Re: Secure IDE?
In message [EMAIL PROTECTED], [EMAIL PROTECTED] (Peter Gutmann) wrote: If you're worried about Joe Burglar grabbing your laptop (for the value of the laptop) and your business data being leaked as collateral damage, or someone stumbling across your warez or pr0n, then it's probably adequate. Only because Joe Burglar doesn't yet have the tools to crack the weak encryption on this device. Joe Burglar now has tools to break the password protection on word processor and other files, and if this new device becomes at all popular, then tools to crack it will become readily available. It's only a matter of time. -- Shields.
RE: Secure IDE?
Trei, Peter [EMAIL PROTECTED] writes: It's a move in the right direction, but I wish they had followed through and done the right things: * [AES | 3DES]/CBC I get the feeling they use ECB for speed (heavy pipelining) rather than cluelessness. with a good distribution of IVs Where would you store them? The feature of this is that it's fully transparent, so you can't store IVs anywhere. * User-generated keys (before initial disk setup, of course). That one's the only thing I can't find a good technical reason for... perhaps it's just commercial, since they see the dongles as a revenue source and will sell you software to set up n dongles yourself, where price is proportional to n. * Some kind of PIN or password protection on the dongle. How would you do this without a custom BIOS (remember that their general product is for dropping into any PC)? 40 bit DES is not secure against your kid sister (if she's a cypherpunk :-), much less industrial espionage. I'm more worried about key backup - it's bad enough having cheapest-possible- components IDE drives without complicating it further with a second point of failure. In the meantime a better option is still the triumvirate of: - Sensitive data saved only to RAM disk. - 3DES-encrypted volume mounted as a filesystem, which I can back up in encrypted form if necessary, and with all crypto done in software with per- sector random IVs, user-generated keys, and all the other stuff you asked for. - Encrypted swap. (Oh yeah, and a UPS so you're not tempted to temporarily save stuff to disk elsewhere in case the RAM drive goes away suddenly). 40-bit DES (US Data Encryption Standard) is adequate for general users Yeah. Right. If you're worried about Joe Burglar grabbing your laptop (for the value of the laptop) and your business data being leaked as collateral damage, or someone stumbling across your warez or pr0n, then it's probably adequate. Since this is what general users would be worried about, I'd agree with the statement. Anyone worried about more than that (probably about 0.01% of the market) isn't a general user any more. Peter.
RE: Secure IDE?
[EMAIL PROTECTED]:[EMAIL PROTECTED] wrote: Trei, Peter [EMAIL PROTECTED] writes: No info on chaining modes, if any, nor of IV handling. DES/ECB, originally with a 40-bit key, more recently with 56-bit and 3DES. Keys generated by the manufacturer onto a USB dongle. No easy way to make backups of the dongle. It's a messy tradeoff: If you want something like laptop/data-theft-protection (which will suit the majority of the market), then DES-40/ECB is fine, but you want to be able to back up the dongle because if that goes (and after multiple insertions and removals it will) you've lost all your data. OTOH if you want protection from the MIB the fragile nature of the key storage is probably a benefit, but then you want 3DES/CBC to go with it. At the moment you have laptop-theft-protection crypto and MIB-protection key storage. You can buy truckloads of these things on ebay for about $20 a pop if you want to play with one. Peter. Color me dissapointed. It's a move in the right direction, but I wish they had followed through and done the right things: * [AES | 3DES]/CBC with a good distribution of IVs * User-generated keys (before initial disk setup, of course). * Shutdown on dongle removal. * Some kind of PIN or password protection on the dongle. eNova claims not to keep a database of keys (they don't say that 'there is no database of keys', which is a little different), and to get a key copied you have to send it to them. They do seem to supply a spare. Back a few years ago, I calculated that with the DES key search software then available, a single 200MHz machine could search 40 bits of keyspace over a long weekend. Today it would take a few hours. 40 bit DES is not secure against your kid sister (if she's a cypherpunk :-), much less industrial espionage. Quote from http://www.abit.com.tw/abitweb/webjsp/english/mb_spec.jsp?pPRODUCT_TYPE=Moth erBoardpMODEL_NAME=SecureIDE : 40-bit DES (US Data Encryption Standard) is adequate for general users Yeah. Right. Peter
RE: Secure IDE?
