Cracking a Crypto Hard Drive Case

juct writes "A label on the box reading 'AES' does not ensure that your data are protected. heise examined a hard drive enclosure with an RFID key that is typical of many similar products. They found that the 128-bit AES hardware encryption claimed in advertisements was in fact a simple XOR encryption that they were able to break easily with a known plaintext attack." The manufacturer of the drive examined has announced that the product is being retooled and will be reintroduced later this year, presumably with actual AES encryption.

Comments

Criminal prosecution?

[palegray.net]

For God's sake, can't the company's executives be charged under a criminal statute? Fraud, anyone? I guess their next product will use advanced ROT13 encryption technology.

Re:Criminal prosecution?

[Nero Nimbus]

Hey, that's better than ROT26.

Re:Criminal prosecution?

[mxs]

For God's sake, can't the company's executives be charged under a criminal statute? Fraud, anyone? AES was used /somewhere/.

It's /never/ a good idea to rely on cryptographic features when you don't know exactly how they are implemented. A vendor telling you they use AES is completely and utterly worthless, and always has been. It's a nice buzzword people like to use.

It's also NEVER a good idea to use any "crypto developed in-house". Manufacturers love to tell you since they developed it and their development is secret and such that their product is safe and secure, much more secure even since nobody knows how it works.
Cryptologists laugh at those claims, and everybody else should, too. These non-encrypting devices are a good reason as to why they do so.

If you want truly encrypted files and disks, don't rely on cheap external enclosures. TrueCrypt is not hard to use and offers a decent level of protection (forget Windows crypto, it's littered with backdoors unless configured JUST right, which is not an easy task and definitely not default). Under linux, it's decidedly easy to use AES encryption on block devices.

I guess their next product will use advanced ROT13 encryption technology. For good measure, they'll apply it twice -- after all, twice is better than once.

Re:Criminal prosecution?

[Spy der Mann]

It'll be so good, it'll do ROT13 twice!

Hah! That doesn't compare with DOUBLE-XOR encryption! :D

Re:Criminal prosecution?

[Anonymous Coward]

Double-ROT-13 is funny
Quadruple-ROT-13 is twice as funny
Sextuple-ROT-13 is thrice as funny, and gets a two bonus points for the 's-e-x' string in it
Octuple-ROT-13 is twice twice as funny, and gets a bonus point for sounding a bit like the word 'octopus', which has 'p-u-s' in it, which sounds a bit like 'pussy', which is a synonym for 'vagina', which is related to 'sex'
Decuple-ROT-13 is twice plus thrice as funny
Duodecuple-ROT-13 is twice thrice as funny

After that it just gets lame.

Re:Criminal prosecution?

[garutnivore]

Open source is better than closed source for security code but it is not a silver bullet. The idea is that you want to have as many objective and capable coders able to examine the security code. That way, weaknesses in the code or shady things like back-doors are likely to be spotted and publicized. Closed source creates a significant obstacle against that examination. Open source does not create the obstacle but even without obstacle to examination you have no guarantee that objective and capable coders will actually examine the code.

Re:Criminal prosecution?

[alexgieg]

Octuple-ROT-13 is twice twice as funny, and gets a bonus point for sounding a bit like the word 'octopus', which has 'p-u-s' in it. . .

And tentacles.

How about a software solution?

[palegray.net]

Would something like TrueCrypt, where you can easily look at the source, be a better solution? At the very least, it could avoid problems like these.

Re:How about a software solution?

[palegray.net]

I'm aware it's not the same thing :). While I understand the performance benefits of doing the heavy computation with specialized hardware, I'm questioning the wisdom of trusting any embedded encryption platform that isn't easily audited for correct operation. What about devices that actually perform encryption using the algorithms claimed, but the implementation of the crypto routines contains a flaw that isn't easily detected? What do you do about it when your organization has a few of them in production? Closed platforms make me nervous when security really matters.

Re:How about a software solution?

[davmoo]

There's another disadvantage to hardware encryption like this product, even if it worked correctly, and why I also favor something like TrueCrypt (which is infact what I use) even if it might make a bit more work for the computer. The maker says "this is our special chip, and here's the source for our firmware for you to inspect"...now, how do you *know* that's really the firmware that's on that chip? Very few of us are in a position where we could take that source and make our own chip. In a situation where I want to be assured of security, I'm going to not only use TrueCrypt, I'm going to compile it myself.

