrypt them on a foreign PC, in an Internet café etc. because you
cannot trust them at all (keylogger, spyware etc.)

Call me paranoid but I distrust any Windows PC (and any other PC that is
under control of a talented Linux guy) and I would never enter any
sensitive password on them (neither web mail nor ssh nor crypted USB
drives etc.)

Lars R.

Post a reply to this message

On 18/08/2011 10:08 AM, Lars R. wrote:
> GPG and Truecrypt don't have to be “installed” but can be used directly
> from USB drive, sure.

GPG, yes. (I've done it.) Truecrypt, I couldn't say. Never tried it.

> But: If you have sensitive data on your USB drive you never ever should
> decrypt them on a foreign PC, in an Internet café etc. because you
> cannot trust them at all (keylogger, spyware etc.)

This is of course a valid point. If your drive actually contains 
anything "sensitive" then no, you really don't want to be decrypting 
that for arbitrary PCs.

If, on the other hand, the drive just contains your holiday photos that 
you'd prefer random strangers to /not/ be able to access, then 
encrypting the data will prevent that, and I wouldn't be too worried 
about decrypting it in an Internet cafe.

As with everything security-wise, it depends how much security you need.

1. I keep all my favourite program installers on a flash drive. None of 
it is encrypted, but then again, none of it is secret either. I don't 
really care who can see it. Security is not an issue.

2. If I had, say, my holiday photos or something on there, which I don't 
want random strangers looking at, I could encrypt it in various ways. If 
the drive gets lost or stolen, nobody can access the contents. But 
decrypting it on an untrusted PC is no big deal, really.

3. If I had something like my bank details on there, I would /not/ be 
decrypting that stuff on any system except one that I set up myself. But 
then, really, WTF would that be on a portable drive for anyway? I would 
probably GPG encrypt, using public key cryptography rather than a mere 
password to secure it. Since presumably only trusted systems have a copy 
of my private key, I /can't/ decrypt the data from anywhere else, even 
if I want to.

Post a reply to this message

On 8/18/2011 1:29, Invisible wrote:
>> Which device was this? I could use something to stick my passwords on.
> ...the irony... it burns...

What's ironic about wanting to put passwords or private keys on an encrypted 
portable medium?

> OK, for anyone else wanting to duplicate my results:

Thank you!

> Not necessarily. I'm pretty sure you can buy off-the-shelf components that
> run crypto primitives like AES.

I was thinking it would likely be a core, not a component as such.

> (Also, doesn't the USB protocol require a processor core already? In which
> case, all you have to add is firmware for performing AES.)

That was my point, yes. :-)

> Fundamentally though, it doesn't matter whether AES is in special hardware
> or in firmware. The point is, the encryption is transparent to the host PC.

Right.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 18/08/2011 03:57 PM, Darren New wrote:
> On 8/18/2011 1:29, Invisible wrote:
>>> Which device was this? I could use something to stick my passwords on.
>> ...the irony... it burns...
>
> What's ironic about wanting to put passwords or private keys on an
> encrypted portable medium?

You want to password-protect your passwords? That's just crazy. (The 
idea of a password is that you're supposed to /remember/ it. Which makes 
it impossible to ever steal.)

Password protecting private key files is another matter. Having the 
keyfile on a portable device means it's always with you, you can use it 
like a physical key, but if you lose it, the password should stop 
anybody else pretending to be you.

>> OK, for anyone else wanting to duplicate my results:
>
> Thank you!

No problem. There's no charge for this service. ;-)

(Just waiting for you to complain that you can't order from the USA now...)

>> Not necessarily. I'm pretty sure you can buy off-the-shelf components
>> that
>> run crypto primitives like AES.
>
> I was thinking it would likely be a core, not a component as such.

I'm not so sure about AES, but its predecessor DES is very, very easy to 
implement in hardware. Literally *all* you have to do is a few XOR 
operations, rearrange the bits slightly, and implement a few S-boxes. 
Each S-box is probably a dozen logic gates. That's really very, very 
little hardware at all. An 8-segment display driver probably has more 
transistors in it than that. And it's probably very much faster than 
doing this in software, where things like complicated bit permutations 
are fairly expensive.

