Maynard Handley (name99.delete@this.name99.org) on December 11, 2018 4:32 pm wrote:
> Anon (no.delete@this.email.com) on December 11, 2018 4:21 pm wrote:
> > Maynard Handley (name99.delete@this.name99.org) on December 11, 2018 7:20 am wrote:
> > >......
> > > The crypto has to be appropriate to the problem. This is NOT the equivalent of network crypto.
> > > For example, suppose the equivalent of a random key burned into the device is XOR'd with everything
> > > going into and out of an MRAM cache (maybe also XOR-in the relevant addresses).
> > > Is that good enough? On the off-chance that someone could extract the contents
> > > of the MRAM cache (which may or may not be true?) the assumption is always
> > > that they CANNOT extract the contents of these sorts of hardware keys.
> >
> > Such a scheme would be about as secure as writing a key on a yellow postit on your monitor.
>
> Why do you say that?
> This is not a situation where one can watch a constant stream of data and extract statistics.
> My threat model is that someone steals a laptop, delids the chip, and has access to the
> frozen contents of the MRAM data. Not even the cache tags, just a collection of lines
> of data; and not a constant, changing, stream of data as the CPU executes.
>
> Is that the threat model you believe you have in mind? If not, well, we are not discussing the same thing.

Unfortunately it makes no difference, a stream versus a static corpus does not make a difference to many forms of attack.

>
>
> > Unfortunately the fact is that good encryption is hard, and somewhat computationally involved.
> >
> > Not to mention the fact that with a static key, both ends
> > need that key, as as soon as it leaks, its game over.
>
> Slogans are great. But the relevance of this one is not especially clear to me.

What do you think is a slogan? That is a simple fact. What part of it doesn't make sense?
The key is the key.. Abs it must exist at both ends.. If I've of them is insecure then the game is over. Too much like a slogan? Sorry but it is simple fact.

>
> I would be the first to admit that I know very little about crypto. But I know enough to know that not every
> threat model is the same. AND that this fact is not obvious to many people (hence the split between, eg, the
> way Apple implemented a very different sort of crypto model for iOS compared to where Android started).

In what way so you think they are very different? Both have their capabilities and issues, however they are not that different, and neither would be particularly applicable in this situation.

Note the huge need that encrypted hard drives have become lately, for an example of why static device encryption is hard.

Basically the more transparent, more performant, and more static (hardware based) you make encryption, the less strong it is likely to be.