Proposal: Personal Data Encryption (maybe SoC?)

Henryk Plötz henryk at
Sun Mar 18 18:24:31 CET 2007


Am Sat, 17 Mar 2007 10:51:31 +0000 (UTC) schrieb Tobias Gruetzmacher:

> What I'm proposing is a user-friendly encryption scheme of the data
> the user stores in his phone, so any illegitimate user will not be
> able to get personal data about the owner of the phone.

I was thinking about something similar but with a different direction.
One problem I see is that a thief could just connect a debug board and
dump the complete memory. Therefore any secret positively must not be
stored in the phone but instead in a smartcard for example.

> 2. "SIM-binding" - this retrieves/stores a secret on the SIM card,
> that can only be accessed when the correct PIN for the SIM was
> entered. The secret is retrieved from the SIM card and used as a key
> for encfs/ ecryptfs to decrypt the users data

I was thinking in that direction. I'm not familiar with SIMs (pretty
much experience with other smartcards, though), so: The SIM has some
sort of cryptographic function to authenticate itself to the network
and assist in the setup of session keys. Can we use this functionality?
E.g.: is it standardized enough so that we can expect it to be found in
any SIM and can we access it through AT+CSIM and/or AT+CRSM (Harald
told me about these commands which allow some level of passtrhough
through the GSM modem to the SIM) or any other mechanism? 

If so we could use this function to key the encryption without actually
extracting the secret from the SIM (I vaguely remember reading
something about "remotely keyed encryption" which could be used here).
An attacker dumping the memory would gain only those decrypted blocks
that were currently in use and nothing more.

The alternative approach of storing and retrieving the secret (e.g. as
an address book entry) has the significant drawback that the secret
must always be present in the phone's memory and can potentially be
read from there.

Henryk Plötz
Grüße aus Berlin
~ Help Microsoft fight software piracy: Give Linux to a friend today! ~

More information about the community mailing list