I am working an a Windows application that will encrypt and decrypt files using AES Encryption. The 32 byte key which is diversified and derived using a ATSHA204 unique serial number and some addition data via the SHA256 algorithm.

The key is stored on an ATAES132A serial EEPROM and is locked from reading and is only accessible using AES in CCM mode (MAC authentication). In my design, the ATAES132a communicates with a MicroChip (Atmel) microcontroller. The Micro Controller has a security bit which is set to prevent reading the firmware.

The Window's application is designed to only encrypt and decrypt using the unique key stored on the USB HID device. The key is transferred over the USB bus unencrypted to the Windows application. Additionally, the key is held in the PCs memory unencrypted.

My question; Are these acceptable points of failure in a system design? Meaning if someone has access to the USB bus, they may have access to the computers memory and the key is no longer secret. In my opinion, if someone has access to the PC with the USB HID connected, it is no different than being knocked on the head and someone stealing your car keys. It is almost impossible to prevent (at least I think its impossible to prevent).

I also thought that I could use AES-CCM to transfer the encrypted key over the USB bus, but both the USB HID device and Application must share another Key and additional data to encrypt and generate a MAC for the transmission. Even if I would do that, the unencrypted key is still being held in memory.

Here is a general overview of the scenario:

Application Diagram


closed as too broad by Squeamish Ossifrage, Maarten Bodewes May 23 at 9:15

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ What's your threat model? $\endgroup$ – forest May 7 at 2:07
  • $\begingroup$ I would say what I described could be considered the threat model. If someone had access to the PC, they could install malware which sniffs the USB bus, saves memory dumps or has the ability to see both in real time. $\endgroup$ – PhillyNJ May 7 at 10:27
  • $\begingroup$ It is, but I think elaborating slightly would be beneficial. $\endgroup$ – forest May 8 at 3:30
  • $\begingroup$ @forest How would you like me to elaborate? The scenario I describe is what I would consider to be the threat. Let me know.. thx $\endgroup$ – PhillyNJ May 8 at 19:52
  • $\begingroup$ There's no general cryptographic answer to this. It depends on your application whether you are willing to consider malicious actors on the USB bus or not. A question that may be much more important: What are you doing with the pseudorandom permutation family called AES? This is not really an application-relevant concept; if nothing else, you probably want an authenticated cipher like AES-GCM, but it's important to set down a design document detailing the threat model and what you hope to achieve in the face of it. $\endgroup$ – Squeamish Ossifrage May 9 at 15:13