#and a cryptoprocessor

[paymentsclarity1]

Integrating A Crypto Payment Processor For Business

Say hello to the future of payments with Payment Clarity! We are a top choice for businesses looking for a Crypto Payment Processor For Business. Our platform provides seamless and secure crypto transactions, ensuring you stay competitive in a digital-first world. Let’s make digital payments simple and secure!

[andmaybegayer]

Also I mean I can totally make a case for many dramatic changes in individual human life driven by recent technology, but I think it's the wrong way to look at it. That said, it's novel that I could use my phone as a personal cryptoprocessor to get a fully functional bank card from an internet neobank within two days of entering a country with probably less risk of fraud than trying to do the same thing in 1970. That's almost certainly way more important to some other kinds of people than it was to me.

[govindhtech]

TPM: A Guide to Understanding Your Computer’s Security Chip

What is Trusted Platform Module (TPM) A Trusted Platform Module (TPM) is a secure cryptoprocessor chip on your computer’s motherboard.

First Contact TPM for Windows The BitLocker drive encryption, the Virtual Smart Card features, and the Crypto Provider are among the security components of the Microsoft Windows operating system that depend on TPM-based capabilities. In fact, Trusted Platform Module 2.0 needs to be activated in ALL desktop and server variants of Windows 10 and 11. By using remote attestation in conjunction with the system’s Trusted Platform Module to allow Measured Boot, the configuration of the system is protected from undetectable threats like rootkits.

On Intel’s Windows machine, Intel can quickly verify some Trusted Platform Module details by navigating to the Security Devices area of the Device Manager screen.

TPM details by navigating to the Security Devices area of the Device Manager screen.

Now let’s engage with it. Now that a terminal window is open, let’s extract some basic system data. There are numerous powershell cmdlets available in Windows that can be used right away.

Get-Tpm retrieves the following data from the module:

Intel can also use this information to deduce some details about the underlying system: For instance, if the platform is equipped with and employing Platform Trust Technologies (PTT), “Intel” will appear in the manufacturer section here. Here, a Trusted Platform Module from the company STM is being used.

Intel must communicate with Windows Core Security features, namely the Trusted Platform Module Base Services software component and related API, in order to utilise the Trusted Platform Module from an application standpoint. Microsoft offers tools and wrappers to facilitate the integration of these processes more quickly.

Then intel will begin examining these after that.

Linux-based TPM First Contact Working with keys securely across any TPM 2.0 compatible module is made feasible by a set of standardised commands and libraries that enable the use of TPMs for key loading and storage in Linux.

At a high level, you can check if a TPM is present in the system by running the following command in the system log: dmesg | grep -i tpm.

Here is a step-by-step guide to several fundamental Linux system interactions: Required conditions: Install a TPM 2.0 chip on the target machine. Install TPM 2.0 software. These packages differ per Linux distribution.The tpm2-tools and tpm2-tss packages are popular. Initialise TPM: Initialise the TPM before using it. Initialise the TPM with tpm2 startup. Establish an Application Key: Create a key that is unique to your application and that you wish to keep in the TPM.You can use a software library like OpenSSL or a Trusted Platform Module library like tpm2-tools to generate this key.

The following is one method of generating an RSA keypair: RSA algorithm -out appkey.pem -openssl genpkey

Fill the TPM with the Key: To load your application-specific key into the TPM, use the TPM 2.0 tools. For this, you’ll usually use the tpm2 load command: tpm2 load -C appkey.pub -r appkey.priv -u context.out This command saves the context of the key in the context.out file and loads it into the TPM. This context is necessary for using the key later on. Apply the resident key (TPM): You can use this commands or libraries such as tpm2-tss to execute cryptographic operations on the TPM-resident key when your programme needs to access it. To sign data using the TPM key, for instance, run the following commands: tpm2 sign -c context.out -g sha256 -m data.txt -s signature.bin Using the TPM-resident key, this command signs the data and stores the signature in signature.bin. Unload the Key (Optional): You can use the tpm2 flushcontext command to unload the TPM-resident key if you no longer require it: tpm2 flushcontext -c context.out. This releases the key’s associated TPM resources. Shutdown and Cleanup (Optional): You can use the tpm2 shutdown command to terminate the Trusted Platform Module once your programme has finished utilising it. Analysing TPM 2.0 thoroughly Advancements in Computer Security Trusted Platform Module (TPM) 2.0 hardware boosts computer security. It protects your system and encryption keys as a secure cryptoprocessor. Essential Features: Cryptographic Key Management: TPM 2.0 securely produces, stores, and utilises keys.Data encryption, digital signatures, and secure communication require these keys. TPM 2.0’s hardware isolation makes key theft and tampering much harder than with software-based systems.

