NIST Investigating Mass Flash Drive Vulnerability

Lucas123 writes with a followup to news we discussed earlier this week that the encryption on NIST-certified flash drives was cracked. "A number of leading manufacturers of encrypted flash drives have warned their customers of a security flaw uncovered by a German company. The devices in question use the AES 256-bit encryption algorithm and have been certified using the FIPS 140-2, but the flaw appears to circumvent the certification process by uncovering the password authentication code on host systems. The National Institute of Standards and Technology said it's investigating whether it needs to modify its standards to include password authentication software on host systems. Security specialist Bruce Schneier was blunt in his characterization of the flaw: 'It's a stupid crypto mistake and they screwed up and they should be rightfully embarrassed for making it.'"

Comments

If you want to encrypt your data

[MichaelSmith]

Use PGP. Create a really long key, like 4096 bits.

Re:If you want to encrypt your data

[snemarch]

Not really applicable to a hardware device.

Also, keep in mind that RSA by itself is much too slow to encrypt large amounts of data; thus, PGP and other solutions only use RSA to encrypt a symmetric cipher, which is then used for the bulk encryption.

Standard AES-256 is actually just fine, problem with these devices is that the manufacturers screwed up the implementation *majorly* (as I understand it, use the same key for every device and depend on a usermode app to say GOOD_GUY/BAD_GUY to the hardware) - but that's covered elsewhere.

Re:If you want to encrypt your data

[TubeSteak]

Standard AES-256 is actually just fine, problem with these devices is that the manufacturers screwed up the implementation *majorly* (as I understand it, use the same key for every device and depend on a usermode app to say GOOD_GUY/BAD_GUY to the hardware) - but that's covered elsewhere.

The fact that so many major companies have the same exact flaw in their product suggests (to me) that there is only one manufacturer and multiple vendors who just rebadged the item.

I think it's less likely that multiple companies independantly managed to screw up their products in exactly the same way.

Encryption algorithm's aren't the weak link

[Anonymous Coward]

Encryption algorithm's aren't the weak link, its the implementation. But most people just look at how big the key is not who implemented it.

Re:Encryption algorithm's aren't the weak link

[Kjella]

Encryption algorithm's aren't the weak link, its the implementation.

What's more usually the case is that the implementation of the algorithm is just fine, but you fail at using it in the right way. Usually because then you've handed it off from the cryptography experts and to the general team that's building the rest of the system. Kinda like a door that has a great lock but is easy to take off its hinges, won't do you much good.

Re:Encryption algorithm's aren't the weak link

[Joce640k]

The weak link is in the apostrophe.

Re:Encryption algorithm's aren't the weak link

[Anonymous Coward]

My understanding of these devices puts the analogy at:

A super solid, near uncrackable/breakable safe, but all models use the same 12345 passcode, and the owners cannot change this.

To make matters worse, the door of the safe has been mounted on a normal house door that only has a sign saying 'do not open if this is not yours'.

This way, the safe owners dont need to rember such a complex code as '12345', and you get all the security of the full safe. Unless a intruder happens to have a brain, then they will just open the house door that holds the safe door thus negating the entire system.

If anyone could design a worse system, they are truely rube goldberg masters.

Significant flaw & workaround

[Snotboble_]

This is pretty major as so many vendors are affected by it. However, until there's an update or complete recall & replacement, I'd recommend using Truecrypt. Certified by NIST (see HERE. Cross platform. Free (as in spoken beer ;o). Of course, one can only hope that its implementation is better than the devices currently uncovered :P

some vendors got it right... Trust no 1

[advocate_one]

IronKey was among a number of companies to issue statements reassuring customers that their devices were safe from the same attacks. Jevans said that's because the password and authentication process is contained on the USB drive itself and has nothing to do with the host system.
"We don't trust the computer at all," he said. "The computer could have malware on it or have hackers accessing it. In our security design, we said we have to assume the computer is completely untrustworthy. That's where we started our threat modeling."