Menu
Is free
check in
the main  /  Programs / How to protect the open key from the substitution. Means of destruction of carriers

How to protect the open key from the substitution. Means of destruction of carriers

Minus such characteristics of the medium as serial number, hardware configuration, key file, information in the secret sector of the disk, is that the attacker can easily reveal them quite easily and carry out hacking through their imitation.

To eliminate such disadvantages, the environmental characteristics must be made to external devices as possible from the NSD, which make it difficult to emulate and duplicate.

This feature is provided by electronic keys. They are forcibly administered to the medium, the characteristics of the medium, resistant to emulation and duplication.

The keys are the development of the Israeli company Aladdin and are used for POS from the NA use: prevent the program starts when there is no electronic keys, limit the maximum number of copies, simultaneously launching programs on the network, limit the program running time and limit the maximum number of its launches.

Types of HASP electronic keys.

  • 1. Hasp4 Standart
  • 2. Hasp4 Memo.
  • 3. Hasp4 Time.
  • 4. Hasp4 Net.

The simplest modification of HASP electronic keys. Includes only encryption feature and the response function associated with it. Cost - $ 13. Can implement the following protection functions:

  • 1. Check the presence of an electronic key
  • 2. Serve the response function various values and compare the response with reference values
  • 3. Use the encryption feature to encrypt the decryption of the executive code of the program or the data used.

Basic security elements

A certain series is connected with each electronic keys, which assigns a specific development. software Product And it is possible at the request of the manufacturer of each of the software produced by him. Inside the same series, electronic keys have one encryption function and one response function. To access the electronic key functions, knowledge of the access code is required (2 to 16 bits). Inside one series of access codes are the same. User software should not know these codes, they are known only to the manufacturer.

These keys include all Hasp Standart features. In addition, have a unique identification number and non-volatile memory of a certain amount.

  • 2 types of non-volatile memory:
    • · Hasp4 M1 - 112 bytes
    • · Hasp4 m4 - 496 byte

In addition to those functions that can be implemented using HASP4 Standart, these keys can:

  • 4. Store in non-volatile memory various confidential information used to protect software (keys, transition addresses, etc.)
  • 5. It is possible to store in non-volatile memory information about disconnected and connected program modules available to the user
  • 6. It is possible to protect programs by the number of launches.

Using this key, it is possible to limit the service life of the program and, as a rule, is used to create demo versions of programs having a high cost, or when leased by software.

Includes built-in calendar with date and time. Used to protect software for use.

Used to limit the maximum number of simultaneously running copies of programs on the network.

Ways to protect software using electronic keys HASP

You can implement using embedded and dying mechanisms.

Built-in - Hasp API.

Distribution Hasp Envelopment.

HASP MEMO, TIME and NET electronic keys include a subsystem full control Access (FAS) that allows you to protect multiple manufacturer's programs at the same time, and limit them depending on the type of keys by the number of launches, by the period of validity, by the number of simultaneously running copies.

HASP MEMO, TIME and NET electronic keys have the ability to remote reprogramming using the RUS subsystem.

For implementation remote control 2 utilities are formed: the seller and the buyer. They are formed under a specific electronic key, which is binding to its identification number.

Pattern Code Security (Structural Code Protection Mechanism)

The PCS mechanism is based on the implementation of template programs into the original texts, which define certain access to the electronic key. These functions defined in templates will be called hidden way From the executable code of the program. For them, the HASP procedure will not be explicitly called. When a developer of protection, an explicit HASP call is made to solve its tasks, the program automatically performs a sequence of hidden calls of functions defined in PCS templates. In total, such templates can be defined up to 25 pieces. By embedding through these templates, the challenges of hidden procedures, the defense developer can significantly complicate the trace of protective mechanisms, make it difficult to interfere with the outside of their work.

An attacker, disconnecting a clear call of HASP, in fact, turns off the set of hidden calls, the result of which is reflected in the program functioning, for example, calls could perform code decryption, receive responses from an electronic key that will be carried out during the further operation of the program.

