Open Side Menu Go to the Top
Register
Latest flaw in RSA library. Are PS tokens safe? Latest flaw in RSA library. Are PS tokens safe?

10-16-2017 , 01:35 PM
https://arstechnica.com/information-...-estonian-ids/

this is mostly about electronic ID smartcards in Europe, but security tokens used by poker rooms might be affected as well. anyone have info if PS tokens use Infineon hardware?

Quote:
The flaw resides in the Infineon-developed RSA Library version v1.02.013, specifically within an algorithm it implements for RSA primes generation. The library allows people to generate keys with smartcards rather than with general-purpose computers, which are easier to infect with malware and hence aren't suitable for high-security uses. The library runs on hardware Infineon sells to a wide range of manufacturers using Infineon smartcard chips and TPMs. The manufacturers, in turn, sell the wares to other device makers or end users. The flaw affects only RSA encryption keys, and then only when they were generated on a smartcard or other embedded device that uses the Infineon library.
Latest flaw in RSA library. Are PS tokens safe? Quote
10-16-2017 , 08:45 PM
Well, you still need the password, the user name and the correct RSA device number and the 4 digit personal identification number. And Stars has also the protection that by using a new computer you will get an SMS number before you can proceed. So that makes five security measures to break. I believe in Stars
Latest flaw in RSA library. Are PS tokens safe? Quote
10-18-2017 , 10:46 AM
This isn't what you seem to think it is. This issue relates to how smart cards work, not to how RSA Security Tokens work.

An implementation of the RSA algorithm is what is at issue, and whereas the security tokens are made by the company RSA. They're not the same thing - the only connection is that both are named after the same trio of security guys.



To use a metaphor from the physical world: a sub-section of some door locks with keys can be examined after a couple of days analysis. A hacker can then use that analysis to create a key that unlocks the door lock. The RSA Security Token in this metaphor is a combination lock, which has no relationship or connection with the broken key locks.
Latest flaw in RSA library. Are PS tokens safe? Quote

      
m