1

There is "Inputstick" device offering way to transport passwords to computer over USB wireless via: AES-128 encryption (CBC mode) over Bluetooth connection http://inputstick.com/index.php/en/about-en/security-en

Assuming it's used to transport credentials (e.g. through KeePass2Android Offline on Android with KP2APlugin plugin (and more about it ) , how would you asses security of proposed solution and used cryptographic algorithms? (not asking about assesment of used Android hardware: you may assume device is freshly patched, offline with only Bluetooth turned on and only Inputstick paired).

Improve this question

1 Answer 1

Reset to default
1

The first thing I would check is what is the entropy source in this device. There is no such thing as strong cryptography without a good entropy source (and also usually a good CPRNG).

Then you need to check how keys and IVs are generated and handled. Keys need to be securely transmitted or negotiated (using something like Diffie-Hellman) this in turn requires authentication to defend against active attackers (MITM). How does the device knows it talks to a legitimate user and not an attacker?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .