I have not (yet?) evaluated this device. I do however have a couple of initial comments.
Only the (TI) security processor itself had a FIPS 140-2 Level 3 crypto engine. However this device as a whole has no certifications I am aware of, FIPS, CESG or anywhere else (let's leave aside for a moment the flaws of the certification processes). Given its claims, the threat model and what it tries to do, that is actually surprising. It should be aiming for 140-2 Level 4, with claims like that. There are not a lot of 140-2 Level 4 devices around at all…
They say "flipped". Do they mean "zeroized"?
There are a few pitfalls with disk encryption. They mention AES-256-CBC. That is not a wide-block mode. So how are the IVs defined? Do they use an encrypted salt-sector IV? A plain one? Is any diffuser used? Is there any integrity protection?
I do not see that this provides a meaningful level of security which is even comparable to, say, (the late) TrueCrypt.
I'm far from being a hardware expert, but I thought it was curious that they used CBC rather than something like XTS. Is there a reason that CBC is more appropriate when used at the hardware (as opposed to filesystem) level, or is this simply just a rather suspect choice?
Probably it was already in the microcontroller they're using. XTS was only FIPS-approved in 2010, iirc. Plenty of other things use CBC, and XTS also has plenty of pitfalls for the unwary who think it works magic (particularly when it comes to the adaptive ciphertext observation/modification class of attacks, in the absence of integrity protection).
Speaking of magic, I've just realised one big potential problem that's been bugging me about this, which finally leaped out at me.
Destruct is controlled via SMS? That is to say, unless they've been unbelievably careful about shielding and optoelectronic coupling (and from the photos, they haven't) there's almost certainly a GSM transceiver, inside the security boundary, near the data paths.
Oops.
Those familiar with EMSEC will know why this could present a Big Problem™. My first port of call, attacking one of these, rather than stealing it, would probably be to sit in the car park with a femtocell and a directional antenna, and make sure the device gets really loud GSM reception. And see what crosstalk gets modulated back. :)
(If you don't think this is a realistic attack for you, why are you in the market for Mission Impossible gadgets anyway? Use TrueCrypt or dm-crypt or DiskCryptor or something. At least you can analyse how they work more easily.)
Similarly, if it's made by, or spiked by, a malicious actor, it's got scope to go kleptographic on your ass and covertly transmit your data. Need to be careful about that.
Comments
I have not (yet?) evaluated this device. I do however have a couple of initial comments.
Only the (TI) security processor itself had a FIPS 140-2 Level 3 crypto engine. However this device as a whole has no certifications I am aware of, FIPS, CESG or anywhere else (let's leave aside for a moment the flaws of the certification processes). Given its claims, the threat model and what it tries to do, that is actually surprising. It should be aiming for 140-2 Level 4, with claims like that. There are not a lot of 140-2 Level 4 devices around at all…
They say "flipped". Do they mean "zeroized"?
There are a few pitfalls with disk encryption. They mention AES-256-CBC. That is not a wide-block mode. So how are the IVs defined? Do they use an encrypted salt-sector IV? A plain one? Is any diffuser used? Is there any integrity protection?
I do not see that this provides a meaningful level of security which is even comparable to, say, (the late) TrueCrypt.
I'm far from being a hardware expert, but I thought it was curious that they used CBC rather than something like XTS. Is there a reason that CBC is more appropriate when used at the hardware (as opposed to filesystem) level, or is this simply just a rather suspect choice?
Probably it was already in the microcontroller they're using. XTS was only FIPS-approved in 2010, iirc. Plenty of other things use CBC, and XTS also has plenty of pitfalls for the unwary who think it works magic (particularly when it comes to the adaptive ciphertext observation/modification class of attacks, in the absence of integrity protection).
Speaking of magic, I've just realised one big potential problem that's been bugging me about this, which finally leaped out at me.
Destruct is controlled via SMS? That is to say, unless they've been unbelievably careful about shielding and optoelectronic coupling (and from the photos, they haven't) there's almost certainly a GSM transceiver, inside the security boundary, near the data paths.
Oops.
Those familiar with EMSEC will know why this could present a Big Problem™. My first port of call, attacking one of these, rather than stealing it, would probably be to sit in the car park with a femtocell and a directional antenna, and make sure the device gets really loud GSM reception. And see what crosstalk gets modulated back. :)
(If you don't think this is a realistic attack for you, why are you in the market for Mission Impossible gadgets anyway? Use TrueCrypt or dm-crypt or DiskCryptor or something. At least you can analyse how they work more easily.)
Similarly, if it's made by, or spiked by, a malicious actor, it's got scope to go kleptographic on your ass and covertly transmit your data. Need to be careful about that.