2

I'm trying to find information on encryption without key storage, I plan to generate the key using location data, and hardware addresses, so the key is never stored, instead it is generated if the user is on the correct device in the correct location. Does anybody know where I can find any information on something like this? I plan to do it in C# for Windows Phone.

Thanks.

  • It is much easier to store a key in the device. You are after all doing the same when using eg. the ethernet MAC address. Except that it is smaller, written in firmware instead of disk, and it is exposed to any system locally connected to it (and yes, it can be spoofed). – Ángel Oct 5 '14 at 20:33
1

Unfortunately, this won't be as secure as you may be hoping. First, you will have to have a fairly coarse geographical scheme, because GPS coordinates vary based on things like weather, interference, etc. You might need to have regions that are 250 meters wide. Then, when you divide up someone's town or home region into a grid like that, there are only a few million possibilities. An attacker can simply try them all.

  • Thanks for the answer, you may not have noticed (or I may have not worded it clearly enough) that I plan to add data such as hardware addresses along with the location data to generate a key. – user3279195 Oct 4 '14 at 20:07
0

You should be aware that a malicious user will not necessarily use your software as intended. An attacker may send you coordinates at which he is not really at, and also guess & use your hardware address.

In terms of security of your system, these parameters (location, hardware address) give you no guarantee for the actual location and identity of the user accessing your system. All the user needs to do is know / find out these parameters...

If you wanted to build a system requiring physical presence at a specified point, you would need very different, stronger security mechanisms. You might for example want to have a look at distance-bounding.

  • Thanks for the answer, you make some very good points. I'll definitely do some research into Distance Bounding as a possible solution. – user3279195 Oct 5 '14 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.