How to protect open key from replacing

In the open key cryptosystems, you do not need to protect the open keys from the compromise. On the contrary, it is much better when they are widespread. But it is very important to protect them from the fake, in order to always remain the confidence that the specific public key really belongs to a person whose name is specified in the certificate information. This consists of the weakest place of the open key cryptosystems and this is their main vulnerability. Let's first introduce a potentially possible incident, and then figure out how to prevent it.

Suppose you need to send a secret Essay Alice. You download its certificate and the public key from the depositary server, then this key encrypt the letter and send it by e-mail.

Unfortunately for you and Alice, Mallory attacker generated his own key pair with alice identification information in the certificate (name, email), hacked the server and imperceptibly replaced the authentic open key of Alice with his fake. I suspected anything, you used the fake wrench of Mallory instead of the Open Key Alice, because everything looked quite believable, because on a fake version there was an alice identification information. Now Mallory can intercept and decipher the message intended for Alice, because at its disposal the corresponding private key. He can even again encrypt a letter to the real key of Alice and send it to the destination, so no one will notice anything suspicious. Moreover, he can make his own closed signature key, allegedly belonging to Alice, because to check them all will use its stock open key.

The only way to avoid such a problem is to prevent frauds with open keys. It is easy if you got an open Alice's key directly from it at a personal meeting, but it may be very problematic if it is in thousands of miles from you or just in this moment Unavailable.

You can probably get the key Alice from your david's common friend with her, who has a true copy of her open key. David can sign an alice's outdoor key with his own closed, thereby behaving for his accuracy.

So, David will assure the key certificate than it will indicate that Alice's key was not formed. At the same time, checking the guarantor signature on the certificate requires you have a genuine copy of the David's open key. Probably, David can also provide Alice a reliable copy of your key. Thus, he will be a trusted mediator-guarantor between you and Alice.

This signed alice open key certificate can be loaded to her or David to the depository server so that you can get it at any convenient time. After downloading the certificate, you check the signature of David's open key and you can be sure that it is actually a genuine open key Alice. None of the fraudster will be able to fool you, give out his fake key for the key Alice, because no one can fake this key certifying the signature of David.

A well-known and respected person can even specialize in mediation and representation between different usersBy signing the certificates of their open keys. This trusted individual can be called the Certification Center. The digital certificate of any public key containing the signature of this certification authority may be a priori regarded as a genuine and really belonging to the user whose identification is specified in the certificate information. Any user who wants to participate in such a network of confidence is a fairly reliable copy of the open key of the CA. In some cases, the CA may also act as a depository server, allowing users to request open keys from it; But for the Depositary Server, the keys are not needed.

Trusted centralized CA is especially appropriate in large corporate and state institutions from unified system Control. Some organizations use CA hierarchies.

In a more decentralized environment, the possibility of all users to act as representatives and trusted guarantors of their friends and colleagues will be more preferable than the centralized source of key certification.

One of the attractive PGP features is that it is implemented equally efficiently and in a centralized environment with a certification authority, and in a more decentralized, in which users independently exchange their personal keys.

A set of measures to protect open keys from a fake is the most difficult problem. practical implementations Open key cryptosystems. It is the "Achilles heel" of all asymmetric cryptography, and most of all PGP mechanisms are tied to the solution of this main task.

Do not use someone else's open key until you fully ensure that this is not a fake, but a genuine key of a person whose identification is specified in the certificate information. You can be confident in the authenticity of the key, if you got it directly from the owner at a personal meeting, or if his certificate is signed by a person you trust, provided that you have a reliable copy of the guarantor key. In addition, the certificate information must be reflected both the name and surname of the user, and not one name.

No matter how experienced, do not forget about precautions and do not rely on the authenticity of the service-depositary or from the public key website, if it is not certified by someone you trust. Such a non-certified outdoor key could be forged or replaced by anyone, perhaps even system administrator Server or website.

If you are asked to sign someone's key, first make sure that it really belongs to the person specified in the certificate identification, since the signature on the open key certificate is your guarantee for its authenticity and belonging to the specified person. Anyone who trusts you will take this outdoor key for reliable, because it carries your certifying signature. Do not rely on the speculation and someone else's opinion: Sign the public key only when personally and directly made it in its belonging to the declared owner. It is preferable to sign only those keys that were directly obtained from their true owners.

