[148988] in cryptography@c2.net mail archive
[Cryptography] Dumb idea: open-source hardware USB key for crypto
daemon@ATHENA.MIT.EDU (Bill Cox)
Fri Jan 10 18:23:37 2014
X-Original-To: cryptography@metzdowd.com
Date: Fri, 10 Jan 2014 17:53:08 -0500
From: Bill Cox <waywardgeek@gmail.com>
To: "cryptography@metzdowd.com" <cryptography@metzdowd.com>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
I've been noodling the idea of a USB stick designed in a way that we
can trust the crypto that goes on there. It's a hard problem, but
there seems to be some guidelines that could help:
- Open source hardware - schematics and everything including board
layout need to be free
- No ICs that could be compromised. Any CPU would have to be a
soft-core in an FPGA, with an open-source design
- FPGA configuration memory both readable and writable over a JTAG port
- External flash program memory also read/writeable through JTAG
- Reasonable hardware RNG where every node in the circuit can be probed
- Signal isolation from the PC: solid state relays would swap a simple
memory back and forth between the PC side and USB stick side. Maybe
power draw should be randomized to obscure any processing going on.
RF shielding should cover the USB stick. No other communication
should be possible. This is similar to an air gap.
- A community supported audit trail verifying produced USB keys are secure
The idea still has issues. Where would I be able to store secret keys
securely such that an attacker who stole my USB stick could not
recover it? Anyway, it's just a fun idea. I'd love to have such a
device in my pocket. There's a lot of applications I can think of
that could benefit from it, from electronic voting to
microtransactions. As one security expert once said in an
electronic-voting discussion I followed, no machine ever connected to
the Internet has proven secure. Could we make such a beast? I
probably don't really have time to work on it, but if a group were
building it, I'd participate.
Bill
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
