Proposal: Personal Data Encryption (maybe SoC?)

[Henryk Plötz]

Moin,

Am Sun, 18 Mar 2007 22:15:57 +0000 (UTC) schrieb Tobias Gruetzmacher:

> If it is possible to store another secret using the PIN2, you could 
> implement "private" records (as Joe Pfeiffer suggested) using the
> PIN2. But if we are talking about about generic encryption of user
> data, maybe a simple public/private flag like in PalmOS would be
> enough (just to hide private data from a shoulder surfer)

Unfortunately you can't use the PIN2, because it already has other
uses. E.g. in prepaid card systems the PIN2 is used to recharge the
card. Also the fixed dialling numbers file is only writable with PIN2.
It would not be uncommon that the phone user doesn't actually know the
PIN2 (e.g. parents buying card for their children, giving them the PIN
but not the PIN2; or even employer/employee for that matter).

Plus: You can't create new files with your own access permissions
anyways. File creation is a messy area in the whole smartcard world
and almost always depends on manufacturer specific commands.

> If I read http://gsho.thur.de/gsho/technik/download/gsm11-11.pdf 
> correctly (I just read some parts, sorry if I get something wrong),
> each "file" on the SIM card can be locked with either the PIN, the
> PIN2 or by the Administrator (the one who gave you the SIM, your
> network operator), so you could certainly use the SIM as a key
> storage...

A thanks for the link. Unfortunately that documents negates my hope:
The cryptographic command is RUN GSM ALGORITHM with CLA=A0 INS=88. 
AT+CSIM won't accept commands with CLA=A0 and AT+CRSM only accepts a
selected few INS and 88 is not one of them.

This pretty much only allows using the SIM as 'dumb' key storage
(albeit with PIN protection with retry counter). The key could be
stored in a specially formatted SMS on the SIM or in a phone book
entry.

-- 
Henryk Plötz
Grüße aus Berlin
~ Help Microsoft fight software piracy: Give Linux to a friend today! ~