Saturday, November 04, 2006

DriveTrust technology - first step to the Trusted Computing era

For those who haven't heard, Seagates plans to release new model of hard drive that support full-disk encryption. It would be called Momentus 5000 and should be available on the market next year (maybe at the same time as Window Vista ?)
More details cand be found here, but its essential features are:
1. The encryption/decryption process is done entirely at hardware level, by a built-in chip inside the hard drive
2. Encryption algorithm used is AES (128 bits), aslo support RSA, SHA-1
3. Full-disk encryption, i.e. every single bit, no exception for even OS or any other "sensitive" data
4. Encryption/decryption keys are protected in hardware, and user must be authenticated by password to access the key. Users are required to set password in the first time, and subsequently provide that password at boot time.

This DriveTrust technology is an introductory step toward Trusted Computing platforms. In fact, Seagate is working closely with the Trusted Computing Group (TCG) in standardize the specification for trusted/protected storage. Furthermore, it seems to me that DriveTrust is technically just a simple implementation of a Trusted Platform Module (TPM) (whose capabilities also include attestation and integrity measurement). While the TPM chip is attached to the motherboard, this DriveTrust chip resides within the hard disk. Main features provided by a Trusted platform are: Remote attestation, Integrity Measurement and Protected Storage. The first two are essential for the third-part to enforce usage/configuration/DRM on the local users (i.e. bad for *us*). Protected Storage is the only useful feature for home users.

Sounds great ? Yeah, it does. But you must be careful not to disclosure the password; otherwise this new technology won't worth the extra bucks. Worse yet, forgeting the password means that you are completely screwed: every single bit in that drive will be lost.
Once authorized/decrypted, the data/keys will stay unlocked and vulnerable as long as the computer is on. It is therefore believed to cause troubles and confusion when user (inadvertently) choose to goes hibernate instead of completely switch off the PC.
Lastly, i don't see this DriveTrust technology to be useful in a networked, time-sharing environment such as a university/school network.

0 Comments:

Post a Comment

Subscribe to Post Comments [Atom]

<< Home