To sign a key certificate, you should be much more confident in its authenticity than for its personal use in order to encrypt messages. To establish the authenticity of the key only for personal use there will be enough signature of a trusted guarantor. But to sign the key to himself, you need your own independent immediate conviction in who actually is the owner of this key. You may need to call the owner (make sure you say with whom you need) and ask him to read the key imprint, in order to make sure that the key that you have is an accurate copy of the original.

Keep in mind: Your signature on the key certificate does not guarantee the trust. owner; It is prescribed only for the accuracy (authenticity) of this open key. You do not risk a reputation by signing a sociopath key, if completely convinced that the key really belongs to him. Other people will believe in the authenticity of the key, as it is signed by you (admitting that they trust you), but do not believe its owner as a person. The trust of the integrity of the key and confidence in its owner is not the same thing.

It is useful to keep your open key along with a set of certifying signatures from a number of guarantors in the hope that most people will trust a certifying signature of at least one of them. You can place your key with a set of signatures in various depositories. If you sign someone else's public key, return it to a copy with your signature back to the owner; Thus, you can act as his representative.

Take all measures so that no one can replace the file of your own bunch of open keys. Checking signatures on a new key certificate completely depends on the integrity of reliable open keys already on your bundle. Keep a ligament under physical control; It is advisable to store it, as well as the private key, on its own personal computer, rather than on a multiplayer system with free access or service PC; This is necessary to protect the bundle from the fake, and not from compromising. Keep relevant reliable backup Bundles of open and closed keys on an external carrier protected from writing, for example, on a CD.

Since your own public key is the last source of direct or indirect authentication of all other keys on the bundle, this key to protect against fake is most important. It will be better if you make it backup and place it on a reliable carrier.

PGP in its logic proceeds from the assumption that you hold the bundles of the keys, the PGP itself and the system as a whole in full physical security. If the attacker gets access to a computer, then, theoretically, he will be able to change the program, making it ineffective all its discovery mechanisms for unreliable keys.

A somewhat complicated way to protect the entire bundle of open keys from the counterfeit will be the signing of its file with a closed key. You can do it by creating removable signature(Detached Signature) file and regularly checking it.

From the book Applied Free Programs and Systems in School Author Retunov Maxim

From book Free programs and systems in school Author Retunov Maxim

Chapter 4. "Open Office" Although "office" programs with distribution of networks and communication programs and ceased to be the main application personal computersthey are still quite popular, and in the curriculum they are given significant (perhaps even

From the book Fedora 8 User Guide Author

6.1.1. Open office: What is it? It's no secret that the main office package The world is MS FFIs. Yes, not all existing computers Work under windows controlbut no one will argue that most office and domestic * computers are used precisely

From the book Internet intelligence [Guide to action] Author Yuschuk Evgeny Leonidovich

How to protect your computer from hacking technical means It must be said that the hackers themselves recognize: hacking with technical means is often difficult. This is due to the fact that software manufacturers and "iron" are continuously monitored

Author Reyond Eric Stephen

From the book digital magazine "ComputerR" № 86 Author Composition "Computerra"

From book Programming Art for Unix Author Reyond Eric Stephen

DLP: How to protect secrets from leakage Viktor Ivanovsky Posted on September 15, 2011 "Wikipedia" presents us as many four options for decryption, two of which - Digital Light Processing and Disneyland Paris - We will note for the considerations of elementary logic, and to two others - Data Loss Prevention and

From the PGP book: coding and encryption of public key information. by the author Levin Maxim.

