Open Padlock

• FlashDrive with hardware encryption
• Simple = Durable+Small+Cheap (this can be done in 300kč as the USB-enabled Atmel chip costs around 200kč)
  • We need only little space to store passwords and certificates so we can use controler's internal flash memory instead of external chip
  • We can add optional microSD reader to improve capacity up to few GBs…
• OpenSource firmware that can be reviewed by whole world
• Easy to use (but secure!)
• No dependency on aditional software or drivers (should work out-of-the box on Linux, Windows and MAC)
• Two ways to control (enter the password, lock,…)
  • using hardware keyboard - completely without software
  • using existing drivers available on every OS (HID, MassStorage, USB-To-Serial ???) - with little help of some simple script. so we'll be able to unlock the flashdrive connected to remote server/computer

I've recently realized that Corsair Padlock 2 can be cracked (you can read my paper: http://www.exploit-db.com/papers/15424/ )

And i came with idea to reimplement it more securely and open the sources so everyone will be able to check security of such device.

I want to make custom encrypted flashdrive (probably) using Atmel AT89C5131 (or AT89C5132) while avoiding the security bugs of Corsair Padlock 2. AT89C5131 does have only 32kB of internal flash memory (enough to store certificates and passwords) but it can interface to some larger flash chip or even microSD cards so you can have very good encrypting card reader/writer which is able to store few GB too…

b00lean seems to have sufficient knowledge and hardware to implement this. actually he was able to get mass-storage working on his development board from Elbow project in minutes. all we need now is to add AES alghoritm, implement some way to enter encryption key and design custom USB stick shaped prototyping board…

Links:

• http://hackaday.com/2010/05/25/mass-storage-business-card/
• http://elasticsheep.com/2010/04/teensy2-usb-mass-storage-with-an-sd-card/

EZ-USB chips are looking promissing too:

• diy_i2c_pamet_k_pc.pdf
• http://code.google.com/p/opencryptotoken/

Some AVR-based crypto-token:

In perfect world it will look approximately like this:

And i hope it will not look like this: