News

For the second time we are in Google Summer of Code (GSoC) as a subproject of FOSSASIA. This means students can get scholarship to code for the Crypto Stick. Here are a couple of ideas of interesting projects but you are free to suggest your own as well. If you are a student and want to join our project, register at Google Melange and apply for FOSSASIA.

Dear Crypto Stick Friend, we need your support!

PKCS#11 is a popular interface to connect smart cards (also Crypto Stick) with various software applications such as Firefox, TrueCrypt, Mozilla Thunderbird, PuTTY and many more. The current driver for the Crypto Stick works well but it is not open source and hence not well integrated to Linux systems and also lacks full write support. The OpenSC framework is the dominating open source PKCS#11 library but it can't be used with the Crypto Stick yet. We want to achieve full read and write support of the Crypto Stick in OpenSC and the driver will be released as open source and can be used by all Crypto Stick users. Because our time and resources are dedicated to the development of Crypto Stick 2 we need Euro 900 to delegate this task to an external developer. We already collected Euro 500 (thanks to Kicktipp) and need another Euro 400 to have sufficient funding. Please support this effort with a donation.

Because we are a non-profit organization, if we receive your donation before New Year's Eve, we are glad to provide you a donation receipt of 2011. (Of course, otherwise you will get a donation receipt of 2012.)

PayPal: Send your donation to spende@privacyfoundation.de and state "Crypto Stick" as purpose.

Wire transfer:

• Recipient: German Privacy Foundation e.V.
• Account number: 329 31 80
• BLZ: 100 700 24
• Institute: Deutschen Bank
• IBAN: DE13100700240329318000
• BIC: DEUTDEDBBER
• Purpose: Crypto Stick

We wish you a Happy New Year!

Crypto Stick Team

If you ever was wondering whether your proprietary encryption device or smart card is secure, you might have been right. History tells us that many vendors pay not enough attention to deliver a really secure product. The following gives an incomplete overview of security flaws which became public:

• In 2011 RSA Inc was hacked and secret information about RSA’s securID token was stolen which allows to hack the tokens.

• In 2010 it was revealed that AES-256 encrypted and FIPS 140-2 Level 2 certified USB storage devices of the following vendors could be easily accessed by using a default password: Kingston, SanDisk, Verbatim, MXI, PICO

• Aladding eToken Pro (2010)

• Corsair's Padlock 2 (2010)

• Kobil smart card readers (2010)

• Raidon‘s Staray-S-Serie (2009)

• All USB storage devices from 9Pay, A-Data and Transcend which use fingerprint readers based on the USBest UT176 and UT169 from Afa Technology (2008)

• Excelstor’s GStor Plus (2005)

• Lexar JumpDrive (2004)

Imagine how many security flaws still exist which haven't been published but are only known by criminals or intelligence services. This is why you shouldn't trust security technology unless it's source code is available for inspection. The Crypto Stick is the only security USB device with published hardware design and source code to ensure it's secure implementation.

If you want to learn more about physical insecurity of smart cards and crypto processors, I recommend you this interesting video from WIRED magazine which presents Chris Tarnovsky's excellent work in this area. Also you can find more in-depth presentations from him recorded at the Black Hat conference.