Slashdot Mirror
MIT Reveals "Hack-Proof" RFID Chip (thestack.com)
JustAnotherOldGuy writes: A group of researchers at MIT and Texas Instruments claim that they have developed a new radio frequency identification chip that may be impossible to hack. Traditional RFID chips are vulnerable to side-channel attacks, whereby a hacker can extract a cryptographic key from the chip. The new RFID chip runs a random-number generator that creates a new secret key after each transaction. The key can then be verified with a server to ensure that it is correct. The group at MIT also incorporated protection against a power-glitch attack, an attack that would normally leave a chip vulnerable to an interruption of the power source that would in turn halt the creation of a new secret key. Texas Instruments CTO Ahmad Bahai stated, "We believe this research is an important step toward the goal of a robust, lo-cost, low-power authentication protocol for the industrial internet." The question is, how long will it be before this "hack proof" chip is hacked?
I give it a week. Not that this will ever make it into commercial production anyway
How many times have we heard this over the years. To be truly hack proof it'll have to be a quantum system. Is it? Doesn't look like it.
Because that is what TFS and TFA read like. I hope there is more to this than meets the eye.
I am Slashdot. Are you Slashdot as well?
Un-hackable? and a thousand hackers said challenge accepted.
"The question is, how long will it be before this "hack proof" chip is hacked?"
How long you ask?
*looks at watch*
No doubt it's an improvement to use a new key each time a transaction is made. But such a system is only as good as the quality of the pseudo-random number generator. If it's predictable, it can be exploited. It adds another layer of defense, but it's not hack-proof.
I hate all anonymous shitbags. Log in, you filthy bastards.
I see, so a true random number generator? (which it can't be because the "server" need to predict the new key, are we then talking about the rfid sending the new key after each new iteration?) Not one that is reverse engineerable to reveal the key, like car "rolling codes" or how about hacking the authentication server so any key is Valid? how about attacking the chips software so it only creates a predictable key? as its also an RFID chip you can also do all this from range without your target being aware, with a little equipment and can be small enough to fit in a pocket.
How about simple cloning the key 1:1 copy to gain access.
It's a definition of time, not a quality: "Until someone will hack it".
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
"Hack-proof" to SIDE CHANNEL attacks.
Achille Talon
Hop!
So in order to use this whizzy new technology, I must have an independent power source for the RFID chip and I need a server. Yup, that won't be too expensive for most RFID applications.
may be impossible to hack
...in the same way that I may be the sexiest guy in the world.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Seriously, since the buyout almost all slashdot postings are by timothy who might as well be the "I APPROVE ALL STUPID STORIES ROBOT."
Timothy - I have a captcha for you.
This story is just in line with the rest of the toilet-bowl material
- hack proof RFID because... um... MIT?
- Assange passport because UN committee?
- Vendors have firewalls with holes?
Next up something about the superbowl?
Please. Spare. Us. You can't resurrect good slashdot editors. Obviously you've killed them.
The honorable thing is to complete the job. Mirror... mirror.
E
"Hackproof"?? From TFA
Traditional RFID chips are vulnerable to side-channel attacks, whereby a hacker can extract a cryptographic key from the chip. However, a hacker would need to execute a cryptographic algorithm many times to extract usable information, as each execution leaks only a small amount of information. The new RFID chip runs a random-number generator that creates a new secret key after each transaction.
So they're backing up the base crypto in the chip with a stream cipher: instead of generating random session keys with a public-key cipher, they're generating secret keys with a random-number generator (i.e. a stream cipher) and using those to generate a session key to generate a session key. Which may be even less secure, if the RNG (i.e. stream cipher) is itself insecure. Perhaps they can fix that by using another RNG to generate an initial state for the RNG which generates the key which generates the session key for the transaction.
It's stream ciphers all the way down!
Im gonna call bullsh*t on this. Sounds like a typical marketing ploy...I suppose they have to pay for that MIT education .. ha!
I can't believe that in 2016 there's people willing to claim that they invented something unhackable
... hack in rand(), rand(), rand().
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Can I embed it into my hand?
https://www.youtube.com/watch?v=2zbxUZYZYVU
If it can produce an "unhackable" piece of info by Alice that only Bob can decode, it can be used to bootstrap into session keys that will be hard to break. So you think the NSA will allow this before nudge, nudge, wink, wink, the "perfectly secure" has a nice backdoor to protect you privacy?
