Post
Topic
Board Development & Technical Discussion
Re: Extracting the Private Key from a TREZOR ... with a 70 $ Oscilloscope
by
gmaxwell
on 02/05/2015, 19:50:44 UTC
We have just the solution for this problem - firewall between the crypto controller and the interface, implemented directly in silicon:
http://www.eliptibox.com/#!Hardware-Firewall-for-Hardware-Wallet/cw4e/54ecb8670cf27a657a44c314
EliptiBox Team
www.eliptibox.com
You are spamming;  advertising your product is off-topic for this thread, doubly so since its already been spamvertised once here;  but since you've been so bold--  I inquired and found out that your product is based off the same weak, barely tested/reviewed, and slow as heck naive cryptographic code used in the product being discussed here.  The information leak here is so severe that I am very doubtful that your (quite laudable) improved hardware isolation can prevent-- e.g. the code in question leaks several bits of information about the key from just the time it takes.

Furthermore, Your "directly in silicon" is an FPGA with a loading procedure 'under the seal', this is potentially yet another back door vector, it sinks a lot of power, and really seems to be of dubious value. I would have preferably seen all the external interfaces over simple low-ish-speed serial interfaces with good electrical isolation, rather than a huge power sucking FPGA under the secure-area can.  Use of a BGA probably also means you need a 4 layer board for signals routing and thus probably can't use an extra layer as a separate ground to complete the shield can. The FPGA just seems like a costly gimmick to me, and that you're misrepresenting this as a solution to bad cryptographic code (which you have made a similar failure by selecting to use it) doesn't bode well for the security of your product.