Platform Integrity Validation: Trusted Platform Module 2.0 monitors firmware and other critical software. It looks for any unauthorised changes that might point to malware or efforts at tampering. TPM 2.0 can protect your data by stopping the system from booting if something suspect is found.

Platform Attestation: The firmware and software of your system can be reported on using Trusted Platform Module 2.0. Other security measures or reliable organisations can use these reports, known as attestations, to confirm the integrity of the system. This is useful for secure boot environments and for assessing a system’s health prior to allowing access to resources that are sensitive.

Benefits of TPM 2.0: BitLocker Drive TPM 2.0 securely holds encryption keys, strengthening encryption and other functions. This makes data access tougher for unauthorised parties, even if they reach your device.

Enhanced Platform Security: Your system will boot with authentic, unaltered firmware and software thanks to the platform integrity checks. This lessens the chance that malware will compromise your system remotely.

More Robust User Authentication: Trusted Platform Module 2.0 can be paired with Windows Hello and other comparable technologies to provide more reliable two-factor authentication. By requiring a physical factor in addition to a password, like a fingerprint or facial recognition, this strengthens security. TPM 2.0, Win11:

Microsoft says Windows 11 needs Trusted Platform Module 2.0. This shows how crucial hardware-based security capabilities are becoming in the battle against more complex assaults. The good news is that TPM 2.0 functionality is probably pre-installed on the majority of PCs made in the last few years. It may, however, be inactive by default in the BIOS settings.

Beyond the Fundamentals: Flexibility: TPM 2.0 takes a “library” approach, in contrast to its predecessor. This implies that Trusted Platform Module 2.0 features can be selected by manufacturers based on what best meets their device and security requirements. Wider acceptance across multiple platforms from laptops to embedded systems is made possible by this versatility.

Future-Proofing: Expansion is a key design principle of TPM 2.0. As security risks evolve, it supports the installation of new functions and algorithms. This guarantees that Trusted Platform Module 2.0 will continue to be applicable and useful when new security threats arise.

Read more on Govindhtech.com

[andmaybegayer]

RFID can be much more secure cryptographically, because the signal is generated by the cryptoprocessor in the card and includes a unique code for each transaction instead of just being a flat signal like from magnetic, which is why it's usually much less susceptible to replay attacks. Basically if everything is cryptographically correct, you can't double-charge a single transaction (in the case of a skimmer over an existing payment terminal), you'd have to immediately charge your mark, invalidating their intended payment and immediately alerting them, or you can only charge them once (in the event of cloning cards and replaying them to your own terminal later).

This also all applies to chip and pin, much more cryptographically secure. There's a tiny hardened chip running (usually) Javacard in there.

Magnetic skimmers can effectively duplicate the card without giving away any information about where the skimmer is or who operates it, and a skimmed magnetic card can be used to buy $5 Amazon gift cards with impunity. If your magnetic card gets skimmed all you can do is throw your card away.

Also if you use something like Google/Apple/Samsung Pay it's even more cryptographically secure, they're generating entire account numbers to proxy payments through.

Why do chip payments for credit cards still (a) take so much longer than all other versions of the transaction, and (b) do that thing where there are like 5 different versions of "please do not remove your card" that make me react and thing it's done, so I remove my card early?

It's like that thing where the recorded Hold Music interrupts itself every 30 seconds to let you know your call is important, and it means you cannot possibly just tune out and pay attention again when there is a real human voice.

