Posts

Personal Review of the ATECC608A CryptoAuthentication on the Nano 33 IOT

I was extremely excited to see that Arduino was offering a relatively inexpensive board that offered hardware encryption and key storage. The Nano 33 IOT and related boards recently released from Arduino advertise many features including an integrated  ATECC608A CryptoAuthentication chip. However once I received them my frustration began immediately.  Neither Arduino nor Microtel offer much in the way of useful documentation on these chips.  Microtel offers a proliferous amount of not very useful documentation here:  https://www.microchip.com/wwwproducts/en/ATECC608A#additional-features They also offer a library  https://github.com/MicrochipTech/cryptoauthlib . The Nano 33 Sports a SAMD21 Cortex - MO Low Power Processor ( data sheet ). The  ATECC608A supports a single wire interface and an I2C interface.  The Nano 33 uses hardware serial for their default I2C bus which is wired to the  ATECC608A.  So they are leveraging I2C.  Bu...
Post a Comment
Read more

Using Encryption to make the Right to Be Forgotten Practical.

Article 17 paragraph 1 of the GDPR states " The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies..."   https://gdpr-info.eu/art-17-gdpr/ Article 17 paragraph 2 of the GDPR states " Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller,  taking account of available technology and the cost of implementation , shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data." It is important to pay attention to the bolded words above.  Because currently available technology and cost of impl...
Post a Comment
Read more

How to do Identity and Access Management Wrong.

This blog is a study in how to do Identity and Access Management wrong.  I am going to pick on an organization that I am a member of known as (ISC)2.  (ISC)2 is responsible for the certification and continued education of computer system information security professionals who bear the prod title (CISSP). They are also the poster child on how to implement security in such a way that the system becomes unusable and unavailable because they are not terribly adept at identity and access management (one of the cornerstones of information systems security).  So let us begin the critique. We will begin with one of the most important and frequently one of the most poorly implemented aspects of identity and access management.  Password management recovery.  But before we begin discussing the flaws in the (ISC)2 implementation of password management recovery let's look at some more pervasive issues around passwords as an authentication factor. In the Authentication ...
Post a Comment
Read more