16.7.1. What is defined as an open source code license can limit or determine any of the following rights: the right to copy and reproduction, the right to use, the right of modification for personal use and the right to reproduce

From book Home computer by kravtsov Roman

19.1. UNIX and open source code in the development of an open source code is used by the fact that clarification and correction of errors, unlike, for example, the implementation of a certain algorithm, is a task that allows its separation into several parallel

From book Linux eyes Hacker Author Flenov Mikhail Evgenievich

How to protect the secret keys from disclosure. Carefully protect your own secret key and password phrase. Truly carefully. If it happened that your secret key is compromised, urgently review all interested parties, before your

From the book digital magazine "ComputerR" № 217 Author Composition "Computerra"

How to protect your computer on the Internet always seemed to me almost incredible that someone could penetrate my computer while I am on the Internet! First, who needs it, secondly, to do this, you need to have a fairly high qualification. And thirdly,

From the book anonymity and security on the Internet. From "kettle" to the user Author Kolisnichenko Denis Nikolaevich

1.3. Open source code is safe? There is an opinion that programs with open source code Reliable and safer than commercials. The solves of this statement believe that such a system is examined by many people different ways And thereby reveal all possible

From the book office computer for women Author Pasternak Evgenia

How to protect a browser from unwanted changes to settings Oleg Necha Posted on March 21, 2014 To lose your usual browser settings easier than simple: enough to go to some dishonest site or download free app,

From the book Laptop [Secrets effective use] Author Ptashinsky Vladimir

Chapter 9. Good password. How to protect your page in social network From theft? 9.1. Choosing a good password Many users use passwords like 1, 1234, QWERTY, and then surprised why their mailbox Or a page in the social network of hacker. The answer is simple - to her

From the book of the author

Protect this feature for those who do not want to be amended in his text. If you click on the Protect Document button and select a command to limit formatting and editing, an additional panel will appear (Fig. 1.115). How can you see from the picture you can

From the book of the author

How to protect the laptop laptop - the product is strong enough. Nevertheless, there are many situations in the outside world that can destroy a laptop computer. It may seem strange, but most laptops die with very trivial circumstances. Nic

- (anti-vandal cabinet) (eng. Protective Cabinet) Telecommunication cabinet, for placement and protection of telecommunication equipment (servers, routers, switches, modems, telephone stationsElements of optical cross ... ... Wikipedia

Electronic key - This term has other values, see the electronic key (values). Electronic key (also hardware key, sometimes Dongl from English. Dongle) hardwaredesigned to protect software (software) and data from ... ... Wikipedia

PGP - Pretty Good Privacy by Philip Tsimmermann Developer Philip Tsimmermann written on Multi Language Operational linux system, Mac OS X, Windows First Issue 1991 Website ... Wikipedia

Cipher Vernama - (Other Title: English One Time Pad Scheme of disposable notebooks) In cryptography Symmetric encryption system, invented in 1917 by AT T Major Joseph Moborn and Hilbert. Cipher Vernama ... ... Wikipedia

Dongle - Electronic key (also hardware key, sometimes dong from English. Dongle) hardware tool for protecting software (software) and data from copying, illegal use and unauthorized distribution. ... ... Wikipedia

Algorithm Diffe - Algorithm Diffi Helmana (English Diffie Hellman, DH) Algorithm, allowing two sides to get a common secret key using unprotected from listening, but protected from the change channel. This key can be used ... Wikipedia

Non-liberated cipher - (Vername code) - In cryptography, a whole class of systems with absolute cryptographic resistance, widely known as "Disposable notepads / liners" .. Contents 1 Creating history 2 Description ... Wikipedia

Algorithm Diffy - Helmana - (English. Diffie Hellman, DH) Algorithm that allows two sides to get a common secret key using unprotected by listening, but protected from substitution, communication channel. This key can be used to encrypt further exchange with ... ... Wikipedia

WPA. - And WPA2 (Wi Fi Protected Access) is an updated device certification program wireless communication. WPA technology has come to replace protection technology wireless networks WEP The advantages of WPA are strengthened data security ... Wikipedia

Disposable notebook

Shipoblot - Vernama cipher (Other Title: Eng. One Time Pad Disposable Notebook Schemes) In cryptography Symmetric encryption system, invented in 1917 by AT T Major Joseph Moborn and Hilbert. Cipher Vername is ... ... Wikipedia

The popularity of PKI-based solutions continues to grow - more and more sites go to HTTPS, enterprises are implementing digital certificates for authentication of users and computers, S / MIME proves its spength and encryption email, and as a way to check the source of messages to counteract phishing. But encryption and authentication in these applications are practically meaningless without proper keys.

