Slashdot Mirror
Crypto with Epoxy Tokens, Glass Balls and Lasers
Anonymous Coward writes "Scientists from MIT and ThingMagic have collaborated and developed an innovative crypto mechanism using epoxy tokens, glass spheres and lasers. They have actually created a physical one-way function that cannot be tampered, copied or faked! The full scoop can be found at MSNBC, and also at Nature, & TOI."
for random numbers with
Lava Lamps? Now there is Lava lamp cryptography.
Read about it at:
LavaLamp
Thanks and have a weekend !
I think the process involved mixing a bunch of little tinfoil sparkles into a clear epoxy resin, applying the resulting glue as a seal, and photographing it from several angles. Simple to create, yet darn near impossible to duplicate a second time. If the blob is missing or different, something fishy is going on.
The thing about things we don't know is we often don't know we don't know them.
Getting the 2D pattern is easy (anyone with access to a reader could simply get this pattern through software). You then have to manufacture a crystal which produces this pattern, so that you can use your new counterfit card at the Sony store, etc. This is the part that is currently impossible.
The article claims that making a holographic forgery would be prohibitively difficult, but doesn't explain why.
You could almost certainly make one if you had the original card to duplicate.
If you had the verification information for the card - the list of patterns the scanner looks for - you could probably make a holographic reproduction with a bit of fiddling (the same multi-exposure technique is used for making aminated holographs that move as you change viewing angle).
You'd have a hard time duplicating the card just from observing one transaction, but the same holds true for electronic media (one challenge/response pair does not give you a smart card's key).
Does anyone have further details on why the researchers say this would be difficult to forge?
One of the nice things about a smart card system is that it doesn't have to go onlne for each transaction. From the descriptions it seems that this system does have to check with a database at the time of purchase. So the speedup from a smartcard is lost.
Lasers Controlled Games!
series called the grey lensman by E.E. "doc" Smith IIRC. Law enforcement was struggling to find a non-forgable form of ID, and one of their failed attempts was a 3D crystal. Interesting that this idea has been around that long.
The idea was that the hull of each spacecraft was coated in embedded diamonds (cheap in the future because DeBeers' monopoly is gone). The police can then read your hull with a laser from 1 million miles away and you can't forge the "number plate".
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
So what? They will use how many, ten angles? To minimize the storage, computing power and hardware needed to read the card. I doubt there would be billions of possible angles to make "check out all angles" reverse engineering impossible.
It's a neat idea, but so are fingerprint / iris readers. Unfortunately, because businesses want cheap devices, you can fool them with household equipment.
All the device would need to do is check at least two angles simultaneously. No 2D forgery can bypass that.
The article seems to be missing the point of one way functions. If you don't change the inputs to a one-way function, it is exactly the same as constant (ie. no good for verification of anything).
An easy application is for keys. If the lock has N input/output pairs recorded, getting in with a fixed example output would be hard.
A more advanced use of these things would be to have some way standard way of encoding a bill of sale including a datestamp into bits that could drive the laser inputs. Then save the resulting pattern(s) as proof that the vob was there at the time of the transaction.
However, that leaves a major hole. If the user destroys the vob, the store can no longer check if the signature was valid. To combat this, the user needs to be identified at the time of the transaction. As long as the vobs are registered in a central identity server so that the store can make sure the person is who they claim to be at that point. Additionally users have to record lost or destroyed vobs. The central identity server could use the N known input/output pairs to authenticate the user.
Insightful! Yes... I went in and read the actual article (in Science, with subscription, sorry), as a result, here's a rather verbose response. You're pretty close to what the original authors actually propose in the article. Essentially, the fob is just a rugged, cheap, light weight way of carrying around a zillion answers of ridiculous complexity to a whole bunch of simple questions. Before you're given a fob they would scan it at every angle, position and wavelength of interest, generating an enourmous number of possible questions to ask. Then they store the answer to all the questions. When you actually use the thing to make a purchase, a question is asked (ie. what do i get if I illuminate at X angle, Y position on the resin and with Z wavelength). A particular answer is given and compared to the stored answer. If it agrees, great. If not, try another. If it fails again, then it doesn't validate. The key thing though is that questions are never asked twice! As a result, the questions and the answers could be intercepted and stolen one by one and it wouldn't matter, as they could never be used again! When they run out of questions to ask (or get close) they have you get another 1 cent fob. The only real security problem I could imagine would be if someone cracked a reader and had it try to read all possible combinations while you were standing there. This would probably take too long to make it worth it. A partial read, well the theif doesn't control which question gets asked and if you have too many bad verifications, ie you're trying to use a partial read, they might drop by to check out your reader... Two other problems, if it gets stolen, you're SOL. Second, the reader is likely to be expensive, making it hard to use this to allow purchase authorization at home. So your problem... The problem with this is that the validation server would have to know what the right answers are to all of the possible questions, and that creates a problem: either there would be waay too much data stored for each card, or there would only be a limited number of "questions" the server could ask. The answer, a limited number of questions. This would probably be fine tuned to balance out the replacement cost, anticipated number of validations during the lifetime of the thing etc. Seems like storage might be an issue though. As far as the half baked work around everyone else seems to be proposing, reading the article helps. The only one which actually might work, reproducing the resin using the paired laser/heat harden resin approach might actually work at some point. But it would require having the fob in the theif's possession for so long that the original would probably have noticed as missing, canceled the old one and gotten a new one by the time it was ready.