5 ms·

Hurray for Java applets. But seriously, there is a sunny side to this story: a user could load her own programs onto her SIM. She could gretaly extend the fun

by jingo 13y ago

Hurray for Java applets. But seriously, there is a sunny side to this story: a user could load her own programs onto her SIM. She could gretaly extend the functionality of her phone... with programs that she trusts. Maybe even ones she wrote herself. Imagine... an open platform. Oh gosh, that would be terrible, wouldn't it? Otherwise this story highlights the concept of "minimum viable product" not in the startup world, but as it exists among major industry manufacturers. For example, if SIM manufacturers can get away with using DES, then why invest their time and money in using stronger crypto? There are so many examples of this type of thinking... it's certainly not limited to imlementations of cryptography or SIM cards. No doubt, some would say this is simply Business 101... ask any used car salesman. But it's particularly acute in hardware and software. Do hardware and software worlds makers need higher standards and more serious "quality control"? Beyond the cosmetic appearance of their work, no. Because users are generally indifferent to all else. What they don't know won't hurt them. Did you know you can type encrypted messages directly with a text editor called ed(1)? How cool is that? It's so easy. Who needs PGP? It uses DES, but hey, DES is good enough for SIM cards, so...

Genmutant 13y ago
How would you extend the functionality? Programming in JavaCard is really not fun (my opinion) and the space and processing power are really limited. The biggest use of it is verifying information (like pins or certificates), but what else would you do that your phone can't?
- jingo 13y ago
  Consider that some might not program for "fun". They might do it out of necessity: to "scratch itches". Limitation breeds creativity. This is true in general, but certainly in computers. Ever heard of demoscene? By comparison to the constraints we had to work with in the 80's, the power of today's handheld computers (one usage of which is as a "phone") is hardly a limitation. But I guess it would depend on what you are trying to do. I have no idea what you would want to do. Only you know that. As for what others might do, were they to be able to upload their own software to their phones, well, the only way to answer that question is to let them and see what comes out of it. Only a fool would believe he could direct, let alone predict, all the uses that might be made of a particular software program, a particular language or a particular computer. One use of a computer is as a communications device, aka a "phone". Another is a "game console". There are plenty of other uses for handheld computers even if you yourself cannot think of them.
  - Genmutant 13y ago
    But you can already upload your software to phones. You don't need the simcard for that.
    - jingo 13y ago
      I thought we were talking about SIM cards. Can I upload software to my SIM card? No. Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.). Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card? The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone. This is like buying a computer that has a special card slot owned by a single company or a consortium of companies that produce special cards only for their own use. The user is effectively denied access to the slot.
      - pjmlp 13y ago
        Do you program your PC BIOS or firmware?
        nitrogen 13y ago
        http://www.coreboot.org http://www.coreboot.org
        pjmlp 13y ago
        How many PCs ship with it?
        jingo 13y ago
        Usually, whatever software PC's "ship with" is crapware. Go figure. "Crapware" is just my opinion. Although I've heard others note the same thing.
        nitrogen 13y ago
- Torgo 13y ago