Re:How about a software solution?

[blackwing0013]

Call me back when they have released something based on version 5.0 that "works" with Linux. Right now, the newly released 5.0 series is broken on Linux. It will cause your machine to lockup on most kernel versions used by Linux distros. Apparently, according to the authors of Truecrypt, they require you to upgrade to the latest release of the Linux kernel, which may not be an option for most of us.

Secondly, even if you were able to make it work the Linux kernel on your machine, the new FUSE-based Truecrypt 5.0 series is only 1/20-1/10 of the speed I get from the 4.x series. From 20-40 MB/s, now I only get 1-5 MB/s.

I am now considering to switch to dmcrypt+luks.

Re:How about a software solution?

[Anonymous Coward]

I'm going to not only use TrueCrypt, I'm going to compile it myself.

That won't help you. You need to read Reflections of Trusting Trust by Ken Thompson: http://cm.bell-labs.com/who/ken/trust.html

Re:So what happens...

[palegray.net]

All the fobs are encoded with the special key: QWERTYUIOP1234567890. Don't worry though, the key is copyrighted internationally and cannot be used without proper authorization. Devilishly ingenious, those wily engineers...

Trust

[Mikey-San]

The manufacturer of the drive examined has announced that the product is being retooled and will be reintroduced later this year, presumably with actual AES encryption.

Trust is a precious resource that you must cultivate; it's not a boomerang. Never risk throwing it away.

Re:So what happens...

[kcbanner]

I think this is actually true in some cases. I once worked on some 2.4ghz radios from a certain vendor, and if you forgot the admin password you could expose them to the net and they could "unlock" them (YIKESOMG). They also had a version where you gave them the MAC of the radio and they gave you a special "unlock" password over the phone. Yea. It wasn't even random either, it was an english word iirc. The world of proprietary network gear = ugh. I prefer building them myself using Soekris or similar.

Re:XOR encryption can be good

[RupW]

Stream Ciphers also use XOR, but are much more convenient to use and could very easily be used to encrypt a hard drive. The problem is that very few stream ciphers allow you to quickly seek to an arbitrary point in the stream - so unless you just want to read the entire drive sequentially you're SOL.

The only exception I've read about is SEAL but IIRC that's still patented by IBM.

Re:XOR encryption can be good

[kiltyj]

To enforce parent's point, many (if not all) of the best modes of operation (CCM, etc) for block ciphers like AES use XOR -- it would be silly to think of cryptography without XOR.

It is also true that one can use AES (ignorantly) in a way that allows decryption as described in the article. Using Electronic codebook (ECB), for example, with the same key for each block, would provide no security beyond what would be provided by a reused OTP. Sadly (though obviously insecure), this is still technically using AES as a block cipher -- it's just using an insecure mode of operation. My first thought was that the manufacturers used ECB, or a similar insecure mode of operation (trusting the claim of using AES).

From reading the article, though, it seems the manufacturers even admitted only using AES "when saving the RFID chip's ID in the controller's flash memory" and that "actual data encryption is based on an algorithm developed in-house." Just goes to show that if tried-and-true algorithms / ciphers are available, you should NEVER have to develop your own.

Perfect XOR encryption.

[Ihlosi]

XOR is not an encryption method, it's just a binary operation. It's what you XOR your data with that determines if your encryption is good or not. That's what is the problem in this case.

Indeed. I XOR the data with itself, making sure that it can never, ever be decrypted.

Re:Well, as others have noted

[Bert64]

Well, just because you may not know too much about C or encryption...
I'm not really inclined to trust some company that says product X is secure, but i'm far more likely to trust a string of unconnected individuals, especially if some of those individuals are recognised cryptography experts or have at least studied cryptography at a reputable establishment.
Sure it's not perfect, but its a huge step in the right direction. The only perfect solution would be to study cryptography and programming (in whatever language) yourself first.

It's not the company's fault...

[msauve]

although they perhaps didn't do due diligence.

They used a chipset from INNMAX, the IM7206, believing it provided AES encryption to data. INNMAX's marketing strongly implies that AES encryption is being used for data on disk.

According to the article, when confronted with this situation, INNMAX's response was

The IN7206 merely uses AES encryption when saving the RFID chip's ID in the controller's flash memory. The company explained that actual data encryption is based on a proprietary algorithm. The company claims the IM7206 only offers basic protection and is designed for "general purpose" users.

Cheap Chinese Crap.