Each time when issuing a digital certificate from the certification authority (CA) or a self-signed certificate, you need to generate a pair of closed and open keys. According to best practices, your secret keys must be protected and be, well ... Secret! If someone gets them, can, depending on the type of certificate, create phishing sites with the certificate of your organization in address lineAuthenticate B. corporate networks, issuing yourself for you, sign applications or documents from your face or read your encrypted emails.

In many cases, the secret keys are personal certificates of your employees (and, consequently, part of the personal data of the organization), so their protection is equal to protecting fingerprints when using biometric credentials. You will not let the hakwar get a fingerprint? The same with secret keys.

In this article we will discuss options for protecting and storing closed keys. As you see, these options may differ slightly depending on the type of certificate (s) and on how you use it (for example, recommendations for SSL / TLS certificates are different from recommendations for end-user certificates).

Certificate / Key Stores and Browsers

Examples: Windows Certificate Store, Mac OS Key

In some operating systems And browsers have certificate vaults or keys. These are software databases that locally on your computer store a pair of closed and open keys as part of the certificate. Such key storage is quite popular: many applications automatically searcable keys here, and you do not need to manually specify the certificate file every time, so this is a fairly convenient option.

Another plus of this option is quite easy to customize. You can enable / disable export closed keyturn on for him reliable protection (Password entry each time using a certificate), and you can create backups if the closed key is exported. In addition, when you turn on roaming profiles in Windows, the certificate is attached to the profile and becomes available at the entrance to another computer with this profile.

If you decide to choose this option, you should consider several aspects. First, even if you mark the closed key as an uncomportable, some utilities can bypass this protection (that is, the impossibility of exports is not guaranteed). In addition, if someone worked under your accounting, And you did not include strong closed key protection (password when using a certificate), then they can use your certificate. Finally, if your private key is marked as exported, then someone for your computer will be able to export it. Even if you have a secret key protection, the password does not ask when exporting.

And Last: Chrome and IE use Windows Certificate Storage, while Firefox has its own certificate store (from Mozilla). This means that if you import a certificate in the Windows Storage, then Chrome and IE will automatically find it, and there is no Firefox.

Typical applications:

  • Applications for digital signature (for example, Adobe Acrobat., Microsoft Outlook and Office will access the Windows Certificate Storage [Custom]).
  • Microsoft IIS server also searches for SSL certificates in Windows Certificate Storage [General for Computer].
  • Client authentication (user or computer), depending on the settings, most often refers to the Windows Certificate Storage.
  • Signature code in Windows (applications and drivers).

Files.pfx i.jks (keys repositories)

PKCS # 12 files (.pfx or.p12) i.jks * (created by the Java Keytool tool) contain your closed and open keys. Unlike local storage facilities for OS and browsers, these files can be placed almost anywhere, including remote servers, and are always protected by password (that is, each time you use your secret key, you need to enter a password). Another attractive feature: Since these are just files, it is easy to easily send copies for several people who need to use the certificate.

If you decide to save the file on the remote server, you should especially take care of restricting access to it. If someone gets access, you can use your certificate. Similarly, you should be especially careful with the easy copying and distribution of these files. Although it is a great convenience for you, but at the same time an attacker will simply make a copy if it gets access to your keys repository. The closed key password is still needed to efficiently use the copied file. This is another reason to use reliable passwords out of 15 and more characters containing capital letters, numbers and special symbols. With this storage option, you need to consider another thing: the end user is superimposed more responsibility from the point of view of where the file is located and whether it is stored correctly.

If you can not use cryptographic equipment or storage windows keys (Described above), but still want to improve security (instead of just place the key storage file on a computer), you can record this file on a flash drive, which will lie in a safe place. Of course, some convenience is lost here, so if you often use the signature, then you will rather want to store the file locally to facilitate access.

Typical applications:

  • Signing a Windows or Java code.
  • FDA ESG and IRS IDES use.pfx for safe communication with American civil services.
  • Some web servers (for example, Apache Tomcat or JBOSS).
* Note: Java recently switched from JKS on PKCS # 12 as the default key storage type.

