Track 3: Trusted Computing, Law & Government Using NSA Tradecraft to Protect Data on Mobile Devices Dan Griffin — JWSecure The U.S. National Security Agency has been public about the inevitability of mobile computing and the need to support the use of cloud-based services for secret projects. Army General Keith Alexander, head of the NSA, recently spoke of using smartphones as ID cards on classified networks. And yet, mobile devices have a poor security track record, both as data repositories and as sources of trustworthy identity information. Cloud services are no better: current security features are oriented toward compliance and not toward real protection. What if we could provide a strong link between mobile device identity, integrity, and the lifecycle of data retrieved from the cloud, using only the hardware shipped with modern smartphones and tablets? The good news is that we can accomplish this with trusted computing standard technologies, including the Trusted Platform Module (TPM), using "measurement-bound" encryption. That is, using data protection keys tied not only to boot measurements in the TPM Platform Configuration Registers (PCR), but also to the secure clock in TPM 2.0. This talk will describe: • How data can be encrypted to a specific device using attestation and the TPM manufacturer Endorsement Key • How decryption is no longer possible if the device is compromised • Where the weaknesses are. I will demonstrate measurement-bound encryption in action. I will also announce the release of an open-source tool that implements this, as well as a paper that describes the techniques for time-bound keys. This is likely the very same way the NSA will be protecting the smartphones used for classified information retrieval. Come learn how your government plans to keep its secrets and how you can protect your own. Mr. Griffin's presentation is available at: https://classic.regonline.com/custImages/360000/369552/TCC%20PPTs/TCC2013_Griffin.pdf More information can be found at http://www.trustedcomputingconference.com/

• published: 26 Sep 2013
• views: 5