[OpenAFS-devel] openafs - proposed cache security improvement

[Sean O'Malley]

On Sat, 31 Mar 2007, Jim Rees wrote:

> I didn't understand most of your message.  But without tamper resistant
> hardware, I don't see how you can protect the user key.  If I store the key
> in my iPod, can't someone just copy the key?
>
> Tamper resistant hardware allows you to use a private key if you know the
> PIN, but does not allow you to read the key.  A couple of important
> advantages are that a thief needs both the hardware and the PIN, and that
> the theft is apparent because the physical device, not just the data
> contained in it, must be stolen.

If you just use a USB keychain, then you can just steal the files.

If you use the iPod, and use the hardware serial number, it becomes
pseudo tamper resistant.

A small container (or file) would be holding your private keys. The
hardware serial number would be used in conjuction with a password to gain
access to the container. The keys themselves would also use the hardware
serial number for verification.

A BIG container which hold multiple small containers which contain keys

The multiple small keys could be used for:
-Different departmental keys.

-Students would have multiple ones, so you could have 1-3 semesters worth
of keys, they could change say their summer2007 key when they saw the
counselor in middle of the spring semester of 2007. Which at that time,
they would still need their spring 2007 key and couldnt overwrite it.

-multiple keys in combination for different levels of security.
(you need say a student key, a TA key, and prof key and a departmental
key and a monday 8-5 key.)

-fake- keys. Nothing like security through obfuscation. That is the main
reason why I know my ideas are safe. :)

---
If the BIG container was actually an encrypted filesystem.
You could also write a date and read it back inside the BIG container and
little containers.  This would be recorded centrally, and the last date on
it, could be used to verify the current access attempt and to verify
logging. If it doesnt match all the keys are voided. You could also do
this with the last access of time from the filesystem of the small
container or keys.

The FUN spin to this would be to embed the BIG container into the MSU
Fight Song.

Not impossible to crack but it makes it a little more challenging.

More clear? Or did I do another great job of obfuscated rambling?


--------------------------------------
  Sean O'Malley, Information Technologist
  Michigan State University
-------------------------------------