Cryptographic Tokens and Smart Cards


As casually mentioned above, you can enhance security if you store a secret key on separate hardware. But there is a big difference Between the use of cryptographic tokens or smart cards and standard flash drives. With cryptographic equipment, the key is generated on the equipment itself and is not exported. The closed key never leaves the device, which greatly makes it difficult to extract access and compromising.

Note: If you want to further protect the private key, which has already been generated earlier (i.e. not on the token), then you can import.pfx file to the token, and then delete the original.pfx.

With a token, every time you use a certificate to enter a password. This means that even if someone gets your token, it will still need a password. The key storage in the token means that you can safely use the same certificate on multiple computers without the need to create multiple copies and passing the export / import process. Cryptographic equipment complies with FIPS, which is required for some sectoral and government regulations.

Of course, there are some other considerations that should be borne in mind if you decide to choose this option. In addition to the additional difficulties of token management, this option may not work with automatic assemblies due to the requirement to enter a password each time using the certificate. There is also no way to create a backup certificate, since the closed key is not exported (lack of additional security). Finally, in some scenarios, this storage option is simply impossible. For example, if specialized devices do not support tokens or smart cards. Or in situations where employees do not have physical access to the computer, and work with remote terminals.

Typical applications:

As a rule, all uses listed for storage facilities in the OS / Browser (Signature of Documents and Code, Customer Authentication, Windows IIS), support crypto-tokens or smart cards - if there are appropriate drivers. However, this is not always practical (for example, in web servers or automated systems Assembly for signature code that will require the password in each time the signature is applied).

Compliance with regulatory requirements is one of the main causes of the use of cryptographic tokens.

  • It is necessary for signing the extended check code (EV) in accordance with the recommendations of the CA / Browser forum.
  • Recommended for standard code signature in accordance with the minimum CA Security Council requirements. Certification centers are required to recommend cryptographic equipment as the main option for issuing certificates. If the cryptographic equipment is not issued, the client must sign an agreement, which will store a private key on some removable equipment (which is removed after signing).
  • Required for digital signature and receiving trusted status in adobe programs, in accordance with the requirements of Adobe Approved TRUST LIST (AATL).
  • Sectoral rules such as CFR 21 part 11 from FDA and digital signature requirements in individual countries often talk about the secret key, which is in the sole ownership of the owner. Storage on cryptographic equipment meets these requirements.

Hardware Cryptographic Modules (HSM)


HSM is another hardware storage solution, especially if you do not want to rely on separate tokens or it seems too burdensome. While the tokens are more oriented on manual entry or individual applications (for example, signing a small amount of documents or code, authentication in VPN or other networks), then HSM provides APIs, support automated workflows and automated assembly. They also comply with FIPS requirements and usually provide a higher rating than tokens.

Traditionally, HSM is local physical devices that require qualified resources to manage and provide basic requirements and SLAs. HSM maintenance may be expensive and resource-intensive process, which in the past prevented the spread of this technology. Fortunately, in recent years, HSM cloud modules have appeared, which provide many of the advantages of local HSM, without needing local maintenance.

An example is a familiar Key Vault service in the Microsoft Azure cloud, which stores cryptographic keys in the cloud HSM from Microsoft. If you have small organizationthat will not allow you to buy and manage your own HSM, then this is a great solution that is integrated with public certification centers, including Globalsign.

If you are considering a version with the signature of documents, we recently launched a new Digital Signing Service service, where it is also used cloud storage HSM for closed keys. It is worth noting that the new service supports individual signatures of all employees. In the past, most HSM-solutions for the signature were supported only by identifiers at the level of departments or organizations (for example, accounting, marketing, finance), and not individuals (for example, John DW). Consequently, to work at the level of individual employees, organizations had to deploy the tokens infruster, which, as we noted above, may be burdensome. With this new service, digital signatures of individual employees are implemented without the need to independently manage HSM (and without the risk of loss of tokens by employees).

Typical applications:

  • Signature of documents or code in large quantities.
  • SSL (depending on server configuration).
  • The CA infrastructure for the work of its own CA (root CA, subordinate CA, RFC 3161 time label server) in offline or online (root CA, as a rule, works offline).

