6 ms·

I personally don't like how it's possible to store data on my device without me being able to access the data. Also most of the time these keys are used for DRM

I personally don't like how it's possible to store data on my device without me being able to access the data. Also most of the time these keys are used for DRM. So... good IMO.

jesprenj 5y ago
Exactly my first thoughts. Key is derived from "user-controlled data". That makes sense, it's my phone, isn't it? Why would the phone need to encrypt data in a way that the user can't access it.
- ZiiS 5y ago
  The user positive use is securely booting to a password prompt to decrypt your data. Without this security working, anyone who steals your phone will be able to get all the data you have saved on it.
  - d-gearloose 5y ago
    That's kind of the thing with Microsoft's bitlocker as well. It automatically decrypts the hard drive on boot, so the only thing it could protect you from is someone removing the hard drive and mounting it somewhere else. But if they have physical access to the device, why would they do that?
    - dwattttt 5y ago
      That's the default configuration for bitlocker, but there are others, including requiring a password or key provided by USB on startup
    - vladvasiliu 5y ago
      I think the idea is that Windows' security, once booted, is enough to protect your data. It's the same situation if, for example, your laptop gets stolen while in sleep / on the lock screen. In theory, you shouldn't be able to get the key while booting on some other media (say, your own Windows USB drive). > Ensuring the integrity of early boot components and boot configuration data. On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to make data accessible only if the computer’s BIOS firmware code and configuration, original boot sequence, boot components, and BCD configuration all appear unaltered and the encrypted disk is located in the original computer. On systems that leverage TPM PCR[7], BCD setting changes deemed safe are permitted to improve usability. https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures https://docs.microsoft.com/en-us/windows/security/informatio...
    - sissjdb 5y ago
      Physical access does not imply easy arbitrary code execution. Consoles are largely protected by the same technology, how often do you see people achieving code execution on them by tampering with the hardware?
      - roblabla 5y ago
        All the time? Hardmods have been a thing since the first consoles, all the way down to the latest Nintendo Switch. Also, consoles are "protecting" not the user, but the manufacturer - which is exactly the point people are trying to make.
        sissjdb 5y ago
        Haha. You’re bringing up tech from 20 years ago when we’re discussing modern security measures, aren’t you very clever. What hardmods do you know of for current gen consoles? Even the previous generation mostly fixed all public hardware based attacks. This is standardized hardware that would be a relatively soft target to build tooling against, yet modchips are essentially dead because the attacks are just far too difficult.
        llbbdd 5y ago
        This is pretty confusing, hardmods are definitely a thing for the current gen Switch - AFAIK it's the only way to jailbreak ones that were manufactured after some date and don't allow soft mods.
        sissjdb 5y ago
        Nintendo famously has the worst security of all the console manufacturers. That there are still no good attacks for the xbox one speaks volumes.
      - nest0r 5y ago
- olliej 5y ago
  No, what you want is a random key. The security properties of an n-bit key depend entirely on those n-bits being random. Derived from user data is not (A CSRNG is not secure if the initial state is predictable). The way security on modern devices with h/w support work is that a random key is generated in hardware. Subkeys are derived from that. Access to these keys (if they're ever directly exposed) is gated on the correct password, but nothing is actually protected by it. This is what you want as it means you don't have to make a password that is maybe 50 characters long, and actually random (e.g. no word sets).
octoberfranklin 5y ago
I have some bad news for you: that's possible with just about every computer introduced since 2013. Google "Intel Management Engine" or "AMD PSP" or "ARM TrustZone". The last of these could, in theory, be less bad, except no ARM licensee except Rockchip (and maybe Apple -- jury is still out there) has chosen the "be less bad" option.
- fastball 5y ago
  I'd say this is more in-line with Intel SGX than Intel ME.
  - anonymousDan 5y ago
    SGX is implemented on top of ME and relies on it for a substantial fraction of its functionality. You are right though that trustzone and sgx are both TEEs.
    - namibj 5y ago
      I wish especially AMD would offer Java Card support through their PSP to the operating system, at least if the PSP is resistant to MMIO attacks on the integrity of the Java Card memory. Being able to open a Diffie-Hellman encrypted, mutual-signature-authenticated channel to a remote device to then receive an AES key for disk encryption is far better than some TPM header that can easily be sniffed with physical access. Would be even better if NVMe SSDs were able to authenticate themselves and let you transfer in a key over a DIffie-Hellman channel so sniffing the PCIe bus wouldn't deliver the key (or a non-PFS-encrypted encapsulated form of it) to an attacker. The speeds of NVMe SSDs unfortunately prevent LUKS from being cheap, and TCG Opal is kind of a joke from a security standpoint (doesn't even (seem to) specify that the provided "password" is used to derive a key, suggesting that it may just be used via a password hash to compare against a database entry to decide whether to unlock a disk encryption key). Even TPMs don't seem to encrypt the communications channel they use with the CPU/PSP, and they are often socketed which makes MITM attacks easy with physical access. If they'd offer Java Card, they'd at least be somewhat useful...
- 5y ago
dhx 5y ago
A particular example of why it's bad that you can't access all the data on your own device is the inability to audit security critical code. As a user, the only security guarantee you get is "trust us we are Vendor123" which means nothing.
olliej 5y ago
The security of the system is entirely because this key material cannot be extracted. I don't know how Samsungs trust zone implementation works, but the Apple secure elements (Ax,Mx,and T2 coprocessor) burn fuses randomly inside the SoC on first power up. Those fuses are used to further encrypt everything down the line from that. There are APIs on macOS+iOS to create asymmetric keys where the private key is handled by the secure element and cannot ever be extracted. Encryption (or signing) using those keys is performed by the coprocessor. This is the model you want from any "hardware wallet" you might have, and is the model you want to actually secure your data.
matheusmoreira 5y ago
These companies think we are the ememy they must secure their devices against. Users having total control offends these corporations because we become too powerful and subversive. What are their little copyrights when we can read and copy everything? What are their little monopolies when we can customize, side load, debug, reverse engineer?

I personally don't like how it's possible to store data on my device without me being able to access the data. Also most of the time these keys are used for DRM. So... good IMO.

jesprenj 5y ago

Exactly my first thoughts. Key is derived from "user-controlled data". That makes sense, it's my phone, isn't it? Why would the phone need to encrypt data in a way that the user can't access it.

ZiiS 5y ago
The user positive use is securely booting to a password prompt to decrypt your data. Without this security working, anyone who steals your phone will be able to get all the data you have saved on it.
- d-gearloose 5y ago
  That's kind of the thing with Microsoft's bitlocker as well. It automatically decrypts the hard drive on boot, so the only thing it could protect you from is someone removing the hard drive and mounting it somewhere else. But if they have physical access to the device, why would they do that?
  - dwattttt 5y ago
    That's the default configuration for bitlocker, but there are others, including requiring a password or key provided by USB on startup
  - vladvasiliu 5y ago
    I think the idea is that Windows' security, once booted, is enough to protect your data. It's the same situation if, for example, your laptop gets stolen while in sleep / on the lock screen. In theory, you shouldn't be able to get the key while booting on some other media (say, your own Windows USB drive). > Ensuring the integrity of early boot components and boot configuration data. On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to make data accessible only if the computer’s BIOS firmware code and configuration, original boot sequence, boot components, and BCD configuration all appear unaltered and the encrypted disk is located in the original computer. On systems that leverage TPM PCR[7], BCD setting changes deemed safe are permitted to improve usability. https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures https://docs.microsoft.com/en-us/windows/security/informatio...
  - sissjdb 5y ago
    Physical access does not imply easy arbitrary code execution. Consoles are largely protected by the same technology, how often do you see people achieving code execution on them by tampering with the hardware?
    - roblabla 5y ago
      All the time? Hardmods have been a thing since the first consoles, all the way down to the latest Nintendo Switch. Also, consoles are "protecting" not the user, but the manufacturer - which is exactly the point people are trying to make.
      - sissjdb 5y ago
        Haha. You’re bringing up tech from 20 years ago when we’re discussing modern security measures, aren’t you very clever. What hardmods do you know of for current gen consoles? Even the previous generation mostly fixed all public hardware based attacks. This is standardized hardware that would be a relatively soft target to build tooling against, yet modchips are essentially dead because the attacks are just far too difficult.
        llbbdd 5y ago
        This is pretty confusing, hardmods are definitely a thing for the current gen Switch - AFAIK it's the only way to jailbreak ones that were manufactured after some date and don't allow soft mods.
        sissjdb 5y ago
        Nintendo famously has the worst security of all the console manufacturers. That there are still no good attacks for the xbox one speaks volumes.
    - nest0r 5y ago
olliej 5y ago
No, what you want is a random key. The security properties of an n-bit key depend entirely on those n-bits being random. Derived from user data is not (A CSRNG is not secure if the initial state is predictable). The way security on modern devices with h/w support work is that a random key is generated in hardware. Subkeys are derived from that. Access to these keys (if they're ever directly exposed) is gated on the correct password, but nothing is actually protected by it. This is what you want as it means you don't have to make a password that is maybe 50 characters long, and actually random (e.g. no word sets).