(My recollection is that AES involves finite field arithmetic that's 
quite fiddly in software, but probably very simple in hardware. I don't 
remember a great amount of detail though.)

>> Fundamentally though, it doesn't matter whether AES is in special
>> hardware
>> or in firmware. The point is, the encryption is transparent to the
>> host PC.
>
> Right.

Mmm, I wonder if it's immune to side-channel attacks? >:-D

Post a reply to this message

On Thu, 18 Aug 2011 09:09:56 +0100, Invisible wrote:

>>>> Of course, file by file encryption makes the encryption obvious.  Try
>>>> truecrypt instead. :)
>>>
>>> Oh, GPG is quite capable of taking /multiple/ files and encrypting the
>>> entire lot as one binary blob. So all you know is that it's encrypted,
>>> and how big it is. You can't tell how many files are inside, nor what
>>> their uncompressed size is...
>>
>> I haven't looked at GPG in a while, but didn't know it could do that.
>> I'll have to have another look at it.
> 
> PGP can encrypt a bunch of files as a self-decrypting executable file.
> Then again, PGP [now] costs money. AFAIK, GPG doesn't have this feature.

Of course, that executable file would probably only run on Windows, 
natch. ;)

>> But with Truecrypt, you can encrypt the entire device and there's no
>> indication of anything on it other than just random data.
> 
> Sure. There is that. In fact, I'm told there's a number of freeware
> whole-drive encryption products. They're usually applied to HDs, but I
> suppose they should apply equally to portable ones.
> 
> I also imagine that such products have to be /installed/ on any machine
> before they can be used. GPG has the advantage that it's just a single
> executable. I mean, the whole point of portable storage is to be, you
> know, /portable/. If I encrypt all my stuff and put it on a flash drive,
> and put a copy of GPG on there as well, I can decrypt on any PC I might
> visit. (Especially if I include a Linux binary as well as a Windows
> one.) If I use Truecrypt or similar, any time I visit another PC I have
> to spend time installing and configuring software before I can access my
> data.

Actually, using Truecrypt on Linux doesn't require system-level access, 
and you just run a single executable.  The Windows version does use a 
filesystem driver, though, so on Windows you do need to install it before 
you can use it.

> The same advantages apply to drives with hardware encryption, of
> course...

True.

Jim

Post a reply to this message

On Thu, 18 Aug 2011 11:08:05 +0200, Lars R. wrote:

> GPG and Truecrypt don't have to be “installed” but can be used directly
> from USB drive, sure.
> 
> But: If you have sensitive data on your USB drive you never ever should
> decrypt them on a foreign PC, in an Internet café etc. because you
> cannot trust them at all (keylogger, spyware etc.)

Certainly, though you can get a certain degree of security if you also 
have a bootable OS, say a Linux LiveCD or LiveUSB.  That doesn't remove 
hardware keyloggers, of course, but it does remove the software threats.

> Call me paranoid but I distrust any Windows PC (and any other PC that is
> under control of a talented Linux guy) and I would never enter any
> sensitive password on them (neither web mail nor ssh nor crypted USB
> drives etc.)

Using ssh - easy way would be to use public key authentication from a 
removable storage device, though I would prefer to boot my own media for 
something like that on a public system.

Of course, if you do this in the public library, the staff sometimes can 
tend to get a bit testy about it (here in the SLC library, they have 
software to restrict your usage to a particular period of time, obviously 
that doesn't run if you use your own OS).

Jim

Post a reply to this message

On 8/18/2011 8:03, Invisible wrote:
> You want to password-protect your passwords? That's just crazy. (The idea of
> a password is that you're supposed to /remember/ it. Which makes it
> impossible to ever steal.)

You're also supposed to use a different, long password for every site. It's 
basically a key locker.

