Re: [gnukeyring-discuss] development

[Jochen H. <Hoe...@In...>]

Hello Florin

On Thursday 23 October 2003 20:47, Florin Andrei wrote:
> Jochen, can i ask a few "hard" questions?
> What's the actual strength of the encryption algorithms on a device
> running PalmOS? Applications running on Unix clones make use of various
> network- and system-events to feed some pseudo-random numbers
> generators. Is there anything like that on PalmOS?

Keyring has it's own strong random pool that is fed as long as keyring is
running by all events including pen stroke events. The algorithm used for
the pool is the same as for the linux /dev/urandom device. This involves
a SHA-1 hash (md5 for keyring-1.2) so even if no randomness is added it
is intractable (as long as you don't get direct access to the pool).

> I guess what i'm asking is, are there any inherent weaknesses in an
> application that runs on PalmOS and uses strong encryption, just because
> it runs on PalmOS?

I don't think so, except for computing intensive algorithms.  For example f=
or
key generation from the master password I had to use a smaller number of
iterations of SHA-1 sums than recommended by the standard.  These=20
iterations make brute-force attacks more difficult if the master password=20
is too simple. [This applies to the not yet finished version, all previous
versions including 1.2.3 use a single MD5 sum]

> In any case, a palmtop is never to be considered totally secure, but i
> feel that, if the encryption stuff doesn't have any inherent flaws, the
> security of the hardware should be better than that of the PCs (it's a
> lot harder to install "keystroke loggers", it's a lot harder to snoop on
> the RF fields generated by the display and by the input device, etc.).

It's probably as easy to build a keystroke logger for a Palm as is for a
PC.  There is no memory protection on the Palm and a program can=20
patch the OS kernel.  On the other hand you don't install new programs
from unknown sources as often on your Handheld as you do on your PC=20
and the PC is often used by more than one person.  Also the PCs are
more often on the internet than Palms are and as they are more
complicated they have more security holes.

> > There will also be a minor bug fix release 1.2.3 (dirty flag isn't set =
on
> > changed records), but that has no new features.
>=20
> An upgrade from 1.1 should be straightforward, right?

Yes, there should be no problems.

  Jochen

=2D-=20
Jochen Hoenicke, University of Oldenburg, 26111 Oldenburg, Germany
Email: hoe...@in...  Tel: +49 441 798 3124