4 ms·
> They would have to store that key in plain-text somewhere. Is this really true? Could not the device manufacturer store embed the key in silicon somehow, per
by smegel 14y ago
> They would have to store that key in plain-text somewhere.
Is this really true? Could not the device manufacturer store embed the key in silicon somehow, perhaps in EEPROM or similar?
- digeridoo 14y agoHonestly, that never happens.
- dfox 14y agoEver it that would happen it would not help in this situation anyway. The application simply needs to be able to access that data. We had built some devices that did encrypt they local stores and used keys burned into separate silicon (really, keys derived from multistep mutual authentication with that silicon), but the attack model was that attacker would not possess both parts of device at once (as the key-containing part was able to be located in different part of the building from rest of the device, was reasonably tamper-proof and detected movement).
- jrockway 14y agoYes, they could use the TPM/Secure Element, but that really only protects against attacks where the memory is removed from the device and the device is lost. (Unless you want to require the user to enter a PIN each time they want a password; then a hardware-based solution provides reasonable security.)