[kaeliri]

My latest project is building a combined travel router-firewall and miniserver. It’s based on PC Engines APU2 (specifically apu2d4) embedded platform running either pfsense or OpenWRT. Turns out that there are fewer and fewer miniPCIe form-factor LTE/5G modems, so I’m experimenting with an m.2 to miniPCIe adapter to see if an m.2 cellular modem could be an option. Physically the adapter just fits!

Notes to self: M.2 and miniPCIe carry both PCIe and USB in the same physical connector. The APU2 mPCIe slots 1 and 2 support PCIe 2.0 and USB 2.0. An LTE modem using USB 3.0 data link must be able to fall back to USB 2.0 gracefully or it won’t work. Aside from improved frequency band support, anything beyond LTE Cat 6 card is wasted unless it uses a PCIe data link. It’s possible that PCIe-based LTE/5G modem can work at full speed; possibly worth experimenting if not too expensive.

[allcrypnews]

Hello, everyone. Welcome to the crypto news updates of the week. Some positive news for Bitcoin holders, some negative news for the rest of the market. I will be talking about Bitcoin first since it is the highest-ranked coin. Crypto News Updates for this week The US Federal Reserve, US Treasury Department, and Federal Deposit Insurance Corporation are planning to release a new set of measures to monitor crypto-assets, Bloomberg reported on Thursday, September 13. According to the article, the institutions are currently working on a report that will provide insight into crypto markets and how the agencies can oversee them. A certain number of crypto exchanges have already agreed to work with US authorities on monitoring their platforms' transactions in order to comply with national security laws. Bloomberg notes that more than 20 exchanges have signed up for this program so far. Recently, South Korea's largest cryptocurrency exchange Bithumb announced that it has joined this initiative as well, but without providing details on what information it is planning to share with US authorities. The official website of Venezuela's Petro (PTR) project has been reportedly hacked by unknown attackers. This week, visitors of petro.gob.ve were redirected towards a fake website asking them to fill out a survey about Venezuelan citizens' cryptocurrency holdings and "misle

[cse6441-blog]

Secure Cryptoprocessors

A secure cryptoprocessor is a dedicated microprocessor for simply cryptographic operations, with multiple physical security measures as a degree of tamper resistance.

Secure cryptoprocessors are used to be the keystone of a security subsystem, thereby eliminating the need for additional security measures.

Smartcards are the most widely deployed form a secure cryptoprocessor. These can be used to several purposes including:

Authentication

Personal Identification

Data Storage

Several comparison leverage this in some form such as Automated Teller Machines (ATMs), TV Set Top Boxes and Military Applications.

Security Features

Tamper-detecting and tamper-evident containment.

Conductive shield layers in the chip that prevent reading of internal signals.

Controlled execution to prevent timing delays from revealing any secret information.

Automatic zeroization of secrets in the event of tampering.

Chain of trust boot-loader which authenticates the operating system before loading it.

Chain of trust operating system which authenticates application software before loading it.

Hardware-based capability registers, implementing a one-way privilege separation model.

Source: https://en.wikipedia.org/wiki/Secure_cryptoprocessor

[public-insecurities]

Homework 3-10: Cryptoprocessors

Finally

Going from ATMs to HSM to now... finally... at the core of it all - cryptoprocessors. It took us a while, but we made it.

What is a cryptoprocessor?

A cryptoprocessor is a processor dedicated to cryptographic operations (as the name suggests). But what does this mean? This means that all the algorithms are done in hardware, since we all know that hardware is faster than software 😏😏😏

Cryptoprocessors are able to accelerate encryption, enhance tamper and intrustion detection, enhance data and key protection, enhance security on memory access and I/O*.

Advantages of cryptoprocessors

Strong IP protection

Better protection of key data compared to simple storage encryption

Offers protection against vulnerability exploits, accomplished by layering software protection on top of hardware

Can be integrated into ASICs and FPGAs

Types of cryptoprocessors

There are several types of cryptoprocessors (thanks Quora.

Smartcards - input program instructions in encrypted form, decrypt the instructions to plain instructions which are then executed within the same cryptoprocessor chip where the decrypted instructions are inaccessibly stored such that the decrypted instructions are never revealed.

