Disk Encryption with a Smart Token

1
Disk Encryption with a Smart Token

• Muhammad Zia Hydari
• Ashwin Krishnamurthy
• Alexander Yip
• Sophia Yuditskaya

2
Outline

• Background
• Architecture
• Proposed Protocols
• Our Recommendation
• Conclusions
• Questions

3
Background

• Confidential Data
• Encrypt each file with password
• Too many passwords
• Encrypt disks with login password
• Laptops can be stolen, exposing data!
• Existing solutions are cumbersome

4
Architecture

• Computer SmartToken
• Bidirectional wireless communication, with short
  range
• Token has some computational power, has secret
  key info

5
Design Goals

• Secure Communication Channel
• Modified Diffie-Hellman tested, widely
  accepted, forward secrecy
• Authentication
• Modified Diffie-Hellman
• Encryption Decryption
• Where does this take place?

6
Proposed Protocols
Encrypt/Decrypt Holds K

• Where does decryption take place?
• One option at the computer
• Modified Diffie-Hellman negotiation
• Secret key travels to computer, stored in
  protected memory
• Secret seed randomly chosen and agreed upon by
  both parties at negotiation
• Token broadcasts sequence of random number
• Computer decrypts as long as it hears correct
  random number

7
How good is this scheme?

• Benefits
• Efficient communication
• Computationally efficient
• Protected against eavesdropping
• Potential Drawbacks
• Key is stored on the computer potential for key
  recovery

8
Another Idea
Encrypt/Decrypt Holds K

• Decryption occurs on the token
• Modified Diffie-Hellman negotiation
• Decryption/Encryption requests travel to token
  for processing
• Results are returned to the computer

9
Any Improvement?

• Benefits
• Key never leaves the SmartToken
• Somewhat less potential for key recovery
• Drawbacks
• Computationally intensive
• Too much for the token?

10
Recommendation

• Decryption at the computer
• Resolve problems with repeater attacks
• Quantum crypto
• Irreproducible radio transmission
• Resolve issue of key storage

11
Conclusion

• Proposed Compared two potential solutions
• Encryption on Computer
• Encryption on Token
• Depends on wireless communication, token
  processing power
• Lay ground for future research evaluation