Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
2

I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, except making EEPROM read-only?
I also want to implement PKCS11 DLL for my token. Is there any pattern I should follow on storing my public and private keys for the PKCS11 standard.

share|improve this question
Even if the EEPROM is read-only, wouldn't anyone with an EEPROM reader be able to get your private key, at which moment they can pretend to be that token? – Marcin Oct 9 '12 at 13:05
@Marcin Even if they can read private key it wouldn't be useful for them. because i will do more action like reading uuid of there token to match my database and also some more... – osyan Oct 10 '12 at 7:17
1  
@osyan I would imagine it wouldn't be too hard to spoof a UUID – Peanut Oct 20 '12 at 20:02
yes, that's what i did last week :) – osyan Oct 21 '12 at 13:29

1 Answer

up vote 4 down vote accepted

Simply storing a secret on a piece of hardware doesn't help secure anything, (god forbid) we have USB sticks for that. The secret must never leave the piece of hardware in order for it to be effective. A device like a smart card is effective in two-factor authentication because it handles the challenge response.

If your device is as effective as a smart card, then it will have to confront a lot of the same challenges, Such as Side Channel Attacks and other physical attacks.

share|improve this answer
And what about the last part of my question. do you know something about pkcs11 standard to help me more. Thanks Rook – osyan Oct 10 '12 at 7:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.