6 ms·
One key (pardon the pun) requirement of a 2FA key is that it can't be cloned - how would this be prevented? Can the microprocessor be locked to prevent reading
by askvictor 8y ago
One key (pardon the pun) requirement of a 2FA key is that it can't be cloned - how would this be prevented? Can the microprocessor be locked to prevent reading its flash memory?
- bsder 8y agoNewer microcontrollers like the Microchip(nee Atmel) SAM-L11 are implementing ARM TrustZone with hardware security features.
- caro_douglos 8y agoit can be read protected. https://www.makomk.com/2016/01/23/openpgp-crypto-token-using-gnuk/ https://www.makomk.com/2016/01/23/openpgp-crypto-token-using...
- bacon_waffle 8y agoThe micro in Tomu is like most other modern micros, in that it has multiple lock bits around access to flash, for various purposes. Specifically, one bit prevents anything but the running program - ie the debug port - from reading flash. The only way to clear that bit is to erase the entire flash, with the notable exception of the user data section, so don't put the secret in there :). Relevant recent discussion: https://news.ycombinator.com/item?id=17587673 https://news.ycombinator.com/item?id=17587673
- pkaye 8y agoYears back I used to work for a company that built 8051 clones. It was possible to prevent the microprocessor from reading the flash memory because the 8051 has a separate program memory and data memory space.
- vardump 8y agoI don't understand how that helps to prevent reading anything. 8051 can read data from both CODE and XDATA memory spaces. See: http://www.keil.com/support/man/docs/is51/is51_movc.htm http://www.keil.com/support/man/docs/is51/is51_movc.htm
- pkaye 8y agoForgot to mention those two instruction will be disabled in flash protected mode.
- gonzo 8y agoATECC608A
- sametmax 8y agoGenuine question: if you can't clone your 2FA, how do you make spares like a house key ? If there is way to get a spare, what's the way to deal with key loss or shared access ?
- jon-wood 8y agoYou don’t make a copy, you add an extra key. (Almost?) all services that support 2FA keys allow you to add multiple keys.
- dspillett 8y agoEssentially you have a to configure the account/device you are authenticating with to accept multiple keys permanently (so you can have spares) or temporarily (replacing a key by registering a new one then revoking the old). In the case of key loss on a properly secure service registering a new key could be problematical if you don't have any other key that is still appropriately registered - you might be permanently locked out unless there is an admin function who has a key registered so can do it for you. Look at multi-key options for encrypted filesystem for one way that this can work. Often the filesystem or block device has a symmetric key that is in turn encrypted by each of the keys that you wish to be able to open it. It is the same symetric key every time, though you can't unlock my copy of it with your key nor can I unlock your's. Once unlocked we could both add a third user by encrypting the base key with their public key (PKI is not required, but is not uncommon).
- sametmax 8y agoOk, so you if you want 9 keys (3 persons in your family has access, have one local spare, and one off site), and 4 services, you need to do 36 registrations of keys ? Is there a standard to automate that ?
- dspillett 8y agoYou don't need one key per service, so that is as little as 5 keys (3 for active users plus the on-site and off-site spares). You may choose to have more than one key per person, to reduce the amount of re-registering needed if one key is lost, though remember that this is the second factor so you also already have passwords that vary by service (and if you give people multiple keys they will most likely carry them together to lose them all at the same time rather than individually anyway).