Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #5023 > unrolled thread

Enclosed, but not encrypted

Back to article view | Back to comp.misc

Contents

  Enclosed, but not encrypted Rich <rich@example.invalid> - 2014-09-22 01:58 +0000
    Re: Enclosed, but not encrypted "tdk" <forum.tdk@squte.com> - 2014-09-22 05:17 -0500
      Re: Enclosed, but not encrypted RS Wood <rsw@therandymon.com> - 2014-09-22 12:29 +0000
        Re: Enclosed, but not encrypted Rich <rich@example.invalid> - 2014-09-22 16:23 +0000
    Re: Enclosed, but not encrypted Peter Mc Donough <mcd-mail-lists@gmx.net> - 2014-09-22 13:24 +0200
      Re: Enclosed, but not encrypted "tdk" <forum.tdk@squte.com> - 2014-09-22 12:17 -0500

#5023 — Enclosed, but not encrypted

http://www.h-online.com/security/features/Enclosed-but-not-encrypted-746199.html

   A new generation of inexpensive disk drive enclosures using hardware
   encryption and RFID keys do not fulfil the promises of their publicity.
   The adverts claim 128-bit AES hardware encryption, but they don't tell
   us how it is used.

   The specifications of the 2.5in. Easy Nova Data Box PRO-25UE RFID hard
   drive case by German vendor Drecom sound promising: hardware data
   encryption with 128-bit AES, access control via an RFID chip compact
   enough to carry around on your key ring and optional 160GB or 250GB hard
   disk capacity. Swiping the RFID chip along the case causes the
   integrated Innmax IM7206 crypto controller to reveal the drive as a USB
   2.0 mass storage compatible device to the attached computer. This works
   under Linux and Mac OS X as well as Windows. There's no need for special
   drivers.

   Look a little closer, and things don't look so good. Heise online's
   sister publication c't magazine has discovered that the encryption
   offered by this product was weak, and erroneously advertised as
   including "128-bit AES hardware data encryption". c't has since spoken
   with the manufacturers involved and can confirm that the encryption
   weakness discovered probably affects numerous similar products.

   ...

[toc] | [next] | [standalone]

#5025

This is shocking, they advertise it as using AES 128, actually it only uses a  
trivial 'proprietry' Vigenere cypher. From the TFA:

>The following crypto hard drive enclosures also use the IM7206 and are  
>therefore likely to be vulnerable to the same attacks:
>STYSEN E08 RFID Security Mobile Disk
>DoTop RFID SATA to USB storage
>Agestar RFID Security External Enclosure SRB2A
>Silverstone Treasure TS01B
>Sharkoon Swift-Case Securita
>DIGITTRADE RFID Security Hard Disk
>These manufacturers have been alerted, but we have yet to receive replies  
>from them.
This is exactly what Bruce Schneier described as Snake Oil [1]



[1] https://www.schneier.com/crypto-gram-9902.html
-- 
tdk

Take back your Internet! http://squte.com/Webertarian-Manifesto
View this thread at http://squte.com/usenet/enclosed-not-encrypted?src=u#comment-39615

[toc] | [prev] | [next] | [standalone]

#5029

On Mon, 22 Sep 2014 05:17:38 -0500
"tdk" <forum.tdk@squte.com> wrote:

> This is shocking, they advertise it as using AES 128, actually it only uses a  
> trivial 'proprietry' Vigenere cypher. From the TFA:

> This is exactly what Bruce Schneier described as Snake Oil [1]

> [1] https://www.schneier.com/crypto-gram-9902.html
> -- 
> tdk


That is a very, very good article.  Schneier is one of the rare
individuals who not only understands the math but can communicate about
it effectively.  We need more people like that.  Glad for this link -
thanks!

[toc] | [prev] | [next] | [standalone]

#5034

RS Wood <rsw@therandymon.com> wrote:
> On Mon, 22 Sep 2014 05:17:38 -0500
> "tdk" <forum.tdk@squte.com> wrote:

> > This is shocking, they advertise it as using AES 128, actually it
> > only uses a trivial 'proprietry' Vigenere cypher. From the TFA:

> > This is exactly what Bruce Schneier described as Snake Oil [1]

> > [1] https://www.schneier.com/crypto-gram-9902.html
> > -- 
> > tdk

> That is a very, very good article.  Schneier is one of the rare
> individuals who not only understands the math but can communicate
> about it effectively.  We need more people like that.  Glad for this
> link - thanks!

If you read into the article (I think it was on pg. 2) there is a small
blurb indicating where it was they were "using" AES-128.  To encrypt
the tiny bit of data obtained from the RFID "key".

So, another example of how the marketing department makes a mockery of
anything slightly more technical than a wet paper towel.

[toc] | [prev] | [next] | [standalone]

#5026

Am 22.09.2014 um 03:58 schrieb Rich:
> http://www.h-online.com/security/features/Enclosed-but-not-encrypted-746199.html
>
>     A new generation of inexpensive disk drive enclosures using hardware ...


Is this news still relevant. It is dated  18 February 2008, 16:09

cu
Peter

[toc] | [prev] | [next] | [standalone]

#5037

Peter Mc Donough wrote:

>Is this news still relevant
You're right, and it got a lot of press at the time. They are still selling  
[1] the chip concerned though and advertising it as "Advanced Encryption  
Standard (AES) 128 bits de/encryption."



[1] http://www.innmax.com/en/im7206.html
-- 
tdk

Take back your Internet! http://squte.com/Webertarian-Manifesto
View this thread at http://squte.com/usenet/enclosed-not-encrypted?src=u#comment-39652

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web