mailing list archives
RE: Good design for a Algorithmically Derived Passphrase for FDE (?!)
From: "Arbogast, Paul (Citco)" <PArbogast () citco com>
Date: Mon, 19 Nov 2007 18:20:35 -0500
Safeboot is a good one for laptops its what my company uses. It does not
allow for bypassing the BIOS, and has its own login before reaching
windows, that can be locked out, and can only be unlocked by someone who
has access to the safeboot server.
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of ManInWhite
Sent: Monday, November 19, 2007 4:11 PM
To: Ansgar -59cobalt- Wiechers; docbook.xml () gmail com
Cc: security-basics () securityfocus com
Subject: Re: Good design for a Algorithmically Derived Passphrase for
You have both misunderstood me.
Firstly: BitLocker is out of the question. Vista. Ewwwww
Secondly: The algorithm used to derive the passphrase not stored with
the laptop at all. The CODEwords which are used to derive the passphrase
are not stored with the laptop. They both never leave the key generation
Thirdly: The security of the system is not in keeping the algorithm
secret. Ultimately all it is doing is generating offsets for lookup in a
secret codebook. The Codebook is not stored with the laptop, and
protected. The security is keeping this codebook secure.
If the attacker was to somehow derive the numbers the algorithm produces
it would be useless without the codebook.
The laptop has no idea (45, 254, 12) means "alice walked with bob to
town". Possession of the serial number or key generation algorithm would
be effectively useless.
Ansgar -59cobalt- Wiechers wrote:
On 2007-11-18 ManInWhite wrote:
I have been tasked with deploying partition based encryption for our
fleet of laptops.
It has been suggested that we use an algorithm derived passphrase
based on some unique hardware number. [ HDD Serial# / Laptop Serial#
Then your security would depend on the attacker not knowing the
algorithm for deriving the passphrase from the serial numbers (which
will be known to him once he has access to the hardware).
Bad idea. Don't do that.
The only good design for algorithmically derived passphrases is not to
have algorithmically derived passphrases.
On Nov 17, 2007 8:51 PM, ManInWhite <maninwhite () tpg com au> wrote:
It has been suggested that we use an
algorithm derived passphrase based on some unique hardware number.
[ HDD Serial# / Laptop Serial# ]
So when the laptop is stolen, the thief will also have all these
serial number, and if they get hold of their algorithm, they can
re-construct passphrase for any laptop.
this kind of scheme may work for equipment that doesn't leave the
facility e.g. servers in datacenter. But definitely don't use this for
I suspect you are trying to use BitLocker, which lack centralized key
management. I would suggest you take a look at some other holistic
solutions for encrypting your laptops.
Disclaimer link. To see it, click the link below, or copy and
paste it into your browser's address line.