2

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the passphase.

The device is a prototype for a series of devices. So the passphrase has to be created individually and automatically. What is the best strategy? Perhaps using a secret combination of hardware constants?

Improve this question
3
  • 1
    Keep in mind that your secret algorithm may be reverse engineered, as happened with UPC WiFi keys.
    – Sjoerd
    Commented Jun 10, 2016 at 8:30
  • Yes. But how do everybody store passwords on devices? Whats the state of the art workflow?
    – Christoph
    Commented Jun 10, 2016 at 8:40
  • The "state of the art workflow" is you use an HSM, or maybe as @Sjoerd said, an embedded TPM (but I know more about HSMs than I do TPMs, so I'm making an assumption there !). Or if you don't have either HSM or TPM, then you use cloud-based HSM. What you don't do is go trying to obfuscate it yourself on the filesystem, because you're likely to fail at that.
    – Little Code
    Commented Jun 10, 2016 at 9:45

1 Answer 1

Reset to default
3

The most secure way is to use a Trusted Platform Module. This is specific hardware made for storing keys and doing cryptographic operations. This is secure even against sophisticated attackers with physical access (e.g. the FBI), but you need specific hardware which will cost more.

Without this, attackers may just read the key from memory. In that case you may want to come up with a solution that when an attacker compromises one device he does not compromise all devices, as would be the case for example with WPA-PSKs derived from the SSID.

Another post that goes into this is Storing a secure key in an embedded device's memory.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .