0

It seems that as long as a computer is connected to the network, any encryption used by that computer makes it insecure, because the computer can be compromised.

I wonder if in this scenario is it secure? And if it's not, how can it be more secure?

We have 2 users: Bob and Eve, both shares a secret key.

each have 1 computer connected to the network and 1 Android phone not connected to the network.

Bob uses his non connected Android device To encrypt a text file, and puts it in an SD card.

He uses his computer to read from the SD card, converts the generated cipher text in data matrix blocks, and sends them to Eve's computer.

Eve's opens the file, converts the data blocks into cipher text, then via OCR in the Android reads it and decrypts it.

Is it possible to get the secret key in this scenario and figure out what is in the text? If so, how?

1
  • Asymmetric or symmetric?
    – rook
    Aug 1, 2015 at 5:00

1 Answer 1

1

Your story is unclear, so I assume a few things:

  • Alice has an Android device and a computer and Bob has an Android device and a computer. (You said "both have 2", but you mean both have 1 so in total there are 2: one for each person.)

  • The computers are compromised, but the Android devices are not.

  • The text file to be encrypted and sent was typed on the Android device.

  • All devices are contained in separate SCIFs. Communication between the computers goes via a cable and optionally any number of routers or other relays.

  • The Android device cannot be exploited via the SD Card (e.g. it doesn't run any autorun files, the user does not accidentally run an executable file from it, etc.).

  • Authenticated encryption is used.

Now to answer your question: yes, in this scenario it's secure, because you circumvented the whole problem.

The point of "you cannot do secure crypto on a compromised computer" is that you do crypto on a compromised computer. In this scenario your Android device does the crypto part, not the computer. Assuming it is not and cannot be compromised, of course it's secure. The computers only act like relays, just like any router on the Internet would when you send an encrypted message.

You must log in to answer this question.