Plus, of course, it has the advantage of being able to store actual 
sensitive files in a mildly secure way.

> (Just waiting for you to complain that you can't order from the USA now...)

Unlike some here, I have learned how to use google to find such things are 
reviews and local retailers. ;-)

> I'm not so sure about AES, but its predecessor DES is very, very easy to
> implement in hardware.

AES (and, really, almost all the modern block cyphers) are designed that 
way. They're all designed to run on smart cards and stuff like that, except 
for the "fish" ciphers (blowfish, twofish, etc), iirc, which are 
specifically designed to be fast in software.

> Mmm, I wonder if it's immune to side-channel attacks? >:-D

Well, first you have to get to the chip in its encrypted state or something. 
I'm (personally) not so worried about it that I think someone's going to 
crack the case open and hit it with a logic probe. Indeed, I haven't found 
any review that actually says it's encrypting the data on the chip itself. 
If it can change the password instantly, I'd doubt the actual data is 
encrypted. I did read one review where they cracked it open, took out the 
battery for a couple weeks, put it back together, and the PIN was still enabled.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

>> PGP can encrypt a bunch of files as a self-decrypting executable file.
>> Then again, PGP [now] costs money. AFAIK, GPG doesn't have this feature.
>
> Of course, that executable file would probably only run on Windows,
> natch. ;)

Yeah, I should think so. It also has a nice GUI. ;-)

> Actually, using Truecrypt on Linux doesn't require system-level access,
> and you just run a single executable.  The Windows version does use a
> filesystem driver, though, so on Windows you do need to install it before
> you can use it.

That's what I figured, yes.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

>> I'm not so sure about AES, but its predecessor DES is very, very easy to
>> implement in hardware.
>
> AES (and, really, almost all the modern block cyphers) are designed that
> way. They're all designed to run on smart cards and stuff like that,
> except for the "fish" ciphers (blowfish, twofish, etc), iirc, which are
> specifically designed to be fast in software.

Well, there's "easy" and there's "really easy". DES is really easy. AES 
I'm not so sure about, off the top of my head.

But sure. None of these ciphers are "hard" to implement in hardare.

>> Mmm, I wonder if it's immune to side-channel attacks? >:-D
>
> Well, first you have to get to the chip in its encrypted state or
> something. I'm (personally) not so worried about it that I think
> someone's going to crack the case open and hit it with a logic probe.

You don't have to open the case for side-channel attacks to be effective.

Maybe if you sent certain requests, the timing of the responce varies in 
a way that tells you something about the encryption key or the password 
hash or the PRNG state. Maybe you can measure power consuption and find 
out useful info. Heck, maybe the temperature varies, or it leaks RF signals.

Come to think of it, /that/ is the kind of thing I would expect FIPS 
certification to be testing for. Anyone can implement AES correctly. 
It's not hard to run a few test vectors and confirm that you get the 
correct numbers. Making sure that the assembled system is actually 
secure is a whole other matter...

> Indeed, I haven't found any review that actually says it's encrypting
> the data on the chip itself. If it can change the password instantly,
> I'd doubt the actual data is encrypted. I did read one review where they
> cracked it open, took out the battery for a couple weeks, put it back
> together, and the PIN was still enabled.

I looked at the FIPS documentation for one of the drives. (Not the one 
in the list I gave you, but something similar.) It actually describes, 
in vague detail, how the encryption works. It seems it stores the 
encryption keys in the clear (?!), and also stores the SHA-1 hash of the 
password. So presumably when you change the password, it just updates 
the SHA-1 hash.

To me, that seems like a very strange way to implement. However, there's 
no particular reason why you can't use the SHA-1 hash of the password to 
AES-encrypt the main AES encryption key. And then changing the password 
is /still/ instant, without having to re-encrypt any data.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On 8/18/2011 10:57, Orchid XP v8 wrote:
> Maybe if you sent certain requests, the timing of the responce varies in a
> way that tells you something about the encryption key or the password hash
> or the PRNG state. Maybe you can measure power consuption and find out
> useful info. Heck, maybe the temperature varies, or it leaks RF signals.

If it doesn't even respond to USB signals until you've unlocked it, it would 
seem to pretty much eliminate side-channel attacks.

> To me, that seems like a very strange way to implement. However, there's no
> particular reason why you can't use the SHA-1 hash of the password to
> AES-encrypt the main AES encryption key. And then changing the password is
> /still/ instant, without having to re-encrypt any data.

Well, yes, that's true.  In any case, by the time you've taken that apart, 
you can probably brute-force the thing pretty easily. You don't have to 
brute-force the entire 160 bit SHA-1 key if you can brute-force the possible 
hashes of 5^10 (9 million) possible combinations.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Thu, 18 Aug 2011 18:47:33 +0100, Orchid XP v8 wrote:

>>> PGP can encrypt a bunch of files as a self-decrypting executable file.
>>> Then again, PGP [now] costs money. AFAIK, GPG doesn't have this
>>> feature.
>>
>> Of course, that executable file would probably only run on Windows,
>> natch. ;)
> 
> Yeah, I should think so. It also has a nice GUI. ;-)
> 
>> Actually, using Truecrypt on Linux doesn't require system-level access,
>> and you just run a single executable.  The Windows version does use a
>> filesystem driver, though, so on Windows you do need to install it
>> before you can use it.
> 
> That's what I figured, yes.

What I wish they had for the Linux version was the option for a hidden OS 
like they do with Windows.  I may have to image this laptop and see if I 
can figure out a way to bodge it together to do that (but I wouldn't be 
surprised if it required a special driver in the OS)

Jim

Post a reply to this message

On 8/18/2011 14:49, Jim Henderson wrote:
> What I wish they had for the Linux version was the option for a hidden OS
> like they do with Windows.

What does that even mean? That you can boot off the trucrypt partition?

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Thu, 18 Aug 2011 16:24:16 -0700, Darren New wrote:

> On 8/18/2011 14:49, Jim Henderson wrote:
>> What I wish they had for the Linux version was the option for a hidden
>> OS like they do with Windows.
> 
> What does that even mean? That you can boot off the trucrypt partition?

Yep.  They've got a special bootloader that's installed (can be made to 
present something that looks like there's nothing installed, but you type 
your password in), and then it boots the hidden OS.  You can combine that 
with a non-hidden OS (though hidden partitions with regular encrypted 
partitions can be dangerous - unless you mount the outer volume so it 
protects the inner volume, you risk overwriting data in the inner volume) 
so the sensitive data is completely hidden from view.

It's an interesting concept.

Jim

Post a reply to this message

On 18/08/2011 07:39 PM, Darren New wrote:
> On 8/18/2011 10:57, Orchid XP v8 wrote:
>> Maybe if you sent certain requests, the timing of the responce varies
>> in a
>> way that tells you something about the encryption key or the password
>> hash
>> or the PRNG state. Maybe you can measure power consuption and find out
>> useful info. Heck, maybe the temperature varies, or it leaks RF signals.
>
> If it doesn't even respond to USB signals until you've unlocked it, it
> would seem to pretty much eliminate side-channel attacks.

Oh, well, if you're talking about the one with the combination lock 
(which *isn't* FIPS certified) then yeah. The most you could worry about 
is RF leakage, or maybe heat. (But you would need some damned sensitive 
thermometers to measure that.) I would imagine RF output is both very 
easy to check for and shield against.

I was thinking more about the ones where you insert the USB drive and it 
asks for a password before it will let you see the encrypted partition.

>> To me, that seems like a very strange way to implement. However,
>> there's no
>> particular reason why you can't use the SHA-1 hash of the password to
>> AES-encrypt the main AES encryption key. And then changing the
>> password is
>> /still/ instant, without having to re-encrypt any data.
>
> Well, yes, that's true. In any case, by the time you've taken that
> apart, you can probably brute-force the thing pretty easily. You don't
> have to brute-force the entire 160 bit SHA-1 key if you can brute-force
> the possible hashes of 5^10 (9 million) possible combinations.