Trei, Peter ABIT has come out with a new motherboard, the IC7-MAX3 featuring something called 'Secure IDE', which seems to involve HW crypto in the onboard IDE controller: From the marketing fluff at http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 For MAX3, the ABIT Engineers listened to users who were asking for information security. SecureIDE connects to your IDE hard disk and has a special decoder; without a special key, your hard disk cannot be opened by anyone. Thus hackers and would be information thieves cannot access your hard disk, even if they remove it from your PC. Protect your privacy and keep anyone from snooping into your information. Lock down your hard disk, not with a password, but with encryption. A password can be cracked by software in a few hours. ABIT's SecureIDE will keep government supercomputers busy for weeks and will keep the RIAA away from your Kazaa files. No, I have no idea what this actually means either. I'm trying to find out. Peter Trei Yeah, I know it's tacky to followup ones own messages, but I found a little more: http://www.abit.com.tw/abitweb/webjsp/english/SecureIDE.htm SecureIDE is a encryption device that uses the eNOVA X-Wall chipset that ensures confidentiality and privacy of your data through disk encryption. When booting up your system, go to DOS and implement the FDISK instruction. This instruction will make a partition to format the Hard Disk to accept the secure IDE key. After this procedure, there are no more extra steps to perform besides using the key to open the hard disk each time you boot up your system. The accompanying diagram shows a daughterboard sitting between the HD and the system, with a USB dongle coming off the side. eNova has more info at: http://www.enovatech.com/w/html/about.htm The USB dongle apparently acts only as a key store, for a DES or 3DES key. It needs to be present at boot time. It appears that the key is put on the device by the manufacturer though they promise Enova Technology does not maintain a database of X-Wall Secure Keys. On the good side, it seems to encrypt the whole disk, including the boot sector and swap. No info on chaining modes, if any, nor of IV handling. There is no mention of a PIN or other 'something you know' required to use the USB key. I can't tell if pulling the dongle shuts down the system. Might be neat, but as yet, insufficient information. Peter
Re: Secure IDE?
On Wed, Jul 30, 2003 at 04:20:37PM -0400, Trei, Peter wrote: ABIT has come out with a new motherboard, the IC7-MAX3 featuring something called 'Secure IDE', which seems to involve HW crypto in the onboard IDE controller: From the marketing fluff at http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 For MAX3, the ABIT Engineers listened to users who were asking for information security. SecureIDE connects to your IDE hard disk and has a special decoder; without a special key, your hard disk cannot be opened by anyone. Thus hackers and would be information thieves cannot access your hard disk, even if they remove it from your PC. Protect your privacy and keep anyone from snooping into your information. Lock down your hard disk, not with a password, but with encryption. A password can be cracked by software in a few hours. ABIT's SecureIDE will keep government supercomputers busy for weeks and will keep the RIAA away from your Kazaa files. No, I have no idea what this actually means either. I'm trying to find out. Peter Trei Yeah, that announcement just ran over the slashdot ticker. Someone posted the following insightful link subsequently: ftp://ftp.abit.com.tw/pub/download/fae/secureide_eng_v100.pdf Looks like that sucker only does key-truncated version of DES called DES-40. Right... did they say weeks? I'd say minutes, unless ABIT means [insert some impoverished 3rd world country] government supercomputers. It's snakeoil, move on, nothing to see here. Cheers, Ralf -- Ralf-P. Weinmann [EMAIL PROTECTED] PGP fingerprint: 2048/46C772078ACB58DEF6EBF8030CBF1724
Re: Secure IDE?
On Wed, Jul 30, 2003 at 04:20:37PM -0400, Trei, Peter wrote: ABIT has come out with a new motherboard, the IC7-MAX3 featuring something called 'Secure IDE', which seems to involve HW crypto in the onboard IDE controller: From the marketing fluff at http://www.abit.com.tw/abitweb/webjsp/english/news1.jsp?pDOCNO=en_0307251 For MAX3, the ABIT Engineers listened to users who were asking for information security. SecureIDE connects to your IDE hard disk and has a special decoder; without a special key, your hard disk cannot be opened by anyone. Thus hackers and would be information thieves cannot access your hard disk, even if they remove it from your PC. Protect your privacy and keep anyone from snooping into your information. Lock down your hard disk, not with a password, but with encryption. A password can be cracked by software in a few hours. ABIT's SecureIDE will keep government supercomputers busy for weeks and will keep the RIAA away from your Kazaa files. No, I have no idea what this actually means either. I'm trying to find out. Peter Trei 40-bit DES in ECB mode sounds even more great. It's them Enovatech guys again. See here: http://archives.abditum.com/cypherpunks/C-punks20030519/0079.html Cheers, Ralf -- Ralf-P. Weinmann [EMAIL PROTECTED] PGP fingerprint: 2048/46C772078ACB58DEF6EBF8030CBF1724
