Re: Re: Encryption keys aren't safe on servers, report warns

[Alan Olsen <alan@clueserver.org>]

On Mon, 10 Jan 2000, Sunder wrote:

> 
> Adam Shostack wrote:
> > 
> > In their talk at FC99, Nicko and Adi Shamir proposed a couple of
> > methods, prime among them being to attack a hosting site that uses
> > 'virtual secure hosting' or 'secure virtual hosting' by putting a CGI
> > of your design on the site.  (Note the first name is more accurate.)
> > 
> > They also elegantly showed that you need know nothing about the design
> > of the server, just be able to access its memory.
> > 
> > I am curious if theres a reason this is getting all this press now;
> > the result is close to 10 months old.
> 
> Solution:  Store the keys in the server with redundancy to prevent this sort of
> attack and turn them into 'keys' only before you pass them to your cyphers.
> 
> Store them as text strings spelling out words: "One, five, three, nine, four"
> or whatever scheme.  These will be less random, but of course the attacker can
> adapt his algorithm to specifically look for strings of that nature, etc. :)

Or you can just have all sorts of bogus random data lying around looking
like keys.

Of course, this is security by obscurity, but if they have already hacked
your server to get this far, you are already in deep shit.

alan@ctrl-alt-del.com | Note to AOL users: for a quick shortcut to reply
Alan Olsen            | to my mail, just hit the ctrl, alt and del keys.
    "In the future, everything will have its 15 minutes of blame."