4 ms·
Security by obscurity, it's useless. It must be some kind of known key derivation function. If it's something home-grown then actually that's much worse as I do
by jakobdabo 11y ago
Security by obscurity, it's useless. It must be some kind of known key derivation function. If it's something home-grown then actually that's much worse as I doubt Lenovo employs world-class cryptographers who can design something better than e.g. bcrypt or scrypt.
- CHY872 11y agoI don't buy that. For stuff like key derivation, there are loads of ways you could vary the process without compromising security. For example, a normal disc encryption system with the caveat that the password is XORed with a secret before the key derivation algorithm is used (where the secret is unique to the exact laptop model) would effectively stop all decryption in its tracks until you knew the exact laptop model, but would not compromise security at all.
- jakobdabo 11y agoWhere are you suggesting to keep the "secret" (to be XORed with)? It must be stored somewhere in the firmware or on the disk, right? Then I'm afraid it's not a secret, it's just a second salt (which KDF functions already have one) and can be easily read. I just don't see the point.
- deepnet 11y agoThe point is if you no longer have the laptop and hadn't previously extracted the "second salt", thus out of luck And you are probably unaware of why your password doesn't work. Were you aware of this issue before GP posted ? I wasn't.
- sneak 11y agoThere would be lists of per-model salts shared online in days.
- esrauch 11y agoIt could be a per-device salt.
- NeutronBoy 11y agoAnd it could be stored in a tamper-proof chip on the device itself...
- misnome 11y agoIt's useless if the only method. If it slows down potential attack then it's just as effective as, say, multiple encryption cycles.