(no subject)

[tgies]

Cipher employed by popular KeeLoq keyless entry system broken; crypto researchers to Microchip: "You're ass got wrecked like fuc"

Comments

[flamingspinach.livejournal.com]

The new research follows by a few months the cracking of encryption in the widely used Mifare Classic smartcard, which is used around the world to control access subways, military installations and other restricted areas. In both cases, the companies relied on proprietary algorithms that ultimately were found to produce cryptographically weak output.

Why do people do this.

[tgies.livejournal.com]

Hell if I know. We have decent crypto in the public domain, so I don't know why everyone insists on designing their own incompetent shit. I think the Blu-Ray people or somebody actually opened up part of their algorithm at some point and offered a bounty on any weaknesses discovered.

[korgmeister.livejournal.com]

every key is derived from a master key that's stored in the reading device

I'm no crypto expert or anything but that's DOIN' IT WRONG!

I remember reading once that there's two ways to keep stuff secure if it's key based. Either have a really fucking strong algorithm (the 'Enigma' approach, if you know your history, that didn't work so well for the Nazis) or keep the keys very, very safe (a much better idea). Putting the master key on every fucking device is just Asking For It.

[tgies.livejournal.com]

A lot of these algorithms involve somehow storing a master key. All the HD-DVD players in the world, for instance, know the content decryption keys, and it's only a matter of digging them out. This gets even easier when one then tries to implement the player in software — that's how these keys are discovered, more often than not.