There is "Inputstick" device offering way to transport passwords to computer over USB wireless via: AES-128 encryption (CBC mode) over Bluetooth connection http://inputstick.com/index.php/en/about-en/security-en

Assuming it's used to transport credentials (e.g. through KeePass2Android Offline on Android with KP2APlugin plugin (and more about it ) , how would you asses security of proposed solution and used cryptographic algorithms? (not asking about assesment of used Android hardware: you may assume device is freshly patched, offline with only Bluetooth turned on and only Inputstick paired).


The first thing I would check is what is the entropy source in this device. There is no such thing as strong cryptography without a good entropy source (and also usually a good CPRNG).

Then you need to check how keys and IVs are generated and handled. Keys need to be securely transmitted or negotiated (using something like Diffie-Hellman) this in turn requires authentication to defend against active attackers (MITM). How does the device knows it talks to a legitimate user and not an attacker?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.