Oh, sure, the password or PIN or whatever is *clearly* the weakest point 
in the system. (Assuming the RNG isn't broken...)

Post a reply to this message

On 8/19/2011 1:01, Invisible wrote:
> Oh, well, if you're talking about the one with the combination lock

Yeah.  I wasn't interested in one I couldn't use on multiple OSes.

> I was thinking more about the ones where you insert the USB drive and it
> asks for a password before it will let you see the encrypted partition.

Yup, agreed.

> Oh, sure, the password or PIN or whatever is *clearly* the weakest point in
> the system. (Assuming the RNG isn't broken...)

I think I'm OK with storing things on there that can only be extraced by 
someone willing to break it open, extract the actual flash chip, and insert 
that chip into a new controller. :-)

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

>> Oh, well, if you're talking about the one with the combination lock
>
> Yeah. I wasn't interested in one I couldn't use on multiple OSes.

I can see why that wouldn't appeal.

It's a pity there isn't a standard, portable way of doing this really.

>> Oh, sure, the password or PIN or whatever is *clearly* the weakest
>> point in
>> the system. (Assuming the RNG isn't broken...)
>
> I think I'm OK with storing things on there that can only be extraced by
> someone willing to break it open, extract the actual flash chip, and
> insert that chip into a new controller. :-)

It depends on the level of security you want, really.

If you're anything like me, you don't particularly need ultra-security.

Post a reply to this message

On 18/08/2011 4:03 PM, Invisible wrote:
> You want to password-protect your passwords? That's just crazy. (The
> idea of a password is that you're supposed to /remember/ it. Which makes
> it impossible to ever steal.)

Please tell me how to remember passwords for half a dozen systems each 
with two or three clients that force you to change your password 
regularly. Along with accounts for umpteen different company websites 
and personal logons?

-- 
Regards
     Stephen

Post a reply to this message

On 20/08/2011 11:15 AM, Stephen wrote:
> On 18/08/2011 4:03 PM, Invisible wrote:
>> You want to password-protect your passwords? That's just crazy. (The
>> idea of a password is that you're supposed to /remember/ it. Which makes
>> it impossible to ever steal.)
>
> Please tell me how to remember passwords for half a dozen systems each
> with two or three clients that force you to change your password
> regularly. Along with accounts for umpteen different company websites
> and personal logons?

Damn. You have even more passwords than I do!

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On 20/08/2011 11:28 AM, Orchid XP v8 wrote:
> On 20/08/2011 11:15 AM, Stephen wrote:
>> On 18/08/2011 4:03 PM, Invisible wrote:
>>> You want to password-protect your passwords? That's just crazy. (The
>>> idea of a password is that you're supposed to /remember/ it. Which makes
>>> it impossible to ever steal.)
>>
>> Please tell me how to remember passwords for half a dozen systems each
>> with two or three clients that force you to change your password
>> regularly. Along with accounts for umpteen different company websites
>> and personal logons?
>
> Damn. You have even more passwords than I do!
>

Then I move to the next job and start again.

-- 
Regards
     Stephen

Post a reply to this message

Le 20/08/2011 12:15, Stephen nous fit lire :
> On 18/08/2011 4:03 PM, Invisible wrote:
>> You want to password-protect your passwords? That's just crazy. (The
>> idea of a password is that you're supposed to /remember/ it. Which makes
>> it impossible to ever steal.)
> 
> Please tell me how to remember passwords for half a dozen systems each
> with two or three clients that force you to change your password
> regularly. Along with accounts for umpteen different company websites
> and personal logons?
>

Have a small black book with the passwords, one page per system.
For the changing systems, using a rotation of 3 entries should do it
(they are weak, badly managed... they usually check only against the
previous one; I only once encountered a really painful one which stored
the 10 lasts)

Post a reply to this message

On 20/08/2011 11:40 AM, Le_Forgeron wrote:

> Have a small black book with the passwords, one page per system.
> For the changing systems, using a rotation of 3 entries should do it
> (they are weak, badly managed... they usually check only against the
> previous one; I only once encountered a really painful one which stored
> the 10 lasts)

Our network stores the last 12 passwords. Stupidly, it enforces a 
*minimum* password age of 1 day. So, like, if your password is 
compromised the day you change it, you cannot change it until tomorrow. WTF?

