[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Diffie's comments on Photuris

At 11:18 AM 3/14/95 -0800, karn@qualcomm.com wrote:
>Ashar,
>
>Thanks for forwarding that note from Whit. In thinking about it and
>similar comments from you and others, I've tentatively decided to modify
>Photuris to sign the shared secret.
>
>I've been thinking about a related problem for some time: finding a
>safe way to use my PGP key on my workstation at work.  If I were to
>type my PGP passphrase into a machine I don't fully trust, I'd risk
>compromising *all* of the traffic I have ever received or will receive
>with that PGP key, including personal mail read only at home.
>
>Using separate keys is one possible approach, but that's clumsy.
>
>The ideal answer seems to be a smart-card that I can plug into the
>workstation that safely holds my RSA secret key and uses it to perform
>operations on behalf of the host without ever letting the secret key
>leave the card.  For maximum safety, the card could log all operations
>and possibly even require a manual "go" button press to approve each
>operation.  Even in the smartcard the RSA secret key would exist in
>plaintext only when it is in active use. At all other times it would
>be encrypted in a symmetric algorithm; before use the user would have
>to enter the key for the symmetric algorithm on a keypad on the card.
>One might even store the encrypted secret key on the host, eliminating
>the need for stable storage on the card. But this would place total
>reliance on the secrecy of the key for the symmetric algorithm, which
>is probably a bad idea given our experiences with badly chosen user
>passwords.

The Cryptodisk from SmartDisk security Corp is a good start in this
direction.  It uses a 3.5" diskette format, so most devices can interface
with it without special hardware.  It has the Seimens chip in it so my
understanding is it is limited to 512bit RSA keys.  It has 8K of EEPROM for
storage of various key information.

Robert Moskowitz
Chrysler Corporation
(810) 758-8212