14 DAY TRIAL // Sam Curry, the chief technology officer of RSA’s Identity and Data Protection division, denies that the SecurID token can be cracked, as researchers claim to have demonstrated in a study called “Efficient padding oracle attacks on cryptographic hardware.”
The experts, part of the Project Team Prosecco, have revealed that they were able to crack a number of authentication devices, including the RSA’s SecurID 800 token, from which they obtained the secret keys in just 13 minutes.
“This week, RSA has received many inquiries, press pickups, blog entries, and tweets regarding an alleged ‘crack’ by scientific researchers of the RSA SecurID 800 authenticator. This is an alarming claim and should rightly concern customers who have deployed the RSA SecurID 800 authenticator. The only problem is that it’s not true,” Curry explained.
“Much of the information being reported overstates the practical implications of the research, and confuses technical language in ways that make it impossible for security practitioners to assess risk associated with the products they use today accurately. The initial result is time wasted by product users and the community at large, determining the true facts of the situation.”
Furthermore, the CTO believes that the research doesn’t really show the “practical risks” posed to users. He states that research into their products is always welcome, but he claims that such results can lead to “confusion and misplaced concern” instead of a fruitful collaboration.
He admits that the PKCS #1 v.15 standard does contain some security holes, but he highlights the fact that the vulnerability presented by the researchers can only be used to access a symmetric key and other encrypted data sent to the smartcard.
“It does not, however, allow an attacker to compromise private keys stored on the smartcard. Repeat, it does not allow an attacker to compromise private keys stored on the smartcard,” he added.
The bottom line, from RSA’s point of view, is that the token’s one-time password functionality is not affected in any way and that the attack cannot be used to obtain the precious private key.