Future key storage methods

We reviewed the basic options that were used for many years. But it seems nothing in the world information security, including storage of keys, is not insured against IoT influence, so new options are being developed.

As more and more devices are connected to the network with the need for authentication and secure data exchange, many developers and manufacturers turn to PKI-based solutions. In turn, this leads to new considerations, requirements and technologies for protecting closed keys. Below are two trends that we see in this area.

Trusted platform module (TPM)

TPM modules themselves are not new, but more and more and more often they are used to protect closed keys. The trusted platform module can be used to store (or transfer) the root key and protecting additional keys created by the application. Application keys cannot be used without TPM, which makes it a very useful authentication method for endpoints, such as laptops, servers, and manufacturers of Internet devices. While many laptops are already supplied with TPM, while this technology is not too widely used in the corporate sector. However, in the world of IoT, they are often used to safely interty devices as a hardware root of trust.

IoT has created a problem when a lot of anonymously interacting devices facilitate hackers intercept messages or device impersonation. The TPM module is introduced at the production stage for protection cryptographic key And, therefore, for reliable identification of the device.

During production, steam is generated from closed and open keys. The public key goes to the certification authority for signing and issuing a digital certificate. The closed key never leaves the device. It is stored on the chip and cannot be exported / copied / destroyed. Now the certificate is a device passport, and the protected private key forms the hardware root of trust.

Physically unconnected functions (PUF)

Technology of physically uncloned functions (PUF) is a paradigm shift in key protection. Instead of storing keys (with the probability of physical attack), they are generated from the unique physical properties of the static SRAM memory of a particular chip and exist only when power is turned on. That is, instead of the reliable storage of a closed key, the same key is restored again and again on demand (until the device fails). This key is guaranteed to be unique, because when generating is used inherent uncontrollable disorder in the silicon structure of the chip.

The PUF technology in combination with a trusted implementation medium (Tee) is an attractive solution if required inexpensive, easy to integrate and ultra-safe key protection. PUF along with PKI make up an exhaustive solution for identification.

Our INTRINSIC ID partner has developed such a SRAM PUF key preparation system, which manufactures unique, fake and copy device identifiers on the hardware level. Using our certification services, we translate these identifiers into digital certificates by adding PKI capabilities. Thus, each device is assigned a unique, protected to cloning a pair of keys, which is not stored on the device in the disabled state, but the device can recreate this key on request. It protects against the attack on the disabled device.

Certification keys

If the keys are in some ways are transmitted to the remote location, they must be checked upon receipt on the subject of whether they are not subject to intervention during the transmission process. This can be done manually or use some form of digital signature.

Open keys are designed to publish or transmit to other users and must be certified as owned key pair owner. Certification is carried out using the Central Certificate Bureau (Certification Authority, CA). In this case, CA provides a digital signature on the open key, and thanks to this, the CA with trust perceives the fact that the public key belongs to the Keyword holder (see Fig. 5).

Fig. 5. Public key certification in Certificate Bureau

Without the correct certification of the key and its owner, an attacker can introduce its own keys and, thus, overcome the protection of all transmitted and authenticated information.

Open keys open key pair do not require privacy protection. They only require ensuring integrity protection through the use of certificates. The secret key of the open key pair should be kept all the time in secret.

If the attacker receives a copy of the secret key, it appears the ability to read all confidential traffic addressed to the owner of the key pair, as well as digital signing information as the owner of the key pair. Protection of the secret key must apply to all copies of it. Therefore, the file containing the key must be protected, as well as any archive media on which this file can be recorded. Most of the key protection systems are implemented by using passwords. This protection allows you to protect the keys from random spy actions, but not from a joint directional attack. The password used to protect the key must be selected thoroughly to confront attacks by rough strength. but best way The key protection is, first of all, preventing the access of an attacker to a key file.

It is necessary to protect all the key keys using the secret keys. If the key is contained in the file, this file must be protected anywhere where it is not (including archival carriers). If the key is in memory, it is necessary to take measures to protect the memory space from research by users or processes. Similarly, in the case of a dump (discharge of data on hDD) Kernel, the kernel file must be protected, as it may contain the key.