NIST Investigating Mass Flash Drive Vulnerability

Lucas123 writes with a followup to news we discussed earlier this week that the encryption on NIST-certified flash drives was cracked. "A number of leading manufacturers of encrypted flash drives have warned their customers of a security flaw uncovered by a German company. The devices in question use the AES 256-bit encryption algorithm and have been certified using the FIPS 140-2, but the flaw appears to circumvent the certification process by uncovering the password authentication code on host systems. The National Institute of Standards and Technology said it's investigating whether it needs to modify its standards to include password authentication software on host systems. Security specialist Bruce Schneier was blunt in his characterization of the flaw: 'It's a stupid crypto mistake and they screwed up and they should be rightfully embarrassed for making it.'"

Comments

If you want to encrypt your data

[MichaelSmith]

Use PGP. Create a really long key, like 4096 bits.

Re:If you want to encrypt your data

[PopeRatzo]

I am still using an Enigma machine that my grandfather brought me back. He stole it from the ennemy while in combat.

You're the one who's got my grandad's Enigma machine!

Give it back. You can send it to me here in Argentina.
 

Re:Encryption algorithm's aren't the weak link

[Anonymous Coward]

Put it in a way /. understands, please.

"It's like having a really huge penis but never leaving your mother's basement."

Re:Encryption algorithm's aren't the weak link

[Joce640k]

The weak link is in the apostrophe.

Re:Encryption algorithm's aren't the weak link

[jd2112]

Just use Quantum Encryption, They'll never crack that.

Oh, nevermind. http://it.slashdot.org/story/09/12/30/2118250/Quantum-Encryption-Implementation-Broken?art_pos=1

Re:some vendors got it right... Trust no 1

[AHuxley]

Why not just say "Microsoft"?

Yep.

[ScrewMaster]

Security specialist Bruce Schneier was blunt in his characterization of the flaw: 'It's a stupid crypto mistake and they screwed up and they should be rightfully embarrassed for making it.'"

That's our Bruce.