I'm just saying they are protecting their IPs, I'm not saying it's a good thing...
-
And I am not sure how effective wrapping really is. The secure element has very low compute performance as it needs to operate with just NFC power. Today brute force attacks run on huge farms of cheap AWS spot instances and even long PINs/Passwords offer little protection.
I'm sorry, you work for Yubico and you can't calculate entropy? "Even long PINs offer little protection" is BS. Past a certain point, even with minimal or no key stretching, you are not brute forcing things. Ever.
-
-
Of course, a completely random 256 bit entropy pass phrase you are fine. Most users though will pick much less. The real problem is that brute force attacks have gotten very cheap.
-
Quick napkin math: A GPU can do ~2^32 hashes/s or ~2^44 hashes/h. A spot g3s.xlarge on AWS goes for 40 cents/h. Let's assume I have a $400k budget (if I steal a key and compromise the secure element, I probably have that). This means I can factor 2^64 bits of entropy.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.