  I would like to be able to take an older smartphone and use it as a smartcard-like device but with a full-fledged computer on it. For example, being able to use a Motorola Droid with a USB cable as a password manager. Keep the key secured on the SIM card. Use the touchscreen to enter the unlock password, and choose a password off a list. Send the password to a computer over USB by emulating a keyboard, or a custom driver that creates a secure channel to a specific app for authentication.
  - greenmountin 13y ago
    Sounds like a lot of work. I don't trust LastPass et al., and really just need a single encrypted password file. My method doesn't provide a driver secure channel, but it is achievable today. 1) Buy a slim ipod touch 2) Jailbreak (unnecessary) 3) App CryptMe allows transfer of plaintext from your computer through iTunes, password unlock on the device, quick search (nice), and according to Firewall iP (Cydia program) doesn't connect to the internet (or you could just always keep wifi off).
  - Spooky23 13y ago
    Look at the OpenPGP card. You can get a smartcard reader with a PIN-entry pad for like $50, and boom, you have a secure certificate store with GPG. GPG isn't pretty, and support lags with OS X releases but you can do alot with it. I've been using this methodology for securing cloud backups for several years. Using tools like Duplicity, you can safely encrypt data on potentially untrusted devices or networks using a public key, and keep the private key safely stored somewhere on the smartcard. The downsides to these sorts of approaches is that encrypting data is easy, key management for decrypting it is a pain.
mje__ 13y ago
I don't think this is a reasonable assessment at all. SIM manufacturers use 3DES, not DES, which - while not recommended for new systems - is still pretty damn secure. I don't think you've really understood the complexity of the SIM - there are literally thousands and thousands of pages of specification, which means that any sim will interoperate with any phone. A SIM is not an "MVP" by any stretch of the imagination - it costs millions of dollars to enter the market; there are stringent security and compatibility controls, and no-one will consider selling you silicon unless you're ordering millions of units per year.
- jingo 13y ago
  You're right. DES repeated thrice is better than DES. But I wonder why 3DES is not recommended for new systems? Hmmm.... You're wrong on the SIM as an MVP idea. I guess I'm not communicating clearly enough. What I mean is the computer ("phone") itself, of which the smart card subsystem (e.g. SIM card system) is a part, is of inferior quality. This is only my opinion. I understand there are barriers to entry in place. But how does that relate to low quality, minimally viable products? I'll let you or someone else answer that. Maybe we need to remove the barriers, lower the cost of entry and lower the complexity (simplify)? No, those sound like ignoble pursuits.
  - rdl 13y ago
    Not recommended for new systems: Mostly because it's slow (vs. AES), and 3DES is effectively 112 bits, which is a bit weaker than you'd want for a new system deployed today (which might be in service for...20-30 years?) I don't know of any attacks on DES better than brute force and on 3DES better than brute force w/ meet-in-the-middle.
    - KMag 13y ago
      The 64-bit block length is more of a problem than the 112-bit key length. For instance, if 3DES were used in OFB mode, one would expect on average to have a unique 64 GB keystream before entering a repeating 32 GB keystream. If the attacker is able to choose the data being encrypted, CFB could have similar limitations. With CBC mode, you'd expect only 32 GB of encrypted data before you got your first self-collision in ciphertext. CTR mode with perfectly random IVs does much better, at 64 exabytes. Even 64 EB isn't as big as it used to be, especially for a key that can't be changed. For many uses, you'd much rather have an ideal block cipher with a 128-bit block and 112-bit keys than an ideal block cipher with a 64-bit block and 512-bit keys.