Trusted platform module (TPM) - specialized chip on an endpoint device that stores RSA encryption keys specific to the host system for hardware authentication

Hardware security module (HSM) - which is covered more in depth in the previous blogpost.

[shmacktus-blog]

Cryptoprocessors, and hardware security modules

Secure cyrptoprocessors are dedicated microprocessors for carrying out cryptographic operations, they usually have some form of embedding to make any manipulation tamper-evident.

Hardware security modules contain one or more cryptoprocessors.

The trusted platform module is an international standard for a secure cyrptoprocessor

Cryptoprocessors are cool because they don't reveal keys or executable instructions on a bus, their purpose is to act as the keystone of a security sub-system, eliminating the need to protect the rest of the sub-system with physical security measures.

The goal is the cryptoprocessor recieves instructions in an encrypted form, decrypts them inside its perimiter to plain instructions, which it then executes within the perimiter. By never revealing the program instructions it prevents tampering of programs by technicians who may have legitimate access to the bus.

Cryptoprocessors have a number of pretty sweet features that ensure their security: * Tamper evidence * Conductive shield layers that prevent reading of internal signals * Hardware based registers that implement a one-way privilege sepeartion model * Automatically zeros out secrets in the even of tampering. * Chain of trust boot-loader which authenticates the operating system, before loading. * Chain of trust operating system with authenticates software before loading. * Internal battery

It provides you with some cool stuff like a random number generator, the ability to securely generate cryptographic keys, remote attestation which creates a nearly unforgeable hash summary of the hardware, and software configuration. Helping to verify that software has not been changed. We can also use it to ensure platform integrity, enable full disk-encryption and digital rights management.

The most common secure cryptoprocessor you know of is going to be a smart card. A piece of plastic the size of a credit card with an embedded integrated circuit.

How safe are they though? The IBM 4758 was attacked by a team at the University of Cambridge. Who found a flaw in the software loaded by the cryptoprocessor, making all the hardware features redundant!

[tsoyuzhu]

Job Proposal: Analytic

Throughout the semester I have been working on technical challenges and extending my knowledge through videos watching videos. 

Research

I kept an eye out for potential vulnerabilities in everyday scenarios and blogged about them.

Security Everywhere 1

Security Everywhere 2

Security Everywhere 3 

Security Everywhere 4 

Security Everywhere 5 

I conducted research for homework activities and broadened my understanding of course content outside what was provided in lectures: 

The Life Expectancy of a Computer

Some Type 1 and Type 2 Errors

Homework Secure Cryptoprocessors and Hardware

ATM Attacks

Outside of course content, I watched some videos of security talks in order to broaden my technical understanding. In particular:

Weaknesses in assembly code 

Psychological defence against reverse engineers

Reflection

Here are some times where I reflected on cases we studied in class and other things security related. 

Deep Water Horizon Week 1 Reflection Week 4 Case Study Week 4 Human Weakness A Sad Reflection Tutorial 7 Reflection

Application Most of my application of theory came through my something awesome where i tested different implementations of rootkits. You can read about it in my reports below.  Something Awesome Progress Report 1

Something Awesome Progress Report 2

Something Awesome Progress Report 3 

Something Awesome Progress Report 4 

Something Awesome Progress Report 5

Something Awesome Progress Report 6  

Reverse engineering was my other main form of application. I applied my knowledge through crackme challenges through the SecSoc Term 2 CTF reverse engineering challenges which you can read about later.  Crackme 0x03

Ciphers were an easy way to apply theory into practice. Lack of entropy is something which allows us to break defences much faster than brute force. Documented here are times i applied this to substitution ciphers. Unfortunately i did not document my work on transposition ciphers. Solving Jazz’s Cipher 

Mid-semester Exam Practice 

[tenderfootsecurityblog]

Hardware Secure module and Secure cyptoprocessor

A hardware secure module is a physical computing device that safeguards and manages digital keys for strong authentication and provides crypto processing. These are typically a plug-in card / external device that attaches directly to a computer of network server

These also have features that provide tamper evidence such as visible signs of tampering. The vast majority of existing HSMs are mainly to manage secret keys and have a system to securely back up the keys they handle.

