Home page logo
/

basics logo Security Basics mailing list archives

RE: Good design for a Algorithmically Derived Passphrase for FDE (?!)
From: "Arbogast, Paul (Citco)" <PArbogast () citco com>
Date: Mon, 19 Nov 2007 18:20:35 -0500

Safeboot is a good one for laptops its what my company uses. It does not
allow for bypassing the BIOS, and has its own login before reaching
windows, that can be locked out, and can only be unlocked by someone who
has access to the safeboot server.


-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of ManInWhite
Sent: Monday, November 19, 2007 4:11 PM
To: Ansgar -59cobalt- Wiechers; docbook.xml () gmail com
Cc: security-basics () securityfocus com
Subject: Re: Good design for a Algorithmically Derived Passphrase for
FDE (?!)

You have both misunderstood me.

Firstly: BitLocker is out of the question. Vista. Ewwwww

Secondly: The algorithm used to derive the passphrase not stored with
the laptop at all. The CODEwords which are used to derive the passphrase
are not stored with the laptop. They both never leave the key generation
PC.

Thirdly: The security of the system is not in keeping the algorithm
secret. Ultimately all it is doing is generating offsets for lookup in a
 secret codebook. The Codebook is not stored with the laptop, and
protected. The security is keeping this codebook secure.

If the attacker was to somehow derive the numbers the algorithm produces
it would be useless without the codebook.

The laptop has no idea (45, 254, 12) means "alice walked with bob to
town". Possession of the serial number or key generation algorithm would
be effectively useless.

MiW


Ansgar -59cobalt- Wiechers wrote:
On 2007-11-18 ManInWhite wrote:
I have been tasked with deploying partition based encryption for our
fleet of laptops.

It has been suggested that we use an algorithm derived passphrase
based on some unique hardware number. [ HDD Serial# / Laptop Serial#
]

Then your security would depend on the attacker not knowing the
algorithm for deriving the passphrase from the serial numbers (which
will be known to him once he has access to the hardware).

Bad idea. Don't do that.

The only good design for algorithmically derived passphrases is not to
have algorithmically derived passphrases.

Regards
Ansgar Wiechers

On Nov 17, 2007 8:51 PM, ManInWhite <maninwhite () tpg com au> wrote:
It has been suggested that we use an
algorithm derived passphrase based on some unique hardware number.
[ HDD Serial# / Laptop Serial# ]

So when the laptop is stolen, the thief will also have all these
serial number, and if they get hold of their algorithm, they can
re-construct passphrase for any laptop.

this kind of scheme may work for equipment that doesn't leave the
facility e.g. servers in datacenter. But definitely don't use this for
laptops.

I suspect you are trying to use BitLocker, which lack centralized key
management. I would suggest you take a look at some other holistic
solutions for encrypting your laptops.

Saqib
http://www.full-disk-encryption.net/





Disclaimer link.  To see it, click the link below, or copy and
paste it into your browser's address line.
http://www.citco.com/emaildisclaimer.htm


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault