6 ms·

I'm going to offer a different opinion: The difference is that if you encrypt a file with a strong, industry standard algorithm, with proper key derivation, en

I'm going to offer a different opinion: The difference is that if you encrypt a file with a strong, industry standard algorithm, with proper key derivation, enough entropy on your passphrase, and stick it on a $27 USB key, you can be personally certain (by most reasonable standards) that your data is secure at rest. However, if you put a file on a $1657 IronKey, you have to trust the certification (the Infineon ROCA snafu has proven beyond a shadow of a doubt that FIPS certification is no guarantee when it comes to the crypto algorithms - and look at stuff like that CVE that affected only the FIPS version of the YubiKey due to extra complexity the certification stuff required!), and have no guarantee that your data is indeed encrypted with your passphrase. Indeed, it's quite common for these "secure" devices to merely encrypt your data with a fixed or variable but not passphrase-derived encryption key, and then merely check the passphrase against a hash (with attempt limits). They are hardened against attacks to bypass this, but they do not offer pure cryptographic protection for your data, unlike the $27 + software solution. Put another way: use a long enough passphrase, and the $27 solution is superior. Use a short passphrase or PIN, and the $1657 solution is hopefully superior (though you have no true guarantee or way to know for sure). You are paying >$1k for the convenience of using a short passphrase, and in exchange you have to trust the manufacturer. Give me a megabuck or two and I bet I have a good chance of getting your files out of an IronKey. Give me a megabuck or two and I can do nothing against software encryption with a 32-character passphrase. If I'm lucky I might even find an IronKey exploit that can be performed for much cheaper. Finding physical exploits (e.g. power, EMI, or even optical glitching attacks, nevermind stuff like pure firmware exploits) is much easier than breaking proper crypto. By the way, the same trade-off exists with Android (in old school FDE mode) vs iPhone secure enclave stuff. The iPhone solution has many advantages for many use cases, but if we're talking strictly about security of data at rest (i.e. from a powered off state) I trust my rooted Android with a long FDE passphrase over any iPhone. The latter only entangles a subset of user data with the lockscreen code, and does not allow you to set a separate longer boot-time passphrase from the normal unlock code (nor does regular Android, but you can do it with root). (disclaimer: it's been years since I looked at IronKeys and had this thought experiment; at the time they definitely made no claims of deriving the encryption key from your passphrase and I seem to recall reading somewhere that they don't, but I haven't checked their marketing these days)

steerablesafe 6y ago
Isn't it a question of where you put your trust? For the software solution you have to trust the computer and its file encryption utilities. For the hardware solution you have to trust the USB stick. Although one could assert that data coming from an untrusted computer might be already compromised. It might not be the case for an air gapped system. Or you can trust different aspects of the computer at a different level. You can trust it for its normal functions but maybe it doesn't get regular updates for file encryption utilities and USB mass storage drivers. Sometimes you still need to fetch data from it using trusted USB devices. Threat models can be complicated, also it makes sense to apply defense in depth.
- marcan_42 6y ago
  If your software is compromised it can already read or write it whatever it wants off of an IronKey, or fire off a passphrase change request behind the scenes and replace your passphrase with an insecure one to render the physical device insecure, at which point it is equivalent to a $27 USB stick. Perhaps in an enterprise setting with physical controls and air gaps you might be able to have a device require a different admin PIN to change the passphrase, avoiding the latter scenario of data exfiltration, but then the device has to be explicitly designed with this in mind to avoid any other exfiltration channels for the true PIN and I don't think IronKeys claim to do this (I don't even know if they support such a split admin PIN). And besides, you probably have bigger problems if your air gapped computer is compromised anyway. Really, IronKeys and their ilk cater to corporate and government bureaucracy use cases that have long since been divorced from true trustable security. They are instead a mountain of complexity, and the more complex a system, the less likely it is to be secure. The thing about software is that you can audit it yourself - it's quite easy to read through the entire source code of a trivial but secure file encryption app and convince yourself that the algorithms match published and industry standard implementations, and that they match test vectors, and that it interoperates with another instance on another machine, or send the files off to someone else to double check. You cannot audit an IronKey yourself. But yeah, sure, defense in depth is a thing, and if you use an IronKey and software encryption (with different passphrases!) then you probably end up with better security, or at least not worse :-)
- 6y ago

steerablesafe 6y ago

Isn't it a question of where you put your trust? For the software solution you have to trust the computer and its file encryption utilities. For the hardware solution you have to trust the USB stick. Although one could assert that data coming from an untrusted computer might be already compromised. It might not be the case for an air gapped system. Or you can trust different aspects of the computer at a different level. You can trust it for its normal functions but maybe it doesn't get regular updates for file encryption utilities and USB mass storage drivers. Sometimes you still need to fetch data from it using trusted USB devices. Threat models can be complicated, also it makes sense to apply defense in depth.

marcan_42 6y ago
If your software is compromised it can already read or write it whatever it wants off of an IronKey, or fire off a passphrase change request behind the scenes and replace your passphrase with an insecure one to render the physical device insecure, at which point it is equivalent to a $27 USB stick. Perhaps in an enterprise setting with physical controls and air gaps you might be able to have a device require a different admin PIN to change the passphrase, avoiding the latter scenario of data exfiltration, but then the device has to be explicitly designed with this in mind to avoid any other exfiltration channels for the true PIN and I don't think IronKeys claim to do this (I don't even know if they support such a split admin PIN). And besides, you probably have bigger problems if your air gapped computer is compromised anyway. Really, IronKeys and their ilk cater to corporate and government bureaucracy use cases that have long since been divorced from true trustable security. They are instead a mountain of complexity, and the more complex a system, the less likely it is to be secure. The thing about software is that you can audit it yourself - it's quite easy to read through the entire source code of a trivial but secure file encryption app and convince yourself that the algorithms match published and industry standard implementations, and that they match test vectors, and that it interoperates with another instance on another machine, or send the files off to someone else to double check. You cannot audit an IronKey yourself. But yeah, sure, defense in depth is a thing, and if you use an IronKey and software encryption (with different passphrases!) then you probably end up with better security, or at least not worse :-)
6y ago