Secure cryptoprocessor: 

This is a dedicated computer on a chip carrying out cryptographic operations and has a degree of tamper resistance. This does not output decrypted data onto a bus in a secure environment (recall 1521). The purpose of one of these bad boys is to act as the keystone of a security subsystem. Whats that? It is something that protects the subsystem eliminating the need to protect with physical security measures.

[andmaybegayer]

@arbitrarygreay said:

When you talk about phasing out passwords for passkeys, how does that interact with a situation like not having any of your own devices and needing to log in to a stranger's device? (e.g. for op sec reasons you don't want any interaction with your own devices, or you didn't bring any of your own devices for various reasons, and you want to print something out)

as far as I'm aware you absolutely must have some kind of authenticator to do passkeys/webauthn/fido2, whether that's just a software passkey manager or a phone with a cryptoprocessor or a dedicated hardware encryption key, so you can't cut that out of the loop. Without that you're out of luck. There are ways to backup your key so that you create a new key if you lose one, but you must have it loaded into a compliant authentication device that can do the cryptographic webauthn dance.

You could have fallback login methods (which defeats the purpose somewhat but might be suitable for lower security higher convenience options) or I suppose someone could make a hardware key that allows you to type in your private key every time from memory. Don't do that.

The advantage of passkeys is that even if you're on a compromised machine, a correctly implemented server and authentication device will still be better than the equivalent password situation, in that it's secure for future sessions. The authenticator only responds with the signed form of the challenge from the server which is a nonce and cannot be replayed the way a password can.

Most authenticators require you to physically active the authenticator for each request, so even if the malicious computer tries to use the plugged in authenticator to access your other accounts, it should be stuck waiting for you to confirm forever. You'd completely compromise the session you had here but you wouldn't have to change your password.

If you already have password+2fa codes then you confound an attacker in a similar way, although they will still have your password and access to this one session.

Of course now I'm wondering if you can use noncompliant hardware to induce enough noise over USB to trigger the human presence sensor on some FIDO2 keys. Probably not, they're well hardened. But who knows! Project idea for someone.

can you actually talk about bitwarden / password managers, or direct me to a post about them? Idk my (completely uneducated) instinct says that trusting one application with all your passwords is about as bad as having the same password for everything, but clearly that isn’t the case.

So it is true that online password managers present a big juicy target, and if you have very stringent security requirements you'd be better off with an offline password manager that is not exposed to attack.

However, for most people the alternative is "reusing the same password/closely related password patterns for everything", the risk that one random site gets compromised is much higher than the risk that a highly security focussed password provider gets compromised.

Which is not to say it can't happen, LastPass gets hacked alarmingly often, but most online password managers do their due diligence. I am more willing to stash my passwords with 1Password or Bitwarden or Dashlane than I am to go through the rigamarole of self-managing an array of unique passwords across multiple devices.

Bitwarden and other password managers try to store only an encrypted copy of your password vault, and they take steps to ensure you never ever send them your decryption key. When you want a password, you ask them for your vault, you decrypt it with your key, and now you have a local decrypted copy without ever sending your key to anyone. If you make changes, you make them locally and send back an encrypted updated vault.

As a result, someone who hacks Bitwarden should in the absolute worst case get a pile of encrypted vaults, but without each individuals' decryption key those vaults are useless. They'd still have to go around decrypting each vault one by one. Combining a good encryption algorithm, robust salting, and a decent key, you can easily get a vault to "taking the full lifetime of the universe" levels on security against modern cryptographic attacks.

Now there can be issues with this. Auto-fill can be attacked if you go onto a malicious website, poorly coded managers can leak information or accidentally include logging of passwords when they shouldn't, and obviously you don't know that 1Password isn't backdoored by the CIA/Mossad/Vatican. If these are concerns then you shouldn't trust online password managers, and you should use something where you remain in control of your vault and only ever manually handle your password.