It's almost like they're begging people to prove them wrong.
And throw away.
Un-hackable technology.
Too many times I have seen pre-release silicon from Texas Instruments be withdrawn from the market because some patent troll threatened litigation. Don't be an early adopter of any chipset from TI unless you've got a very solid plan-B.
No 'w' available then? Or was the summary author an AMERICAN?
Let's begin with a little story. In the 1950s the Betty Crocker company introduced just-add-water 'box' cake recipes that produced cakes that were as good as and often better than peoples' 'scratch' cakes --- sometimes the recipe was better (or) the mix in the factory-sealed box stayed fresher than ingredients taken from the pantry, why does not matter. Betty Crocker cakes aced blind taste-tests and were affordable, and yet the product did not take off as expected.
A bit of research uncovered a guilty secret. In spite of what the company perceived as pure convenience, cake-making women (and the manly cake-making men of the 1950s) were secretly ashamed of the simple steps to produce a product that had been the subject of family pride. They no longer felt sufficiently empowered by the process. By the simple addition of an actual egg, enough recipe-empowerment returned to remove this psychological deterrent and cake-box sales soared.
They later refined the tactic by suggesting on the box that the product might even be improved even further by the (optional) addition of that miracle of miracles, the extra egg. Two eggs! Everyone who was anyone tossed in that extra egg. And all remnants of cake-making insecurity vanished completely and America embraced the box-cake, to become the industrial cake-making giant it is today.
((SIDE NOTE: Even though this was known to me, to come up with a citation I found it not generally discussed. I had to delve down to 'book' level to find a good reference to it. Thanks Google. Folks who imagine that web content sufficiently represents our culture should think again.))
(DO, a deer, a female deer) So not surprisingly the good people of MIT have re-discovered that to continue the cryptographic arms race every simple hard-coded tag must become a passive device, (RE, a drop of golden sun) every passive device must become an active computing device, (MI) and every active computing device must become a self-contained machine (FA) with an autonomous power source, (SO) non-volatile memory and significant processing power. It will soon move into the next phase where even this is not sufficient because of unforeseen circumstances like new attacks on hash algorithms or implementation errors, and a robust system must also include flash-update capability, (LA) which also requires a separate and secure chain of certificate-based authentication to prevent someone from planting the original 'stoned' virus upon RFID tags. "Your passport is now stoned. Legalize marijuana!" (TI)
Which is itself moot if someone somewhere manages to leak or crack a single private flash update key. Which brings us back to (DO).
So the discovery is actually that RFID technology is mirroring nicely the same arms race that computers and communication links everywhere are experiencing. As Bruce Schneier sagely says, "Security is a process, not a product." So be generally conservative and wary every time someone offers a new security end-product --- and remind yourself every now and then, "Why again are we even riding this Merry-Go-Round?" By all rights Schneier should be helping to roll out the gravy train that would place RFID tags everywhere. More work for him! But surprisingly often he comes out in favor of less embed-intrusive and more human-intensive approaches to security. That's why humans love him and robots don't subscribe to his Twitter feed.
In addition to taking these (seemingly necessary) small steps in the direction of embedding additional complexity, we should devote equal time to considering the possibility of small steps that roll back complexity generally, to reveal what unforeseen benefits they may have. Perhaps the powdered egg once included in box-cakes was actua
<blink>down the rabbit hole</blink>
Take a look at PHD Comics' "Science News Cycle". I think it is much more likely that the media, not the researchers, are the ones claiming that the chip is "hack-proof."
We can work out a way to circumvent, reverse engineer, brute guess...it's never "if" always "when".
Stop wasting your time on that old, broken "unbreakable" system; there's a new one to dismantle.
...opening a can of worms, the reaction is predictable, and rightfully so.
Anything can be reverse engineered and thus hack-proof doesn't really exist.
What this world is coming to - is for you and me to decide.
Are you the type of person that likes to hear yourself talk? Looking at your history, all I see is endless fucking words.
Can you get the point across without boring the reader to death? I'm on my lunch break. I don't have time to read all that shit. Get to the fucking point, man.
No, I'm not kidding.
It's v-chip legal already?
all I see is endless fucking words.
Oh brave new world. I've got a brevity-stalker.
Check out his or her other fine word-product.
The ship of the imagination has sailed without you.
<blink>down the rabbit hole</blink>
Did you figure that out all by yourself? BTW - that's a one word answer (yes, or no), I don't need a whole diatribe.