Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
  • How long does it take to extract a key from a FIPS-140 Level 2 device?
  • What records are there of successful extraction?
  • How much did the first extraction from a given device cost?
  • How much would a subsequent extraction cost?

Dr. Google is usually very helpful on questions like this but he isn't helping me here.
Any ideas?

share|improve this question
1  
This question belongs to security.SE –  SquareRootOfTwentyThree Aug 6 '12 at 5:09
2  
Parsing error: "FIPS-140 Level 2". Please state if "2" is the version of the standard, as in "FIPS 140-2 Security Level 3", or the security level, as in "FIPS 140-1 Security Level 2". –  fgrieu Aug 6 '12 at 7:25
add comment

2 Answers 2

FIPS 140-2 Security Level 2 does not require any form of security measure to prevent extraction of secrets. It simply requires tamper evidence, that is, it should be possible to notice that such attack took place by looking (for instance) at some seal on the device or at a log file.

To answer your question, extracting a secret may therefore take 0 seconds and 0 dollars.

Only Security Levels 3 states that the cryptographic module must respond to attacks, even though the requirements are not phrased in terms of attack cost, but rather of guidelines the module must follow. For instance, it says that the circuitry should be covered in hard epoxy, but not exactly how, so a manufacturer could also choose a substance a hairdryer can easily melt.

A good source of material to look at is Ross Anderson's group at the University of Cambridge, and more in particular the work of Mike Bond.

share|improve this answer
add comment

This page gives details of a successful extraction of a 3DES key from an IBM 4758 (FIPS 140-1 Level 4): http://www.cl.cam.ac.uk/~rnc1/descrack/. In summary, it required 20 mins of access to the device, 2 days of (offline) cracking time, and about $1000 in equipment.

Not sure if this quite answers the question you were asking in that it relies on vulnerabilities in IBM's "Common Cryptographic Architecture" API implemented by the device, rather than overcoming anything specific to the FIPS validation requirements.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.