ABIT's Secure IDE Motherboard

Frank Caviggia writes "The Inquirer has a story about ABIT's spiffy new IC7-MAX3 motherboard. Apparently, this motherboard has a feature called 'Secure IDE,' which is marketing-speak for hardware-based encryption ... ABIT goes on to claim that 'Secure IDE' 'will keep government supercomputers busy for weeks and will keep the RIAA away from your Kazaa files.' Pretty bold claims for a motherboard maker ..."

Comments

Security by obscurity, cool.

[mjmalone]

SecureIDE connects to your IDE hard disk and has a special decoder; without a special key

So what they are saying is their algorithm is proprietary and is therefore likely insecure? I thought people stopped believing in/hyping security by obscurity years ago... Or maybe that's just wishful thinking? Hell, for all we know they could be using xor encryption or some such crap. I don't trust any encryption algorithm that I can't see.

while ((c = getc(unencrypted)) != EOF) { if (!*cp) cp = "key\0"; c ^= *(cp++); putc(c,encrypted); }

3y3 y4m l33t, c4tch m3 1f y0u c4n RIAA. heh.

In addition, if there is no key does that mean there is no local security? If someone just took your whole rig mobo and all would they be able to access your files since whatever algorithm they are using must be embedded in the board?

I can see the spooks at NSA laughing.

Re:Security by obscurity, cool.

[garcia]

I certainly doubt the NSA it too worried, and I doubt that the majority of people will generate good passwords/keys, but it's a step in the right direction.

Is someone going to go out and buy this MB if they aren't intending on using other good security measures?

The general public doesn't create decent password/key pairs. Joe Schmoe is not going to buy this board. Paranoid freaks are.

Re:Security by obscurity, cool.

[Pieroxy]

The question is more: When my Mobo dies or has to be replaced, can I read my HDD on a new one?

Re:Security by obscurity, cool.

[enigma48]

A little more info:

It looks like this (physically) small key plugs directly into the encryption/decryption chip (the interface looks like a USB plug but the picture doesn't show it well; the interface itself has a 4 pin header though).

It looks like to boot your computer, the key needs to be there. So make sure the police never show up while you are using the computer, never keep the key on you and keep your case open all the time so you can attach/detach it easily?

Nice idea though. Just not entirely practical.

Right

[dirkdidit]

will keep the RIAA away from your Kazaa files.

Wouldn't that require some intelligence by the user? I mean like not sharing their file library? It's not like the RIAA can just go into people's homes and start busting open computers for pirated music.

Kazaa

[Anonymous Coward]

Secure IDE .. will keep the RIAA away from your Kazaa files.'

Until the user shares them with the world. Damn some people are stupid.

RIAA

[swtaarrs]

The RIAA isn't going after people because it finds files on their hard drive, it goes after people because it sees them sharing these files online, unencrypted. This technology is worthless against the RIAA in that respect.

Before

[Schezar]

Before everyone starts bitching with their collective "This can't work! How would it work!?! It's insecure!!" pablum, I offer this solution:

wait.

There will be more information in the weeks and months to come. Don't decry this as useless until you know what it actually is.
___________

That aside, this could be a case of "secure computing" working counter to many of the interests that originally pushed it. Sure, encrypted channels can be used to enforce DRM, but they can also be used to hide that cracked media when $badguy comes looking for it on your hard drive.

The DMCA can work for you just as it works for $badguy. That encrypted IDE is protecting -your- copyrighted intellectual property, after all.

a few thoughts....

[NerveGas]

Encryption algorythms are sufficiently advanced that key management is the real issue: Trying to brute-force it can be very difficult, but finding out the private key (which makes decryption trivial) can often be relatively easy. So, even if they used reasonably strong encryption, chances are that they won't succeed at protecting the private keys.

However, I suspect that their encryption isn't really all that strong. Doing strong encryption at speeds necessary to sustain IDE transfers (up to 50 megabytes/second *per drive*) is fairly serious stuff, especially if you want to be able to do it at sufficiently low latencies. Hardware-encryption boards that truly do strong encryption at much slower speeds than that are pretty pricey, usually at least four figures.

steve

Read the damn article...

[Physics Nobody]

Everyone ranting about how this is inherently stupid since the key is just on the motherboard should actually read the article and note that the key is actually going to be stored on a removable device of some sort. So the idea is you carry the key with you at all times and just plug it into the computer when you want to use it. When the key is not in the computer the data cannot be read.

Of course this still doesn't explain the silly Kazaa claims, however that is another issue altogether. In fact this whole thing seems kind of useless since if the government were to confiscate your computer or something you'd think they could just subpoena the key as well, and it does nothing to protect against hackers since the key has to be in your computer for you do use it. Turning it off when you're not using it would be just as effective. About the only thing this is good for is in case somebody steals your computer when you're away. But it could work for that.

Since nobody reads the acticle...

[Kjella]

• It has *nothing* to do with the motherboard, it is a card that connects between the IDE cable and the IDE drive. Like s separate card.
  
• It works with all OS, no drivers. You need to start from a blank disk though because everything is being encrypted/decrypted as it passes through (if you "decrypt" plaintext something it goes horribly wrong).
  
• The encryption is 40 bits which is really really weak. Same as DVDs for example (ok slightly FUD because CSS was a poor algorithm)
  
• You have an external keyring, which acts as your hardware key.
  

That being said, I really don't see the big use of this. It's only good if your disk is taken, they don't take the key and it's only protecting the information (disk is as good as ever if you remove the card and format it again). Of course if you have vital company/personal/military data on your disk I suppose that might be enough of a reason.

Kjella

40-bit DES?

[Sapwatso]

according to the installation guide:

40-bit DES (US Data Encryption Standard) is adequate for general users

In much the same way that leaving the data un-encrypted is adequate for general users, I suppose.

Re:No, read a little further

[Xzzy]

If you're gonna borrow overused cliche's, at least get them right. R-Type is an old (and very pretty) side scroller from the arcade.

I think what you meant was the Type R. ;)

Won't keep RIAA out

[billstewart]

According to several other posters, it's running DES-crippled-to-40-bits as its encryption algorithm, and in ECB mode, not CBB, just to make it easier. Regular 56-bit DES took about a day for distributed.net to crack in ~1998 (though they got lucky - should have taken them ~2-3 days.) Since then, computers have gotten much faster, and this is 2**16 easier. (Technically that's only true if the crippled keyspace can be searched efficiently, like the full keyspace can, but that should be doable, and worst-case is no worse than single-DES.) True, the EFF machine in John Gilmore's basement hasn't gotten any faster, but it's been sitting there collecting dust for years, and somebody who wanted to spend another $250K to build a new one would get a much faster machine today - and if it's the RIAA, they could pay for it with the first couple of lawsuits against file-sharers.

Not only will it not keep government supercomputers out for weeks, it won't keep the RIAA out of your disk for weeks if they confiscate it. Besides, the RIAA can subpoena you to make you hand them the key dongle. Also, this is only useful against people who have physical possession of your disk when your machine isn't running - if your machine's running with the disk mounted, it's no different than a regular disk, so querying your Kazaa file-sharer will work just fine, or running a search program on your machine.