Let’s consider these 4 computers :
East Coast location :
- computer East1 is connected to the internet.
- computer East2 is connected to East1 through a RS232 serial cable.
West Coast location :
- computer West1 is connected to the internet.
- computer West2 is connected to West1 through a RS232 serial cable.
East2 and West2 have a copy of the same one time pad.
Their only connection to another computer is the serial cable.
They use a custom written software to transmit (crypted) messages on the serial port.
They have another custom written software that can crypt / decrypt a message with the one time pad.
East1 and West1 have another custom software that can :
- send and receive the crypted messages through the serial cable
- send and receive the crypted messages to each other via internet (email, FTP, SSH ...)
They don't have the one time pad so cannot decrypt the messages. They're just acting as transmitters.
Example scenario :
Bob is on east coast and want to send a crypted message to Jane who is living on west coast.
- Bob writes the message on East2.
- East2 encrypt the message with the one time pad
- East2 sends the message to East1 through the serial cable
- East1 receives the message and forwards it to West1 via internet
- West1 receives the message and transmits it to West2 through the serial cable
- West2 decodes the message
- Jane reads the message on West2
- she decides to answer
- West2 encrypts her new message and pass the message to West1 through the serial cable
- West1 sends the message to East1 via internet
- East1 receives the message and sends it to East2 through the serial cable
- East2 decrypts the message and Bob reads Jane's answer
Let's make some assumptions :
- the one time pad is truly random (meaning unbreakable)
- East2 and West2 were not compromised before being connected with the serial cable
- Bob and Jane are trusted
- and so is the developer that wrote the custom softwares used to communicate through the serial port
- the potential attackers can't access physically to East2 and West2 (nor with tempest etc)
And finally here is my question:
can an attacker who gained control of East1 and / or West1 access the one time pad on East2 and / or West2 ?
I understand that the attacker can :
- intercept the coded messages (wich he can't read if the one time pad is random)
- stop the communications between all the computers
- send fake messages (wich should be gibberish once decoded)
But can he do anything else if its target is behind a serial cable ?
More questions :
- does it change anything if instead of true serial ports, serial to USB converters are used ?
- if the solution is secure, does the operating system of East2 and West 2 has any role to play or even an unpatched Windows 95 would not change anything (remember the attacker can't access physically the computers) ?
Thanks in advance for your inputs.