Slashdot Mirror
Security Company Tries To Hide Flaws By Threatening Infringement Suit
An anonymous reader writes: An RFID-based access control system called IClass is used across the globe to provide physical access controls. This system relies on cryptography to secure communications between a tag and a reader. Since 2010, several academic papers have been released which expose the cryptographic insecurity of the IClass system. Based on these papers, Martin Holst Swende implemented the IClass ciphers in a software library, which he released under the GNU General Public License.
The library is useful to experiment with and determine the security level of an access control system (that you own or have explicit consent to study). However, last Friday, Swende received an email from INSIDE Secure, which notified him of (potential) intellectual property infringement, warning him off distributing the library under threat of "infringement action." Interestingly, it seems this is not the first time HID Global has exerted legal pressure to suppress information.
The library is useful to experiment with and determine the security level of an access control system (that you own or have explicit consent to study). However, last Friday, Swende received an email from INSIDE Secure, which notified him of (potential) intellectual property infringement, warning him off distributing the library under threat of "infringement action." Interestingly, it seems this is not the first time HID Global has exerted legal pressure to suppress information.
Nothing worse than a person who always finds a way to blame someone else for their own mistakes, except perhaps cold coffee or warm beer.
Buy your next Linux PC at eightvirtues.com
IClass, meet Barbara.
You can't handle the truth.
Most of the world knows that security is fleeting, and those that deepend on the law to preserve obscurity is the fleetingness of all. Do they not even consider that citizens of nations that don't give a shit about legal protections are the very people their customers need to be protected against? These companies should be paying rewards to anyone who can defeat their protections, not punishing them.
Time is what keeps everything from happening all at once.
Below I will paste the specific patent's independent claims. I don't think this can actually cover generic software written for the PC, because of the 'secret memory' and the fact that they have patented the device implemented in hardware, not a software implementation of the algorithm (and how many computers actually have a pseudo-random shift register?)
1. Method of producing an authentication code (CA), comprising cycles for reading binary words (Mn) out of a secret memory (21) comprising a plurality of binary words, wherein, at each cycle, the address for reading a word out of the secret memory (21) is generated from an address generating binary word (GA) forming the result of a combination operation (Fc, ) of words (M1 to Mn) read out of the memory during previous cycles, characterised in that it comprises a transform operation of the address generating word (GA) consisting in logically combining at least one bit (g'0, g'1, g'2) of the address generating word (GA) with at least one bit (r1, r4, r6) of a pseudo-random shift register (26).
8. Logic machine (20, 20-1, 30) clocked by a clock signal (H), comprising a secret memory (21) in which a plurality of binary words read out at clock rate are stored, wherein the output of the memory (21) is applied to a first input (A) of a logic circuit (22) whose output (C) is fed back to the second input (B), the logic circuit (22) performing a combination (Fc, "+") of its two inputs (A, B) and producing an address generating binary word (GA) supplied to the address input (ADR) of the memory, characterised in that it comprises a pseudo-random shift register (26) and logic means (25-1, 27) for combining at least one bit (r1, r4, r6) of the shift register (26) with at least one bit (g'0, g'1, g'2) of the address generating word (GA).
"First they came for the slanderers and i said nothing."
Without inspecting the software, and knowing what the HID attorney is asserting, there is no way of forming a legal opinion... and this is in no way a legal opinion, just a recitation of the first patent claim and some questions. But it does look like the method requires using a "pseudo-random shift register" and a "secret memory" among other things. Do the people who are said to infringe actually use this method? Does the code require that such a register and memory be used, or are there ways the code could be used without infringing all of the elements in the claim? Is the target of the letter simply caving to avoid consulting a lawyer?
Join the IParty!
Some software projects like LAME, x264, and libav claim to skirt around patent issues by only distributing source code, not binaries. I've always wondered if this is a valid workaround, or just some clever devs getting their hopes up.
"Being a security company, we wanna keep our mistakes secure."
Table-ized A.I.
His implementation only uses non-secret memory and should therefor be safe from these patents. The patents described here rely on the contents of the memory of the contraptions to be "secret" to make the process "secure".
You could even say that the original implementation by INSIDE secure doesn't follow the patent since obviously, the memory content isn't that "secret" anymore.
I was promised a flying car. Where is my flying car?
I've said that same thing before. I happen to BE competent professional in certain security matters, so that affects my point of view.
On the other hand, the most popular locks, Kwikset and Master lock, are obviously not designed to be secure against a knowledgeable or determined advesary. They are designed to discourage your neighbor from casually getting into your stuff, and that's pretty clear from looking at the product and feeling how lightweight it is. Maybe that's what people want most of the time - a lock sufficient to make it rather inconvenient for the average person to walk in, not something that's going to keep the locksmith out when you lose your key.
At the other end of the spectrum, for $10,000 you can buy a heavy duty safe made of steel and concrete. For $32, I can rent a demolition saw designed to cut through concrete and steel. Since physical security costs about 300 times as much as breaking it costs, perhaps the primary goal is to not be low-hanging fruit. I've watched a car burglar go from car to car, stealing stuff from the ones that were unlocked. He skipped the locked ones, which all had very breakable windows.*
* Redundant. Windows is always easily breakable.
under european law, they have no standing for requesting this sort of code to be removed, as the code was obviously created as a research tool and for interoperability.
screw those idiots... let's start git cloning the hell of it ;)
NoClass sounds more like it.
"When they said you was IClass, well that was just a lie".
(ducks and runs)
It's seriously difficult to understand the mindset of the organization and how they came into this. Did they even bother hiring a competent cryptographer when designing their product ? Were they duped by someone they hired and led to design a insecure product ? Or is encrypting an RFID communication a difficult and non-trivial task with no known vetted solution ?
I don't think that the problem is difficult in some fundamental way (the problem of verifying a remote host with asymmetric crypto has been reasonably well explored with SSL/TLS, and an access control system has the advantage of being able to trust only a CA it controls, and the advantage that you need to get physical access to an RFID reader pad to attempt attacks); but there are significant practical challenges.
RFID chips are pretty power constrained, since they only get whatever energy they can scavenge from the reader's RF output; and customers want them to be cheap. The industry also has fairly long product lifecycles (since, once you've put in a zillion card readers and integrated it with all your other building security stuff you don't want to rip it out and upgrade in 2 years).
It isn't so much a 'there is no known cryptographic solution to this problem' issue as a 'Why yes, we still have major customers using the 'security' provided by the lousy proprietary cryptosystem that our engineers were able to cram into a cheap, power-constrained, chip using the fab processes available in the mid to late 90s, and we really don't want to fix that' issue.
Can't say I've ever heard of [...] security by litigation.
Then you weren't around for the DeCSS cases.
The goal of any security measure is to make it easier for someone to break into someone else's property; thus securing yours.
It's like an implementation of the punchline, "I don't have to run faster than the bear. I just have to run faster than you."
Please stand clear of the doors, por favor mantenganse alejado de las puertas
Where did you get that interpretation? The way I read patent law, if you trip all the parts of one claim, you infringe the patent. If a claim is dependent ("The device of claim 1, where..."), you have to trip the claim it mentions as well. But you don't have to trip all of them.