From: Suresh Ponnusami (suryansecure.net)
Date: Wed Jan 14 2004 - 03:00:22 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----- Original Message -----
From: "lsi" <stuartcyberdelix.net>
| Just a thought:
|
| Whilst reading some compiler documentation the point was made that
| "The Intel x86 chips offer eight 32-bit registers, while the x87
| numeric coprocessor sports another eight 80-bit floating point
| registers.".

This feature depends on the processor architecture and the operating
system used. If the registers are not used or reserved, but still
accessible,
this can be done.

| Some of these registers are used internally. But maybe at least one
| of them is available to store up to 80 bits of crypto key, in a
| location that is not coredumped or swapfiled?
|
| Multiple registers could be combined to store a larger keysize.
|
| Previous discussion has commented that storing a key for programmatic
| access is unavoidably insecure. While storing keys in registers on
| the CPU itself does not rectify the problem, it might potentially
| reduce the number of avenues of attack available.

In the case of available hibernation options, complete registers, process
status along with the memory is dumped to the file.
I have some questions:
 => where will the key kept initially?.
Is it created dynamically and stored only in the register?.
In that case the program can be reverse engineered and the keygen function
can be used. if not using a function then how secure is the option to hold
the
key?.

If it is secure, then there is no need for storing the key in the memory.
May
be just for speeding up of the operation, it can be kept in a *x register.

Also the crypto process has to be a part of the kernel directly and if not,
it
has to be kept running always to prevent process swap creation and dump
files. And the option of using an undocumented or unused register might
be tough because of upward compatibility. Operating system has to be
considered too because if it uses the register to which we are storing the
key and the documentation does not contain information like in Window$.

my 2 cents.
regards,
Suresh Ponnusami.
---------------------------
* Do you know that No word in the English language rhymes with "MONTH" ?

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]