Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It is said here

http://www.emtec-international.com/sites/default/files/s530_aes_en_0.pdf

  • 2048 bit RSA module: ready for PKI application
  • SHA256 data hashing: ready for digital signature

Does it mean it is an usb token where I can export my digital certificate that will automatically prompt for pin code ?

share|improve this question
    
Not sure what you mean by "automatically prompt for pin code", what does it refer to? –  Andrew Smith Aug 2 '12 at 23:24
add comment

1 Answer 1

up vote 1 down vote accepted

Possibly. Or not. The data sheet is quite short and lacks details. Most of it is about AES encryption for data storage, which is orthogonal to usage as a private-key storage token. The two lines you quote are the only indication that the device may act as a smartcard-for-PKI at all. Come to that, there is not enough text on this PDF file to decide whether the most touted encryption system is applied correctly or not (it seems that the encryption occurs in the hardware, which is necessary, but not sufficient for appropriate security). A cursory look at EMTEC's Web site did not yield additional data (however, it did reveal a line of USB drives in the shape of Angry Birds, which is rather fascinating and might perplex a future archeologist a thousand years from now).

There is not a single trace of any kind of conformance to FIPS 140-2 or an EAL level. I would be wont to claim that such standards guarantee any kind security; but they still are widespread standards, and I find the lack of information about conformance to these standards quite discomforting.

Note that if the device is able to act as an asymmetric key store and signature engine (something which Windows would call a Cryptographic Service Provider), with the popup asking for the PIN code at the time of usage(*), then serious, competent setup would require private key generation on the module too. Ideally, the private key should never exist outside of the tamper-resistant hardware. That's one of the things about which FIPS 140-2 is rather insistent. RSA private key generation is heavier than simple signature computation, so some modules can do the latter but not the former.

(*) If the host PC handles the PIN code entry itself, then the security model must assume that the PC is secure and free of keyloggers, an assertion which verges on the preposterous.

share|improve this answer
    
The Angry birds are quite cute:) About key generation, I doubt it does it, can't I import a digital certificate (pfx) rather ? I would prefer in fact because I could then put even my bank certificate. –  user310291 Aug 3 '12 at 5:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.