I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the passphase.

The device is a prototype for a series of devices. So the passphrase has to be created individually and automatically. What is the best strategy? Perhaps using a secret combination of hardware constants?

  • 1
    Keep in mind that your secret algorithm may be reverse engineered, as happened with UPC WiFi keys. – Sjoerd Jun 10 '16 at 8:30
  • Yes. But how do everybody store passwords on devices? Whats the state of the art workflow? – Christoph Jun 10 '16 at 8:40
  • The "state of the art workflow" is you use an HSM, or maybe as @Sjoerd said, an embedded TPM (but I know more about HSMs than I do TPMs, so I'm making an assumption there !). Or if you don't have either HSM or TPM, then you use cloud-based HSM. What you don't do is go trying to obfuscate it yourself on the filesystem, because you're likely to fail at that. – Little Code Jun 10 '16 at 9:45

The most secure way is to use a Trusted Platform Module. This is specific hardware made for storing keys and doing cryptographic operations. This is secure even against sophisticated attackers with physical access (e.g. the FBI), but you need specific hardware which will cost more.

Without this, attackers may just read the key from memory. In that case you may want to come up with a solution that when an attacker compromises one device he does not compromise all devices, as would be the case for example with WPA-PSKs derived from the SSID.

Another post that goes into this is Storing a secure key in an embedded device's memory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.