by jingo 13y ago

Genmutant 13y ago

How would you extend the functionality? Programming in JavaCard is really not fun (my opinion) and the space and processing power are really limited. The biggest use of it is verifying information (like pins or certificates), but what else would you do that your phone can't?

jingo 13y ago
Consider that some might not program for "fun". They might do it out of necessity: to "scratch itches". Limitation breeds creativity. This is true in general, but certainly in computers. Ever heard of demoscene? By comparison to the constraints we had to work with in the 80's, the power of today's handheld computers (one usage of which is as a "phone") is hardly a limitation. But I guess it would depend on what you are trying to do. I have no idea what you would want to do. Only you know that. As for what others might do, were they to be able to upload their own software to their phones, well, the only way to answer that question is to let them and see what comes out of it. Only a fool would believe he could direct, let alone predict, all the uses that might be made of a particular software program, a particular language or a particular computer. One use of a computer is as a communications device, aka a "phone". Another is a "game console". There are plenty of other uses for handheld computers even if you yourself cannot think of them.
- Genmutant 13y ago
  But you can already upload your software to phones. You don't need the simcard for that.
  - jingo 13y ago
    I thought we were talking about SIM cards. Can I upload software to my SIM card? No. Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.). Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card? The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone. This is like buying a computer that has a special card slot owned by a single company or a consortium of companies that produce special cards only for their own use. The user is effectively denied access to the slot.
    - pjmlp 13y ago
      Do you program your PC BIOS or firmware?
      - nitrogen 13y ago
        http://www.coreboot.org http://www.coreboot.org
        pjmlp 13y ago
        How many PCs ship with it?
        jingo 13y ago
        Usually, whatever software PC's "ship with" is crapware. Go figure. "Crapware" is just my opinion. Although I've heard others note the same thing.
        nitrogen 13y ago
Torgo 13y ago
I would like to be able to take an older smartphone and use it as a smartcard-like device but with a full-fledged computer on it. For example, being able to use a Motorola Droid with a USB cable as a password manager. Keep the key secured on the SIM card. Use the touchscreen to enter the unlock password, and choose a password off a list. Send the password to a computer over USB by emulating a keyboard, or a custom driver that creates a secure channel to a specific app for authentication.
- greenmountin 13y ago
  Sounds like a lot of work. I don't trust LastPass et al., and really just need a single encrypted password file. My method doesn't provide a driver secure channel, but it is achievable today. 1) Buy a slim ipod touch 2) Jailbreak (unnecessary) 3) App CryptMe allows transfer of plaintext from your computer through iTunes, password unlock on the device, quick search (nice), and according to Firewall iP (Cydia program) doesn't connect to the internet (or you could just always keep wifi off).
- Spooky23 13y ago
  Look at the OpenPGP card. You can get a smartcard reader with a PIN-entry pad for like $50, and boom, you have a secure certificate store with GPG. GPG isn't pretty, and support lags with OS X releases but you can do alot with it. I've been using this methodology for securing cloud backups for several years. Using tools like Duplicity, you can safely encrypt data on potentially untrusted devices or networks using a public key, and keep the private key safely stored somewhere on the smartcard. The downsides to these sorts of approaches is that encrypting data is easy, key management for decrypting it is a pain.

mje__ 13y ago

I don't think this is a reasonable assessment at all. SIM manufacturers use 3DES, not DES, which - while not recommended for new systems - is still pretty damn secure. I don't think you've really understood the complexity of the SIM - there are literally thousands and thousands of pages of specification, which means that any sim will interoperate with any phone. A SIM is not an "MVP" by any stretch of the imagination - it costs millions of dollars to enter the market; there are stringent security and compatibility controls, and no-one will consider selling you silicon unless you're ordering millions of units per year.

jingo 13y ago
You're right. DES repeated thrice is better than DES. But I wonder why 3DES is not recommended for new systems? Hmmm.... You're wrong on the SIM as an MVP idea. I guess I'm not communicating clearly enough. What I mean is the computer ("phone") itself, of which the smart card subsystem (e.g. SIM card system) is a part, is of inferior quality. This is only my opinion. I understand there are barriers to entry in place. But how does that relate to low quality, minimally viable products? I'll let you or someone else answer that. Maybe we need to remove the barriers, lower the cost of entry and lower the complexity (simplify)? No, those sound like ignoble pursuits.
- rdl 13y ago
  Not recommended for new systems: Mostly because it's slow (vs. AES), and 3DES is effectively 112 bits, which is a bit weaker than you'd want for a new system deployed today (which might be in service for...20-30 years?) I don't know of any attacks on DES better than brute force and on 3DES better than brute force w/ meet-in-the-middle.
  - KMag 13y ago
    The 64-bit block length is more of a problem than the 112-bit key length. For instance, if 3DES were used in OFB mode, one would expect on average to have a unique 64 GB keystream before entering a repeating 32 GB keystream. If the attacker is able to choose the data being encrypted, CFB could have similar limitations. With CBC mode, you'd expect only 32 GB of encrypted data before you got your first self-collision in ciphertext. CTR mode with perfectly random IVs does much better, at 64 exabytes. Even 64 EB isn't as big as it used to be, especially for a key that can't be changed. For many uses, you'd much rather have an ideal block cipher with a 128-bit block and 112-bit keys than an ideal block cipher with a 64-bit block and 512-bit keys.