4 ms·
> I have personally discarded that approach because I feel air-gapped systems provide a false sense of security: data eventually does need to come in and out of
by zeveb 9y ago
> I have personally discarded that approach because I feel air-gapped systems provide a false sense of security: data eventually does need to come in and out of the system, somehow, even if only to propagate signatures out of the system, which exposes the system to attacks.
This need not be a problem if the machines are truly air-gapped, and all interactions are conducted by typing & reading the screen. This is impractical for OpenPGP or X.509 keys & certificates, and generally for any system using RSA, but it's quite practical for SPKI certificates[0] and systems using Ed25519.
Updates aren't nearly so important with an air-gapped system: after all, there are no network attacks to worry about, and physical attacks can be dealt with physically.
Note that a truly airgapped machine does not have data transferred to or from it, even via a USB key. The whole point of an air gap is an air … gap.
[0] An SPKI certificate is human-readable and hence human-typeable. An example (taken from http://people.csail.mit.edu/rivest/spki-examples.txt http://people.csail.mit.edu/rivest/spki-examples.txt) is below:
(sequence
(public-key
(rsa-pkcs1-md5
(e #11#)
(n
|ALNdAXftavTBG2zHV7BEV59gntNlxtJYqfWIi2kTcFIgIPSjKlHleyi9s
5dDcQbVNMzjRjF+z8TrICEn9Msy0vXB00WYRtw/7aH2WAZx+x8erOWR+yn
1CTRLS/68IWB6Wc1x8hiPycMbiICAbSYjHC/ghq2mwCZO7VQXJENzYr45|
)))
(do hash md5)
(cert
(issuer (hash md5 |+gbUgUltGysNgewRwu/3hQ==|))
(subject
(keyholder (hash md5 |+gbUgUltGysNgewRwu/3hQ==|)))
(tag
(* set
(name "Carl M. Ellison")
(street "207 Grindall St.")
(city "Baltimore MD")
(zip "21230-4103")))
(not-after "1998-04-15_00:00:00"))
(signature
(hash md5 |54LeOBILOUpskE5xRTSmmA==|)
(hash md5 |+gbUgUltGysNgewRwu/3hQ==|)
|HU6ptoaEd7v4rTKBiRrpJBqDKWX9fBfLY/MeHyJRryS8iA34+nixf+8Yh/
buBin9xgcu1lIZ3Gu9UPLnu5bSbiJGDXwKlOuhTRG+lolZWHaAd5YnqmV9h
Khws7UM4KoenAhfouKshc8Wgb3RmMepi6t80Arcc6vIuAF4PCP+zxc=|)))
Yes, it'd be a pain to type — but it would be doable.
- geofft 9y agoTyping data in is not inherently different from transferring it on a USB drive. Your "truly airgapped" machine is still parsing input from an untrusted and potentially malicious source. Yes, you're protected against malicious filesystems, but I'm a lot more worried about buffer overflows in the S-expression parser and SPKI interpreter that you're typing into than e.g. the ext2 or FAT implementation in the Linux kernel, simply because no SPKI implementation has been subject to nearly the same level of attack or scrutiny as Linux kernel filesystem drivers. I think you could probably do it for something like Ed25519, which has the nice property that any 32-bit string is a valid key, so all you have to do is type exactly 64 hex characters. But SPKI seems like a huge attack surface.
- g-b-r 9y agoOk but it is a lot more "gapped". A buffer overflow vulnerability is a lot more unlikely to be exploitable if you can't extend arbitrarily the amount of data passed and you have very little room to manipulate it (and it is so if the target has at least a vague knowledge of the format of the data).
- oconnore 9y agoYou would not accidentally type, with your own hands, some string that would attack the parser. People do not actually name their children Robert"); drop table. An SPKI parser + a manual keyboard operated by a trusted user is an incredibly small attack surface.
- g-b-r 9y agoYou should also assess whether the shielding that air provides is enough for your thread model