Slashdot Mirror
Mazda Switches To USB Keys
kv9 writes "The new Mazda Sassou while being 'cool and promoting a positive state of mind' has a most important feature, that every geek will love. Instead of the classic key it uses a usb flash drive for starting up. The key can also be used to transfer things like driving instructions or music to the car's hard drive."
RFID would be the way to go. I though that somebody (Mercedes, Lexus?) had one of their uber-expensive cars set up so that you carried an RFID chip in a credit card in your wallet. When you pulled up on the doorhandle it checked your ID and unlocked. Automatically locked when you got more than 20 feet away, and only had a push-button for a starter.
Or, it could have all been a dream.
"Mazda switches to USB keys"
Um, no.
Mazda put a USB key in a freakin' concept car. There's no USB keys in any Mazda at any dealership now. It might happen some day down the road.
"Switches" my ass. "Tries out"? "Messes about with"?
Come on guys.
There are many USB tokens on the market. Probably a few of them will handle 2048 bit RSA keys. This is as strong asymetric encryption as you'll ever need.
What you do is you send a challenge (random bytes) from the car to the token. It encrypts (read: signs) the challenge with the private key. Now the encrypted challenge can only be decrypted by the public key. The car does this and if it finds the challenge it knows that the token has the secret private key of the public/private key pair.
These chips can keep the private key pretty safe, so safe that it is really, really hard to get it ever out of the chip, even in a big lab. And with USB it is pretty easy to put some MB's or GB's next to it.
All this said, such a key would be easy to loose (forget you put it in a computer somewhere), and USB has not such a strong connector (even if better than most computer connectors). I hope they used one that was designed from scratch. It's not so much the security that I worry about.
No, without commands from the computer to fire the injectors, etc, it won't start.
If you work in a facility that requires you to not bring media into work so that you can't remove secret information, you deserve to be fired for bringing in a flash drive. Trusted insiders are the greatest threat, hence the need for policies. Such policies are very enforceable, and hold up under the law for the dismissal of employees who violate them. A good policy sets up not only what's forbidden, but also what to do if a security breach happens. Check http://www.sans.org/. If an employee is determined enough, he or she might just find a less restrictive job.