Bitwarden is open source and fairly regularly audited, so you can be somewhat assured that they're not compromised. If you are worried about that, you can use something like KeePassXC/GNU Pass/Himitsu/ (which all hand you the vault file and it's your job to keep track of it and keep it safe) or use clever cryptographic methods (like instead of storing a password you use a secret key to encrypt and hash a reproducible code and use that as your password, e.g. my netflix password could be hash(crypt("netflixkalium", MySecretKey)), I know a few people who use that method.

Now with any luck because Apple is pushing for passkeys (which is just a nice name for a family of cryptographic verification systems that includes FIDO2/Webauthn) we can slowly move away from the nightmare that is passwords altogether with some kind of user friendly public key based verification, but it'll be a few years before that takes off. Seriously the real issue with a password is that with normal implementations every time you want to use it you have to send your ultra secret password over the internet to the verifying party.

[comp6841]

Secure processing & storage

Cryptoprocessors

In a post last week, I discussed some of the issues associated with system integrity and security associated with side channel attacks - you could potentially reverse engineer the keys used in the calculations. This is where cryptoprocessors come in to the equation - basically they are dedicated processors which are utilised when handling encrypted data. The idea is that unlike traditional processors which output decrypted data onto a bus, a cryptoprocessor doesn’t output this data. Instead it will perform all the operations and checks required of it within the unit itself and output the result - this means the security of the key isn’t reliant on that of the entire system, but just this individual unit.

This essentially means we have a smaller attack surface - from here we can apply a number of defensive measures:

Shielding to prevent external reading of electromagnetic signals

Uniform timing execution of certain operations to prevent ‘timing attacks’

Validation of chain of trust modules for both OS and application software in case either is hijacked

Implementation of a unidirectional privilege escalation model

Tamper detection and wiping of registers in case of tamper

In the majority of cases the security that these measures provide is fairly good, however some of these protections are heavily reliant on the fact that an attacker doesn’t have physical access to the machine

Hardware Security Modules

These modules are essentially responsible for generation, processing and storage of keys; they often contain a number of cryptoprocessors. They are designed in such a way that the only means to obtain data from the module is through physical access, however they will often provide multiple visible signs of tampering if this occurs. One of their main uses is in public key infrastructure - for example in the generation and usage of asymmetric key pairs used by certification authorities.

High stakes operations such as banks often use them when handling user data such as pins, magnetic stripe cards and the key sets used in smart cards. Hardware wallets used with cryptocurrencies are another useful example - they store the keys associated with a particular wallet address. If the wallet is sent the template of a transaction, it can sign it internally within the module and provide it back to the source system for upload to the blockchain. At no point outside the module is the private key exposed.

[businessdaily05]

AMD confirms that TPM is a problem for some PCs running Windows 11

AMD confirms that TPM is a problem for some PCs running Windows 11

It looks like Windows 11 users with AMD Ryzen processors, and affected by an issue on their hardware that is causing “temporary pauses in system interactivity or responsiveness”, will have to wait until May for a BIOS fix. from the chipmaker. The issue affects Windows 10 and Windows 11 systems with Firmware Trusted Platform Module (fTPM) enabled. The TPM cryptoprocessor handles cryptographic…

[alexa-mk]

AMD confirms that TPM is a problem for some PCs running Windows 11

AMD confirms that TPM is a problem for some PCs running Windows 11

It looks like Windows 11 users with AMD Ryzen processors, and affected by an issue on their hardware that is causing “temporary pauses in system interactivity or responsiveness”, will have to wait until May for a BIOS fix. from the chipmaker. The issue affects Windows 10 and Windows 11 systems with Firmware Trusted Platform Module (fTPM) enabled. The TPM cryptoprocessor handles cryptographic…

[knowasiak]

HPE iLO5 Firmware Security – Go Home Cryptoprocessor, You're Drunk

HPE iLO5 Firmware Security – Go Home Cryptoprocessor, You’re Drunk

Copyright © Informa PLC. Informa PLC is registered in England and Wales with company number 8860726 whose registered and head office is 5 Howick Place, London, SW1P 1WG. Join the Read the full story – https://www.knowasiak.com/hpe-ilo5-firmware-security-go-home-cryptoprocessor-youre-drunk/ Signup on KC.inc to make your day easy reading world-class articles – https://www.knowasiak.com/register/