The idea, of course, is that you can't enter 12 passwords and then go 
back to your original password. As if *anybody* dumb enough to work here 
would realise they could do that.

What it /does/ mean is that if I reset somebody's password, I can't 
reset it, let them log back in, and then have them change it again. They 
have to wait until tomorrow (by which time they WILL have forgotten). So 
they end up with a weak password for a month. (Or I reset the password 
to something strong, and they whine at me for a month.)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Orchid XP v8 <voi### [at] devnull> wrote:
> Our network stores the last 12 passwords. Stupidly, it enforces a 
> *minimum* password age of 1 day. So, like, if your password is 
> compromised the day you change it, you cannot change it until tomorrow. WTF?

> The idea, of course, is that you can't enter 12 passwords and then go 
> back to your original password. As if *anybody* dumb enough to work here 
> would realise they could do that.

  The solution to both problems is really obvious: Make the waiting time
progressive rather than fixed. In other words, you can change your password
a second time immediately, but the third time requires something like a
minute before you can do it, the fourth time 5 minutes, and so on, until
the 12th time requires a few days or whatever.

  This both prevents potential abuse *and* allows you to immediately change
your password again for whatever reason (eg. because it was reset or
because it was compromised or whatever).

  Why do not developers understand trivial solutions like this?

-- 
                                                          - Warp

Post a reply to this message

On 20/08/2011 11:40 AM, Le_Forgeron wrote:
> Have a small black book with the passwords, one page per system.
> For the changing systems, using a rotation of 3 entries should do it
> (they are weak, badly managed... they usually check only against the
> previous one; I only once encountered a really painful one which stored
> the 10 lasts)

Since I generally access the systems from the same laptop. I have a 
small black spreadsheet which is password protected and the entries are 
in ROT13 so I can tell where in my sequence of passwords I am at a 
glance but someone looking over my shoulder cannot. The laptop itself is 
encrypted.

BTW That was a "Tell me about it?" type of question. I did not expect a 
literal answer. ;-)

-- 
Regards
     Stephen

Post a reply to this message

On 20/08/2011 12:03 PM, Warp wrote:
> Orchid XP v8<voi### [at] devnull>  wrote:
>> Our network stores the last 12 passwords. Stupidly, it enforces a
>> *minimum* password age of 1 day. So, like, if your password is
>> compromised the day you change it, you cannot change it until tomorrow. WTF?
>
>> The idea, of course, is that you can't enter 12 passwords and then go
>> back to your original password. As if *anybody* dumb enough to work here
>> would realise they could do that.
>
>    The solution to both problems is really obvious: Make the waiting time
> progressive rather than fixed.

That would work.

>    Why do not developers understand trivial solutions like this?

Myself I'd probably just follow the Keep It Simple principle; no minimum 
password age at all. As I say, very few people are smart enough to 
realise that the system can be abused this way. Heck, most people just 
/assume/ that the system keeps all passwords forever. They don't know 
that 12 is our magic number.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Orchid XP v8 <voi### [at] devnull> wrote:
> Myself I'd probably just follow the Keep It Simple principle; no minimum 
> password age at all. As I say, very few people are smart enough to 
> realise that the system can be abused this way. Heck, most people just 
> /assume/ that the system keeps all passwords forever. They don't know 
> that 12 is our magic number.

  Security by non-disclosement isn't a good strategy either. It would be
like arguing "nobody is going to hack our password database if we don't
tell anybody in which directory it's located".

  (Yes, I know this is not a question of hacking or the users being
malicious and potentially causing mayhem. However, I see no reason to
not prevent even "innocent" abuse of the system.)

