Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Thu May 27 1999 - 23:44:21
Michael Bauer (mick@tiny.net)
Wed, 7 Apr 1999 10:23:20 -0500 (CDT)
Since, as Vin implies, the SecurID cat is apparently out of the bag (to
some extent or another), wouldn't this mean that a SoftID on a PC or
PalmPilot is at least theoretically quite vulnerable if a system on which
a SoftID resides is stolen? E.g., savvy thief steals PalmPilot and copies
SoftID files onto PC and brute-forces secret-key, or uploads SoftID
cracker onto stolen PalmPilot and cracks SoftID files locally (although
the latter seems like a stretch -- how many AAA-battery-years would it
take to brute-force even a small key on a 68000-based Palm system? :-).
Having said all that, I think it's very cool that SDTI is developing for
Palm...
Cheers,
Mick Bauer
EXi Corp.
-----Original Message-----
From: Vin McLellan [SMTP:vin@shore.net]
Sent: Wednesday, April 07, 1999 4:00 AM
To: Bruce Schneier
Cc: CodherPlunks@toad.com; rah@shipwright.com;
ptrei@securitydynamics.com; adam@homeport.org
Subject: Re: Announce: SecurID on PalmPilot available.
Bruce Schneier <schneier@counterpane.com> asked:
>Does this mean that the SecurID hash function is finally
>public?
Nope, Brainard's 14 year-old hash is still proprietary. (You did
write something about old crypto being good crypto, didn't you? ;-)
John Brainard, now with RSA Labs -- a SDTI subsidary -- has
designed a new token with equivalent functionality, standards-based
crypto, and some additional defenses against the "smartcard" attacks you
and Paul Kocher have blueprinted, but I don't know how quickly it will be
rolled out or when.
Even with ACE/SecurID-based authentication being replaced with
SDTI's new PKI-based Keon system, there is great demand for the SecurID --
both as a traditional two-factor hand-held authenticator (HHA), and (as an
alternative to a smartcard) an HHA which allows a token-holder to download
a key thru an SSL tunnel to unlock that user's PKI credential set.
(In Keon, PKI credentials can be either stored encrypted on the
local workstation, or downloaded over SSL from a Keon Server on the
network, if the user is mobile -- or if he, or his Administrator, decides
that his local workstation can not be satisfactorily secured.)
I think there are a few reverse-engineered copies of the SecurID
hash in illicit but limited circulation, but apparently no one has felt
that the world would be a better place if they were to published it. Any
SDTI customer -- and I suspect most potential customers -- can review the
SecurID hash (and documentation and critiques, from RSA and third-parties)
under NDA.
Not the same as open review, I know -- but ACE/SecurID remains an
artifact of a different generation of applied cryptography, from before
there was much of a private-sector crypto community. I tell John Brainard
that it will end up diagrammed on the wall of a museum some day.
Obligatory admission: SDTI has me on retainer as a consultant and
sometimes even heeds my advice and suggestions.
Suerte,
_Vin
--------
"Cryptography is like literacy in the Dark Ages. Infinitely potent,
for good and ill... yet basically an intellectual construct, an idea,
which by its nature will resist efforts to restrict it to bureaucrats
and others who deem only themselves worthy of such Privilege."
_A Thinking Man's Creed for Crypto _vbm
* Vin McLellan + The Privacy Guild + <vin@shore.net> *
53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548
The following archive was created by hippie-mail 7.98617-22 on Thu May 27 1999 - 23:44:21