Re: Storing an encryption key in CMOS

["Vladimir B. Kropotov" <slyman2000 () mail ru>]

Hi All!
----- Original Message -----
From: "Alexander Lukyanenko" <sashman () ua fm>
To: <security-basics () securityfocus com>
Sent: Thursday, March 04, 2004 11:22 PM
Subject: Storing an encryption key in CMOS

=============
Hello people.
While replacing a faulty CMOS battery, I came upon an idea:
what if we store a file encryption key in the NVRAM chip (in the very
same place, where the BIOS settings, among with the BIOS password, are
stored). Imagine the (hardly, but still possible) case:
the system boot is locked by a BIOS password. Now (imagination, again), our
system gets stolen.
.......
Snip
........

Also, the key must be backed up as usual (just for the above-mentioned
case of a dying battery :p )
===================
If you can BACKUP key - that mean than you can read that KEY (You can dump
your BIOS) <=> GET KEY => you must encrypt that key in NVRAM chip => you
MUST have external key that will be used to decrypt KEY in NVRAM => You
needn't store key in NVRAM cos you already have external key.


============
2) online compromise (the system gets hacked while being up and
   running);

Sure!
Software that running is running under OS <=> OS can manage that software
<=> If you interact like part of OS you can get anything you want including
passwords and unencrypted sensetive data. Drivers and even fonts implemented
in priveleged mode and every first of these can potentially do it.

============

4) the NVRAM memory has <very> limited size, so the length of key will
   be also limited.
==========
I think you can find 16 bytes = 128 bit for your key.....

===========
5) the key has to be stored in RAM and can possibly be swapped to
   disk/dumped along with the core dump in case of a system or
   application crash.

==============
CONCLUSION:
This concept is intended as an added layer of security; it does not
guarantee 100% protection (as no method does), but can provide a good
line of defence against a more-than-causal snooper.
It might be particularily interesting to laptop vendors.
==============
If you really wanna use strong  filesystem encryption, you must use some
kind of hardware addon that implement that encryption instead implement that
encryption using software. And in any case KEYS and DATA must be separated.

=============

regards
Vladimir B. Kropotov

Russian folks always read and SOMEtimes talks...


* * * * * * * * * * * * * * *
* Alexander V. Lukyanenko   *
* ma1lt0: sashman ua fm     *
* ICQ#  : 86195208          *
* Phone : +380 44 458 07 23 *
* OpenPGP key ID: 75EC057C  *
* NIC   : SASH4-UANIC       *



---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------