-- 
                                                          - Warp

Post a reply to this message

On 8/20/2011 3:44, Orchid XP v8 wrote:
> As if *anybody* dumb enough to work here would realise they could do that.

Uh.... you work there?

> What it /does/ mean is that if I reset somebody's password, I can't reset
> it, let them log back in, and then have them change it again.

You're doing it wrong. Assuming you're talking Windows, I believe there's a 
checkbox that says "Must change password on next login".


-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 20/08/2011 03:39 PM, Darren New wrote:
> On 8/20/2011 3:44, Orchid XP v8 wrote:
>> As if *anybody* dumb enough to work here would realise they could do
>> that.
>
> Uh.... you work there?

And what does that make me?

>> What it /does/ mean is that if I reset somebody's password, I can't reset
>> it, let them log back in, and then have them change it again.
>
> You're doing it wrong. Assuming you're talking Windows, I believe
> there's a checkbox that says "Must change password on next login".

...and that checkbox is frequently the *reason* I'm having to manually 
reset the password in the first place. If the user's password expires, 
and they only access our network via the VPN, they don't get the warning 
to change password. They just get silently locked out.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Sat, 20 Aug 2011 19:06:54 +0100, Orchid XP v8 wrote:

> On 20/08/2011 03:39 PM, Darren New wrote:
>> On 8/20/2011 3:44, Orchid XP v8 wrote:
>>> As if *anybody* dumb enough to work here would realise they could do
>>> that.
>>
>> Uh.... you work there?
> 
> And what does that make me?

Employed. :)

I'm about ready to be done with the "not currently employed" status - 
it's been a quiet summer, but I'd rather actually be making an income 
(been doing a little contract work, but not having health coverage is a 
bit of an issue).

Jim

Post a reply to this message

Le 2011/08/20 06:15, Stephen a écrit :
> On 18/08/2011 4:03 PM, Invisible wrote:
>> You want to password-protect your passwords? That's just crazy. (The
>> idea of a password is that you're supposed to /remember/ it. Which makes
>> it impossible to ever steal.)
>
> Please tell me how to remember passwords for half a dozen systems each
> with two or three clients that force you to change your password
> regularly. Along with accounts for umpteen different company websites
> and personal logons?
>

Some post-it on your monitor ;P
After all, it's prety common practice almost everywhere...

Post a reply to this message

On 20/08/2011 10:29 PM, Alain wrote:
> Some post-it on your monitor ;P
> After all, it's prety common practice almost everywhere...

Written in mirror writing? :-)

-- 
Regards
     Stephen

Post a reply to this message

>> Please tell me how to remember passwords for half a dozen systems each
>> with two or three clients that force you to change your password
>> regularly. Along with accounts for umpteen different company websites
>> and personal logons?
>
> Some post-it on your monitor ;P
> After all, it's prety common practice almost everywhere...

In fairness, this is probably OK for the PC in your house. If 
unauthorised people are in your house, you have *way* bigger problems 
than passwords...

In an office though, DO NOT DO THIS! >_<

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Le 2011/08/21 06:20, Orchid XP v8 a écrit :
>>> Please tell me how to remember passwords for half a dozen systems each
>>> with two or three clients that force you to change your password
>>> regularly. Along with accounts for umpteen different company websites
>>> and personal logons?
>>
>> Some post-it on your monitor ;P
>> After all, it's prety common practice almost everywhere...
>
> In fairness, this is probably OK for the PC in your house. If
> unauthorised people are in your house, you have *way* bigger problems
> than passwords...
>
> In an office though, DO NOT DO THIS! >_<
>

It's a common sight in many offices, especialy when the passwords are 
numerous and change often.

They usualy read similar to:
Site/acount
User name - password

The password can be under the user name.

Some only list the user name and password, or only the password for the 
main password the user need to start his work day. In that later case, 
you only have to look at the office/desk to figure the user name.

I know, it's realy no good, but common...

Post a reply to this message