Security Question

[BigChimp]

Thanks a lot for your quite detailed posts, ezlage.

Rather than respond to the security measures you have stated I am once again bringing up the method you use to come up with security measures is very important.

As others (ludob etc) and I mentioned before, you need to have an analysis that considers:
1. possible threats, for clarity categorized into e.g. confidentiality/integrity/availability, then subcategorized (i.e. confidentiality when the usb stick is lost by the customer)
2. amount of damage that can be expected if these threats materialize
(1+2 will describe the risks for your system)
then you need to assess if you think the risks are acceptable. Obvously in your case they are not, so you
3. design and implement measures to stop these threats from doing damage, taking care to first address the easiest attacks/biggest damage
4. now you go on until you are satisfied that your risks are covered.

The point of this is that it forces you to think systematically about what you are protecting against.

The discussion in this thread showed a lot of measures that can be taken which can be quite effective, but my point is that you need to be sure you covered the right things.
Now you posted some measure you took which may be effective, but:
1. we cannot know if you took the biggest risk into account
2. you have to take into account the effects of your measures on the risks for other components (e.g. if you do server side backups+"online functionality to store and retrieve user password"=>the password will be on your server so you can open the encrypted backups.)

You may very well protect extremely well against attackers that try to debug your running code while that has a much lower chance of occurring than a keylogger on the user's pc catching all his financial details being entered.

So let me give an example of what I'm trying to say:

1. Confidentiality (somebody else has access to client data)
1.1 while program is running and client has stick etc. => countermeasure: screensaver password to be mentioned in documentation. User responsiblity
1.2 while program is not running and client has stick inserted in machine => encryption of data files on stick. Problem: password management needs to be done. See availability

2. Integrity of client data (is the data corrupted)
2.1 while program is running with stick in pc:
- programming errors should be caught, use try/except etc.
- use checksums to check integrity
- provide automatic backup snapshots somewher. Note: probably has security implications; to be further detaild
2.2 while program is not running and client has stick inserted in machine: basically this means the OS thrashes the encrypted files.
- provide backup mechanism (automatic or manual); note backup has confidentiality issues as well, see... <insert another section>
- do checksum of entire data file on startup to detect integrity problems
2.3 if somebody else has the stick: too bad; irrelevant if a thief cannot get good date off the stick

3. Availability of client data (does the client have access to the data):
3.1 if program is starting and stick is in pc: only a serious os error would lead to this: file has been deleted by user or OS or something.
- solution: notify user & provide facility to restore backup to same or other stick; see section <....> for security issues
3.2 stick is gone:
- solution: provide facility to restore backup to another stick; see section <....> for security issues

You could perhaps have a look through http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard for some more information.

Thanks,
BigChimp

[ezlage]

BigChimp,

I'm adapting my code to somethings that you said.
After, could you take a look at the code?

I have all time of the world to do this job, so, I want to do of best way!

Sorry by disturbing you.
When I learn enough, maybe I can help you too.

Regards.

[BigChimp]

Hi Ezequiel,

I'd be glad to take a look at the code but mind you, I'm not that much of a programming guru.

If you have some kind of security analysis document, I'd be happy to take a look at that too, even if it is in Spanish (Spanish is your native language, right?)

Just send me a PM

Thanks,
BigChimp

[ezlage]

Thank you BigChimp.

My native language is Brazilian Portuguese.
I have some difficulties with English, but it is one more thing that I'm trying to learn.
But I can understand english and spanish if by text.

So, in few days I will send to you my code and documentation.

Have a nice week!
Thank you again!

[ezlage]

Hello friends!

After a long time research, I decided to reduce the attack surface because have no solutions for protecting cryptographic keys in both run-time and compile-time.

So, I've developed the SecBase89 class.

Basicly:
-SecBase89 receives the key (like string, numbers or encrypted string with(or without) the decryption task, all previously declared like const, or directly imported of a TStrHolder).
-While in memory, SecBase89 keeps the received key at numeric format (without decrypt it, and obfuscated with mathematics)
-Just when need to, the key is converted of numeric type to string (if was reported a decryption task, it will be decrypted).
-The key and all ways to them remain protected by the class, that have public procedures to encryption and decryption of strings and streams (external uses).

Take a look at the attachment.
Is a generic version of SecBase89 because I'm working in a stable version, with more functionalities and new security implementations.

I would like to know from all of you about the real effectiveness of this class.
Can anyone contribute someway?

[ezlage]

Please!?

[BigChimp]

Had a brief look... the code seemed sensible, but haven't used the crypto stuff myself - what key does it encrypt the strings with? Are those keys specified by the program? Quick look didn't show anything but the variable names where not that clear to me.

Yes, this would seem like another layer to defend against casual inspection of memory for sensitive data. Usual disclaimers of using debuggers, reverse engineering etc applies of course as well as my advice to analyse the complete threat environment.

Hope somebody more knowledgeable chimes in - you might want to start a new subject like "New free crypto library - please comment"... to get some more interest.