octoberfranklin 5y ago

I have some bad news for you: that's possible with just about every computer introduced since 2013. Google "Intel Management Engine" or "AMD PSP" or "ARM TrustZone". The last of these could, in theory, be less bad, except no ARM licensee except Rockchip (and maybe Apple -- jury is still out there) has chosen the "be less bad" option.

fastball 5y ago
I'd say this is more in-line with Intel SGX than Intel ME.
- anonymousDan 5y ago
  SGX is implemented on top of ME and relies on it for a substantial fraction of its functionality. You are right though that trustzone and sgx are both TEEs.
  - namibj 5y ago
    I wish especially AMD would offer Java Card support through their PSP to the operating system, at least if the PSP is resistant to MMIO attacks on the integrity of the Java Card memory. Being able to open a Diffie-Hellman encrypted, mutual-signature-authenticated channel to a remote device to then receive an AES key for disk encryption is far better than some TPM header that can easily be sniffed with physical access. Would be even better if NVMe SSDs were able to authenticate themselves and let you transfer in a key over a DIffie-Hellman channel so sniffing the PCIe bus wouldn't deliver the key (or a non-PFS-encrypted encapsulated form of it) to an attacker. The speeds of NVMe SSDs unfortunately prevent LUKS from being cheap, and TCG Opal is kind of a joke from a security standpoint (doesn't even (seem to) specify that the provided "password" is used to derive a key, suggesting that it may just be used via a password hash to compare against a database entry to decide whether to unlock a disk encryption key). Even TPMs don't seem to encrypt the communications channel they use with the CPU/PSP, and they are often socketed which makes MITM attacks easy with physical access. If they'd offer Java Card, they'd at least be somewhat useful...
5y ago

dhx 5y ago

A particular example of why it's bad that you can't access all the data on your own device is the inability to audit security critical code. As a user, the only security guarantee you get is "trust us we are Vendor123" which means nothing.

olliej 5y ago

The security of the system is entirely because this key material cannot be extracted. I don't know how Samsungs trust zone implementation works, but the Apple secure elements (Ax,Mx,and T2 coprocessor) burn fuses randomly inside the SoC on first power up. Those fuses are used to further encrypt everything down the line from that. There are APIs on macOS+iOS to create asymmetric keys where the private key is handled by the secure element and cannot ever be extracted. Encryption (or signing) using those keys is performed by the coprocessor. This is the model you want from any "hardware wallet" you might have, and is the model you want to actually secure your data.

matheusmoreira 5y ago

These companies think we are the ememy they must secure their devices against. Users having total control offends these corporations because we become too powerful and subversive. What are their little copyrights when we can read and copy everything? What are their little monopolies when we can customize, side load, debug, reverse engineer?