Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
1 10
Newest
 Enthusiast
Impact
~6k people reached

  • 0 posts edited
  • 0 helpful flags
  • 16 votes cast
Jan
7
answered ArcSight logging - Windows Workstations
Oct
31
awarded  Enthusiast
Oct
28
answered Is it safe to send clear usernames/passwords on a https connection to authenticate users?
Oct
13
accepted Smart cards for user authentication - is configuration of PIN complexity important?
Oct
5
comment Smart cards for user authentication - is configuration of PIN complexity important?
"I'd say a 4 digit PIN is secure". Please can you justify your assertion. Is it down to the lock-out behaviour that the card implements?
Oct
5
asked Smart cards for user authentication - is configuration of PIN complexity important?
Sep
19
comment How to inject a key (physically) on a huge number of devices?
The same HSM can be program to inject IPEK (Initial Key) to all the devices as well. How is it physically done and how does the physical process scale up?
Sep
19
comment How to inject a key (physically) on a huge number of devices?
Thanks @Potion, very interesting. Your assumption is correct. How well does this scale up for a huge number of devices?
Sep
17
comment How to inject a key (physically) on a huge number of devices?
@halfinformed Very interesting comments, thanks! I think an answer that provided a review of smartcard chips, TPMs and HSMs (not necessarily specific products, but the class of device), the different key injection solutions for each class, and a comment on how the solution scales up, would be the winning answer.
Sep
16
comment How to inject a key (physically) on a huge number of devices?
+1 for "reduce the size of the secure environment". This is a highly desirable objective.
Sep
16
comment How to inject a key (physically) on a huge number of devices?
@Gilles I know like it sounds like I'm being secretive or vague, but honestly the devices are still at the design stage at this point, and we want to find the best solution for their personalisation as you say. You can consider that the device manufacturing process is the subject under discussion here. We can implement a secure factory area that provides physical and operational protection to the process. Concerning the distribution process and relevant device capabilities, there is time to modify these to adopt the best solution put forward.
Sep
15
awarded  Commentator
Sep
15
comment How to inject a key (physically) on a huge number of devices?
@LamonteCristo that is probably true but it is not the question here. Can you elaborate on how you would use such a mechanism to satisfy the requirements in the question?
Sep
15
comment How to inject a key (physically) on a huge number of devices?
@André Borie please can you elaborate on this comment as an answer, with reference to the requirements stated in the question?
Sep
14
comment How to inject a key (physically) on a huge number of devices?
@Selenog Just to clarify, the uniqueness here refers not to the key generation but to the allocation of the key to the device. You can assume for this question that keys have already been generated and have an associated identifier. The set of keys is an input to the process this question is trying to elucidate.
Sep
14
awarded  Promoter
Sep
9
awarded  Teacher
Sep
7
comment How to inject a key (physically) on a huge number of devices?
@Adam Shostack: interesting idea! The requirement is for the symmetric key to end up on the device, and yes, in a secure manner (avoiding exposure at manufacture time if possible). If this can be achieved through additional keys for this purpose, then please put forward your idea as an answer.
Sep
7
comment How to inject a key (physically) on a huge number of devices?
@domen: I agree, though the question relates to a very specific part of device provisioning, with particular requirements of scale and security (relating to key injection as it does).
Sep
7
comment How to inject a key (physically) on a huge number of devices?
@Purefan: If I understand correctly, to ssh into the device would entail (a) that it is a member of a network, and (b) that there is a private key installed there (part of a symmetric pair). I think use of ssh is good, but it would create a new problem.