Steven Bellovin wrote: > On Oct 29, 2009, at 11:25 PM, Jerry Leichter wrote: > >> A couple of days ago, I pointed to an article claiming that these were >> easy to break, and asked if anyone knew of security analyses of these >> facilities.
See below. >> I must say, I'm very disappointed with the responses. Almost everyone >> attacked the person quoted in the article. The attacks they assumed >> he had in mind were unproven or unimportant or insignificant. Gee ... >> sounds *exactly* like the response you get from companies when someone >> finds a vulnerability in their products: It's not proven; who is this >> person anyway; even if there is an attack, it isn't of any practical >> importance. > > Unfortunately, there's no better response here. > > At time T, someone will assert that "X is insecure", and that products > exist -- commercial and freeware -- to crack it. This person supplies > no evidence except for an incomplete list of products to support the > assertion. What do I now know that I didn't know before? [...] I agree, there was no useful evidence about the security of Filevault or Keychain in the article. > The article made no verifiable or falsifiable technical statements, so > there's nothing to evaluate in that respect. I've never heard of any > freeeware to crack Filevault; given the familiarity of the readership of > this list in the aggregate with the free software world, it seems > unlikely that such software exists. He did point to some commercial > software to attack Filevault, but it works by password guessing. For > his business -- forensic analysis -- I suspect that that technique is > extremely useful; I doubt that anyone on this list would disagree. But > that's not the same as a flaw in MacOS. However, there are huge differences in the relative cost of password guessing between different disk encryption protocols. There are also significant differences in the help that crypto software gives users to encourage them to use a high-entropy password/passphrase. For instance, if some product just used a simple hash to generate a key from a password, rather than using a technique like key strengthening or key stretching and a random salt, then I would consider that a serious flaw, even if everything else about the product's crypto usage were well-designed. OTOH, according to <http://crypto.nsa.org/vilefault/23C3-VileFault.pdf>, Filevault uses PBKDF2, which does employ key strengthening. However it only uses 1000 hash iterations, which is a little on the low side. The video of that talk is at <http://video.google.com/videoplay?docid=2948370762304265773> (the actual talk doesn't appear to start until a few minutes in). Note that according to the slides, "Cryptographic security depends on more than just AES-128, it's rather 3DES effective 112bit || AES-128 || RSA-1024". Also, only the user's home directory is encrypted, "passwords are not properly scrubbed", and swap file encryption is not enabled by default. Worse, "If encrypted swap is on: contents of the sleep image will be encrypted, but key will be written out in the header". Oops. -- David-Sarah Hopwood http://davidsarah.livejournal.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majord...@metzdowd.com