Cracking a Crypto Hard Drive Case

juct writes "A label on the box reading 'AES' does not ensure that your data are protected. heise examined a hard drive enclosure with an RFID key that is typical of many similar products. They found that the 128-bit AES hardware encryption claimed in advertisements was in fact a simple XOR encryption that they were able to break easily with a known plaintext attack." The manufacturer of the drive examined has announced that the product is being retooled and will be reintroduced later this year, presumably with actual AES encryption.

Re:Criminal prosecution?

[Nero Nimbus]

Hey, that's better than ROT26.

Re:Criminal prosecution?

[GaryPatterson]

It'll be so good, it'll do ROT13 twice!

Re:So what happens...

[palegray.net]

All the fobs are encoded with the special key: QWERTYUIOP1234567890. Don't worry though, the key is copyrighted internationally and cannot be used without proper authorization. Devilishly ingenious, those wily engineers...

Re:Criminal prosecution?

[dbIII]

It's not fraud if it's still AES. In this case AES stands for the claims which are Advanced Equine Stool.

Re:Trust

[Agent.Nihilist]

Have you ever used a boomerang before?
Someone usually ends up catching it with the back of their head.

I think trust IS a boomerang.

Re:Trust

[Anonymous Coward]

Yea, it is so!

The precious resource of trust can only be grown slowly, fed by the nutrients of honesty, the rains of commercial and/or interpersonal interaction, and the sun-like rays of consistency. Like the noble crops of wheat that adorn the fields of the Great Plains, it is only finally harvested in the autumn of our lives. But, unlike those nutritious grains, its wholesomeness fills the belly of our souls every day of our lives.

Nay, trust is _not_ a boomerang.

Re:get creative

[iminplaya]

Rig your drive to explode...

In today's post 9/11 world, "self destruct" might be more politically correct.

Re:Criminal prosecution?

[Spy der Mann]

It'll be so good, it'll do ROT13 twice!

Hah! That doesn't compare with DOUBLE-XOR encryption! :D

Re:Criminal prosecution?

[techno-vampire]

Maybe they can can get real technical about it and use ROT 39.

Re:Criminal prosecution?

[Anonymous Coward]

Double-ROT-13 is funny
Quadruple-ROT-13 is twice as funny
Sextuple-ROT-13 is thrice as funny, and gets a two bonus points for the 's-e-x' string in it
Octuple-ROT-13 is twice twice as funny, and gets a bonus point for sounding a bit like the word 'octopus', which has 'p-u-s' in it, which sounds a bit like 'pussy', which is a synonym for 'vagina', which is related to 'sex'
Decuple-ROT-13 is twice plus thrice as funny
Duodecuple-ROT-13 is twice thrice as funny

After that it just gets lame.

Re:This has to be illegal

[Mike1024]

the CEO [...] I'm sure his pocket change could hire a contractor to test this.

I'm not sure the $20 Chinese-made USB hard drive caddy market has produced many millionaire celebrity CEOs :)

Michael

Perfect XOR encryption.

[Ihlosi]

XOR is not an encryption method, it's just a binary operation. It's what you XOR your data with that determines if your encryption is good or not. That's what is the problem in this case.

Indeed. I XOR the data with itself, making sure that it can never, ever be decrypted.

Re:How about a software solution?

[palegray.net]

I followed your advice and dug out a hard drive full of BASIC code from 15 years ago... I replaced all the GOTOs with GOSUBs and feel much more secure!

Re:Criminal prosecution?

[jmv]

I do double-xor with a one-time pad. I've even figured out a way to do what without having to give the one-time-pad to the recipient, so I guess it counts as asymmetric cryptography.

Re:Criminal prosecution?

[pyite]

Is ROT13 a group? We may never know...

After much work, I have proved that ROT forms a group under functional composition. I shall call it "the rotation group." This comment field, however, is simply too small to contain the proof.

Re:Criminal prosecution?

[TheVelvetFlamebait]

Can you please repost your comment in plain text? Most of us can't be bothered decrypting your message.

Re:Criminal prosecution?

[garutnivore]

Hmm... after that you are inducing bit rot.

Re:Criminal prosecution?

[alexgieg]

Octuple-ROT-13 is twice twice as funny, and gets a bonus point for sounding a bit like the word 'octopus', which has 'p-u-s' in it. . .

And tentacles.

Re:Criminal prosecution?

[Opportunist]

You'll see that used a lot for encryption with the Hentai crowd.

Re:Trust

[Opportunist]

So the analogy is flawed. Boomerangs are not a tool for protection but for cracking.

Guess the Germans are going to outlaw them in a bit.

Re:Criminal prosecution?

[pnewhook]

I agree completely - open source or nothing. But you would not BELIEVE the hassle I get checking into an airline when I refuse to let them close the door and take off until I've inspected all of their flight code. Bunch of unreasonable pricks.

Re:Criminal prosecution?

[somersault]

Tell me about it. I accidentally bricked an AIBO when reverse enegineering the OS to make sure that it wasn't going to try and chew on anyone's ankles or purposely try to trip them up. The kids were crying and bitching for weeks, but it was obviously for their own good.

Actual source code used proves company didn't lie!

[Anonymous Coward]

Reverse engineering their code I can see they weren't lying afterall....

XOR AX,0031 ; 1
XOR AX,0032 ; 2
XOR AX,0038 ; 8
XOR AX,002D ; -
XOR AX,0062 ; b
XOR AX,0069 ; i
XOR AX,0074 ; t
XOR AX,0041 ; A
XOR AX,0045 ; E
XOR AX,0053 ; S