I'm just saying they are protecting their IPs, I'm not saying it's a good thing...
-
-
Replying to @P3b7_ @pavolrusnak
Fair. I don't think they're actually accomplishing anything but... :-)
1 reply 0 retweets 1 like -
Replying to @marcan42 @pavolrusnak
What I find not fair in the discussion is to induce the idea that using pwned circuit as they are open, is a better idea (security wise) than secure circuits as they are closed... I think it's a fallacy...
1 reply 0 retweets 1 like -
Replying to @P3b7_ @pavolrusnak
It depends on your threat model. If you are more concerned about firmware flaws and design, it makes more sense to use an open IC with a solid FW design. If you absolutely must resist physical attacks, maybe not.
1 reply 0 retweets 2 likes -
For example, at least old YubiKeys did not cryptographically wrap the PGP private keys with the user PIN, which is insane. Under some threat models, that makes them less secure than an STM32. And in fact they did have a bug where they weren't checking PINs at all.
1 reply 0 retweets 6 likes -
(I don't know if newer YubiKeys do this, because they're a black box. This is part of the problem.)
1 reply 0 retweets 3 likes -
Replying to @marcan42 @pavolrusnak
Wrapping keys with a low entropy secret as a PIN does not bring much security. If you can get the wrapped key, it's game over! TBH, I don't know well Yubikey products. But maybe they go through 3rd party audit and cert...
1 reply 0 retweets 1 like -
Replying to @P3b7_ @pavolrusnak
"PIN" in PGP-card terminology means passphrase. It's not just 4 digits, it's up to 127 ASCII characters. It absolutely is not "low entropy" and beyond a certain length would certainly be uncrackable if implemented properly.
2 replies 0 retweets 3 likes -
This Tweet is unavailable.
-
This Tweet is unavailable.
Replying to @Serianox_ @P3b7_ and
If your security model relies on people not characterizing your chip, you're nuts and you shouldn't be designing security products. Security by obscurity does not work.
4:43 PM - 12 Mar 2020
0 replies
0 retweets
0 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.