Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
1

It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can happily turn it over while smugly informing the attacker that it will do them no good because the physical token is 'dead'?

Does anyone manufacture hardware tokens which do not require physical strength in order to quickly 'destroy' them (ie. zero out the private key) when the user is under duress?

share|improve this question
1  
I strongly advise against being smug when confronted with a weapon-wielding thug. – Thomas Pornin Oct 7 '11 at 17:45

3 Answers

up vote 6 down vote

Although its a cool idea, I think these would be practically impossible to use. A better idea would be a tamper-pin. If coerced, give the tamper pin which renders the smartcard/token/etc useless when entered into a system.

To (try to) answer your question, I haven't seen any commercial solutions, but I bet you can find custom hardware.

EDIT: There is the Verisign OTP card that PayPal uses which is pretty flimsy. While it's not designed to be broken, I can easily crush/snap the thing in half. You can check it here: http://www.verisign.com/authentication/two-factor-authentication/compare-two-factor-authentication/index.html

share|improve this answer
2  
This would be similar to a "panic code" for your home/office alarm system - one which indeed disables the alarm, but still alerts the police that something is wrong. The difference here being that your "tamper PIN" won't even give the illusion of success. However, this could be a problem for the user if the attacker feels he's been fed false information. That's where the "easily destroyed" factor can help - the attacker knows he can't do anything with a visibly dead token, but may keep prying if he thinks he can get the "right" PIN out of you. – Iszi Jan 31 '11 at 14:48
@Iszi thats a good point, but are there practical implementations of this in the commercial world? – SteveS Jan 31 '11 at 19:42
1  
I still haven't found anything, and I've been looking hard. – David Bullock Feb 2 '11 at 1:44
yfuhs - Commercial, maybe not - except for Super-Secret-Squirrel government contractors. Whether any implementations exist, I don't know. But, there's certainly plenty of good reasons one could think of that they might be needed - if the paranoid dial is turned up to 11. – Iszi Feb 4 '11 at 21:17
up vote 1 down vote

What you're looking for is a system with a "duress" option or duress code. We use these pretty commonly with our facilities - but not often enough with our computing assets.

Duress functions can come in a variety of styles (from invalidating a card or locking it) - which is the gemalto/activeclient pairing's method of handling locks (after X login attempts), though the lock command could be sourced through any major vendor (such as Gemalto) fairly simply if your middleware supported such a feature.

L-1 identity solutions also has a reader/card solution that provides duress capacity. Though it is a strong multifactor system and includes biometric identity so may not be quite what you're looking for.

http://www.ibix.com.mx/pdf/VStation.pdf
http://www.l1id.com/files/288-DS-bio-vsmart.pdf

share|improve this answer
As @Iszi pointed out, the duress code versions have a drawback in a real-world situation: the attacker may not believe it is locked. At least a broken device is an obvious showstopper. – Rory Alsop♦ Feb 7 '11 at 15:28
Agreed. Whether or not it alerts to a locked or zeroe'd out state as the OP asked is usually a function of the middleware. The enviornment I work for uses the duress finger method for our smart cards and duress codes for access systems (which lets you into the system, but then guys with guns come knocking) --- but we're ultraparanoid. – iivel Feb 7 '11 at 16:10
up vote 1 down vote

You can feed a smart card though a shredder, that would work well. I've also heard that diehard "anti-ID" folks have used hole punchers effectively.

But generally having a duress PIN would be a nice feature, if you're really paranoid. Other simpler options might be locking the card with wrong PIN entries or similar methods.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.