3
$\begingroup$

When browsing the internet I found out about this amazing phone. Well, it would be amazing if it was actually obtainable. It's called the Turing Phone, and it is supposed to come with as good as unbreakable cryptography:

http://www.ibtimes.co.uk/turing-phone-liquid-metal-smartphone-impossible-hack-offering-true-offline-encryption-1498003

Warning: ads, crashing Adobe plugins and the like

"We have what we call a master public key and a master private key, and instead of hosting the keys on a server, we bundle these two keys into a hardware chip on the Turing Key that we call the Turing Imitation Key (TIK)," he explained.

"Basically, the technology allows users to exchange crypto keys in an offline setting, which is called a static key exchange. This means that when I send you information like email, an SMS text message or files, I would first obtain your identity and then the key can be created and authenticated prior to any sort of communication, so you know the information will safely and securely reach only the device intended."

and further

In addition, Chao and his colleagues' work on the TIK has been certified by the International Telecommunication Union (ITU) to become a new global security standard – the ISO 29181-5.

"It's literally impossible to hack the phone as the keys reside inside the hardware chip. Whenever you have a hardware key it locks down the system, and the TIK can issue 10^48 pairs of master public keys and master private keys, which is infinite," said Chao.

So it's supposed to be described in ISO/IEC TR 29181-5:2014 but as I haven't seen a single reference to that document, which makes me a bit reluctant to download it. It's only 6 pages, 38 Swiss Franks and it says that it just contains a problem statement / requirements.

Note that he also mentioned this piece of bull:

"Today, we have [security technologies like] Public Key Infrastructure (PKI) and Identity based Encryption (IBE). You submit a private key to a public server where a public certificate is issued to sender and receiver, so we refer to that as a centralised third-party certificate issuer," TRI's chief executive SYL Chao told IBTimes UK.


The phone would carry a Turing Coin too, but I have seen even less information about that piece of technology.


If this is real tech, then I would guess something based on static-static DH key exchange.


So the question is: Does anyone know the underlying cryptographic principles behind this phone and the Turing Imitation Key?

$\endgroup$
  • 1
    $\begingroup$ Well, if I read this text correctly, you haven't found any reference to that ISO standard because it was basically modeled after what they did there... FYI: There are apparently $10^{48}\approx 2^{160}$ keys which does indeed hint at ECC and not in way giving any hope it may be long-term secure... $\endgroup$ – SEJPM Jun 9 '16 at 22:08
  • 2
    $\begingroup$ Possible way it works: Static peer-based ECDH authentication key agreement / exchange /verification (like Signal-Protocol offers) paired with security module enforced key-security based on P-160 with the coin being a physical RFID token transporting your public key in a trusted manner for peer-verification. $\endgroup$ – SEJPM Jun 9 '16 at 22:15
  • 2
    $\begingroup$ @SEJPM It could be normal DH with a Q of 160 bits. That could be more secure. $\endgroup$ – Maarten Bodewes Jun 9 '16 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.