Re:Security Breach Forces RSA to Offer to Replace SecurIDs
by rlpb on Monday June 06, 2011 @10:20PM
(#2627644)
It does seem a bit weak to be relying on a system based on shared secrets nowadays. USB keys/smartcards that can do RSA aren't particularly expensive. The key can be generated on the devices themselves, so there would be no single database to compromise since nothing else would need to hold a copy of the private key.
[ Parent
| on HN ]
Re:Security Breach Forces RSA to Offer to Replace SecurIDs
by brown9-2 on Monday June 06, 2011 @10:56PM
(#2627715)
I'm not sure if I understand how this would work, and I'm curious - I believe the majority of SecurID tokens are used as a part of two-factor authentication to further prove you have the credentials you state you do, in concert with a password - how would device-generated keys work for this?
Re:Security Breach Forces RSA to Offer to Replace SecurIDs
by rlpb on Tuesday June 07, 2011 @07:01AM
(#2628623)
See for example http://ftsafe.com/products/ePass1000.html. The device uses its own random number generator to create an RSA keypair. The private key never leaves the device. The public key will leave the device and be available for checking on the authentication server (usually by being signed and that signature checked on the authentication server).
When authentication is required, the server sends a challenge to the device ("sign this"). The device signs it with its private key, which no other device can do.
This way it's impossible for a single point of failure to compromise the entire system during operation, like it has here with SecureID. The authentication server might be compromised, but that could happen in any system and it would only need that server to be rebuilt.
There are attacks against this system too of course - for example the RNG could be compromised on the devices themselves, or there could be an attack allowing the extraction of a private key due to a design flaw. But the single point of failure as in this case doesn't exist.