Secure yourself, Part 1: Air-gapped computer, GPG and smartcards • Hacker News Board

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#51

Post by AlyssaRowan » Sat, May 16, 2015, 10:20 AM UTC

mrsteveman1 wrote: post #34

Torgo wrote: post #3

How easy is it for somebody to get your PGP key off a yubikey if they stole it? In particular since physical devices can be fuzzed, etc, it might be worse than an encrypted keychain on device for some people?

The Yubikey NEO used the NXP a700x microcontroller family the last I checked (NEO-n might as well but I'm not sure). You can read about the security features of the chip at NXP's website[1] to get a sense for what they're designed to defend against, but despite the very real possibility of a successful key retrieval attack on the card, in general it would be MUCH easier for an attacker to obtain your on-disk keychain…

Smart cards/hardware tokens try to not make themselves easy targets, and many such microcontrollers have attempts (of varying success) to defend against limited degrees of physical access and make attacks evident. But in any case, given sufficient time and resources, the attacker will always win.

Bottom line: It depends largely on who stole it and for how long - however, if someone knew enough to target stealing your hardware token/smart card, you are under targeted attack and your key's probably toast: revoke it.

I would also gently caution that the elliptic curve routines provided by NXP should not be used over special prime fields (elliptic curves that are fast in software, i.e. just about everything except Brainpool) as they abuse the large (RSA) multiplier whose side-channel blinding was not designed for non-random fields. (Unless they've rewritten it since I last saw it?)

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#52

Post by viccuad » Sat, May 16, 2015, 1:30 PM UTC

philip1209 wrote: post #28

I would enjoy a "pragmatic security" article about how individuals could adopt enterprise-standard security without too much technical knowledge or additional hardware. This could target freelancers or travelers, but I think that there are a lot of engineers who want to secure their personal laptop in a manner similar to their company laptop. Some ideas: * Disk encryption * Always-on VPNs, like Cloak * Encrypting DNS…

author here: that's what I'm intending with this blog post series more or less; after 4 or 5 submissions I should be fairly close to that.

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#53

Post by viccuad » Sat, May 16, 2015, 1:32 PM UTC

task_queue wrote: post #16

The airgapped computer loads propriety Chinese blobs to boot and is pulling it's encryption software over the network via HTTP.

author here: No, I'm using no blobs; just the mainline Kernel and U-Boot. All the software stack is leveraged on Debian.

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#54

Post by viccuad » Sat, May 16, 2015, 1:38 PM UTC

an6n wrote: post #5

When's the Part 2 gonna be published? Will there be a blog post about using gpg-agent as a ssh-agent? :) BTW, Androids openkeychain supports fully yubikey neo, this is a great addition to using the pass(1) on from mobile with yubikey neo. https://github.com/zeapo/Android-Password-Store http://www.openkeychain.org/

author here: All of that should be on Part 2, in a week or so.

Part 2 will cover emails (Thunderbird, mutt), pass as a password store, setting up OpenKeychain + a Yubikey Neo on an Android phone, K-9 Mail on Android, Yubico authenticator for Android as a 2-step auth, ssh, and Keybase. Future parts would cover hdd encryption via LUKS, authentication for sudo and more, GPG by NFC on your desktop, GPG intents to open doors, etc.

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#55

Post by viccuad » Sat, May 16, 2015, 1:43 PM UTC

tagawa wrote: post #43

I'd like to be notified of subsequent parts but the atom feed is broken: http://viccuad.me/atom.xml Fix please?

Author here: oh god, nice catch. will fix it :)

edit: fixed

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#56

Post by viccuad » Sat, May 16, 2015, 1:55 PM UTC

listic wrote: post #18

Doesn't Allwinner board require blobs to boot?

Author here: No. I'm just using the mainline Kernel with Simple Framebuffer support, and U-Boot. U-Boot does the booting, yet there is firmware on the Soc for the first stage booting.

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#57

Post by viccuad » Sat, May 16, 2015, 2:21 PM UTC

herbig wrote: post #35

Fix your RSS so feedly can find your most recent posts.

author here: fixed!

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#58

Post by viccuad » Sat, May 16, 2015, 2:25 PM UTC

jmgrosen wrote: post #13

I'm a little worried about generating a new "master" RSA key nowadays, since it seems like ECC is right on the horizon of going mainstream. I would generate a new Ed25519 key today with GPG 2.1, but Curve25519 encryption isn't supported yet (only signing is). Does anyone else have the same feeling of apprehension?

going full ECC now will isolate you: a lot of people don't use gpg 2.1. Additionally, a lot of people are reluctant to use ECDSA, and would only use EdDSA.

I honestly think RSA is a good decision for now.

You can always add subkeys of any type (your primary key is the core of your certificate and is your cryptographic identity though).

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#59

Post by darklajid » Sun, May 17, 2015, 9:24 AM UTC

burke wrote: post #45

rmac wrote: post #9

Earlier quoted context omitted.

Can you elaborate on 'authentication time made it totally impractical' ? Does this mean it was slow? I'm using gpg-agent on osx with a neo-n to ssh into boxes and it's not noticeably slow.

Thinking on this again now, perhaps using a shorter key (I'm sure I would have chosen 4k RSA) would have helped. Regardless, I did find that connecting to 50+ hosts at the same time, most of them would hit my 3 second connect timeout with the neo-n and gpg-agent. This is a somewhat unusual use-case, I will grant, but I also found a somewhat-noticeable delay in connecting to a single server, on the order of several hu…

I might be mistaken, but I think Yubikeys only support 2k keys? I'm reasonably sure mine does anyway.

Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards

#60

Post by tikums » Sun, May 17, 2015, 2:43 PM UTC

walterbell wrote: post #29

Here's a 2014 paper from Qubes, http://www.invisiblethingslab.com/resources/2014/Software_co... "Many people believe the Holy Grail of secure isolation is to use two or more physically separate machines. This belief seems so natural, that we often don't give it much thought. After all, what better isolation could we possible get than physical "airgap"? I would like to discuss two exemplary scenarios involving isolati…

There's no contest between physical vs. virtual isolation. Theo de Raadt and @thegrugq are right when they're saying you shouldn't put much trust in virtualisation-as-isolation model. Just look at the recent VENOM bug.