21

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD Card, or Smart Card!

I've asked and poked around, and people claim the following:

When given the choice of a Smart Card and another storage medium for 2FA, or regular authentication, go for the Smart Card, as it is safer.

I can't really find why it would be safer, an encrypted SD Card switched to "read only" with the side switch would just be as safe as the Smart card, correct? (That is to say, a USB drive can be overwritten by Malware, etc.).

Is this advice accurate? Why or why not? Is a Smart Card indeed safer?

  • 6
  • Note also that the SD card switch is pretty much ignored by any PC card reader I know. I think mostly only consumer devices like cameras check that switch. – Martin Oct 31 '14 at 10:45
  • 1
    @Martin I'm pretty sure the switch affects the card and prevents it from applying write commands, regardless of the reader/device used. – user42178 Oct 31 '14 at 16:35
  • 1
    @AndréDaniel - you are pretty wrong. (SD card, right?) just take close look. It's the same thing we had back with floppy disks: Just a switch the drive has to heed. Trust me, I tried it, both my external and my internal SD card reader couldn't care less about that switch. – Martin Nov 1 '14 at 21:22
31

A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been compromised.

An encrypted USB drive or memory card on the other hand can simply be copied. There is no mechanism protecting it from being cloned by an attacker. There are some USB sticks that do provide hardware protection to prevent unauthorized access and these would make a more viable option, but it would be a toss up as to whether even those were as well protected as a good smartcard.

  • For authentication, that's definitely correct. Since the OP mentioned bitlocker however I presume they're looking for a second factor to secure their decryption key, in which case the smart card will have to reveal its factor/key-share every time the OP asks to decrypt something. – Bristol Oct 31 '14 at 15:29
  • 2
    @Bristol - in that case there are two different encryption keys. The key on the card is still never shared, but rather the computer would have an encryption key for the hard drive which is encrypted with a key on the smart card. The smart card would provide decryption of the key for the computer, but still wouldn't actually share the key used for decrypting that key. An offline attack would be possible where the key for the hard drive could be decrypted if the smart card was compromised for a short period though, but it still requires an attack on the computer prior to attacking the card. – AJ Henderson Oct 31 '14 at 15:55
21

It's (theoretically) harder to duplicate a Smart Card. You can duplicate a USB drive easily.

If I steal both, you are equally in trouble, but if I steal the USB, duplicate it, then replace it without you knowing, then you are in trouble and you don't know it.

6

Disk encryption requires the host to keep or derive a master key which is kept somewhere in memory so that's your biggest issue. I've implemented aspects of the SafeNet ProtectFile product and other smart-card stacks so I'm intimately aware of the challenges.

Don't for a minute think you have any real security. There are "digital forensic devices" that snapshot and analyse system memory just by plugging a USB stick into a device port, they exploit USB hardware "bugs". Banks have been known to remove or Aryldyte USB ports on workstations because of these known problems. Its almost trivial to acquire the disk encryption key out of memory and then decrypt a hard disk with the tools that are available. This is one aspect of how law enforcement is able to gather evidence and bring criminals to justice.

For your particular use case, nothing is more secure than what you can hold in your head. So its a question of whether you think your brain is more likely to lose information than some piece of technology.

I would use a long meaningless phrase and change it periodically based on your level of paranoia. Pronounceable pass phrases are easier to remember and providing you use a long enough one you have better security than any device (including smartcards) can provide in this instance. I include Availability as a dimension of security and for personal use I prefer the Availability characteristics of my person more than flash which could be acquired if I am incapacitated. Enterprise's may prefer an alternate model that doesn't rely on wet-ware to be alive and functioning to maintain availability.

Smart-card messaging protocols cannot prevent a MITM attack between the card chip and the host computer without a pre-agreed secret (this is distinct from the card PIN and is actually used to protect message flow between card and host/computer) and there are many surreptitious ways to eavesdrop USB. Setting up this secret on all cards to be used on all machines/workstations represents a royal configuration nightmare in enterprise deployments, so it is rarely ever done and fixed well known keys built into the smartcard stack are used. Even if you did go to the trouble, you now have a secret installed in all over the place, so its hardly secret anymore. For this use case a smartcard is just hand-waving, and really no better than typing something on a keyboard, but it can fail more easily or be "lost"/"stolen".

So given a smartcard cannot give you more than keyboard level security in this particular use case, I would use either use a long pass-phrase or consider a read-only flash stick containing a large chunk of random data with a passphrase/password and make sure you keep a secure offline backup of that cheap Chinese flash!

  • "change it periodically based on your level of paranoia"; How does changing your password every 90 days increase security? – a CVn Oct 31 '14 at 8:56
  • The reason people change passwords is if they believe the password may have been observed, perhaps by shoulder surfing, a hidden surveilence camera where they use their computer, a USB or Bluetooth acquisition / key logging device. It depends on your level of paranoia to how frequently you choose to change if ever. If the bios or boot code has been compromised though, changing passwords will be of little to no use. – Andrew Hacking Nov 1 '14 at 7:11
1

I see two points:

  1. you can set a PIN for Smartcards to unlock. Unlike passwords, this PIN can't be offline brute-forced, as long as the smartcard isn't opened and modified. It has protections built in to prevent this. They are not impossible to break, but they offer very good protection.

  2. It depends on the configuration of the smartcard itself, but most likely you have an un-copyable (as in very hard to copy) smartcard. The content of USB-sticks however can always be copied, and when you try to introduce copy protection to USB-sticks you basically want to create a smartcard.

  • downmodder please explain – user10008 Nov 5 '14 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.