{"action":"created","issue":{"url":"https://api.github.com/repos/numworks/epsilon/issues/413","repository_url":"https://api.github.com/repos/numworks/epsilon","labels_url":"https://api.github.com/repos/numworks/epsilon/issues/413/labels{/name}","comments_url":"https://api.github.com/repos/numworks/epsilon/issues/413/comments","events_url":"https://api.github.com/repos/numworks/epsilon/issues/413/events","html_url":"https://github.com/numworks/epsilon/issues/413","id":317566199,"number":413,"title":"[question] Real time clock and some kind of internal secret...","user":{"login":"daniel-jozsef","id":6108136,"avatar_url":"https://avatars1.githubusercontent.com/u/6108136?v=4","gravatar_id":"","url":"https://api.github.com/users/daniel-jozsef","html_url":"https://github.com/daniel-jozsef","followers_url":"https://api.github.com/users/daniel-jozsef/followers","following_url":"https://api.github.com/users/daniel-jozsef/following{/other_user}","gists_url":"https://api.github.com/users/daniel-jozsef/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-jozsef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-jozsef/subscriptions","organizations_url":"https://api.github.com/users/daniel-jozsef/orgs","repos_url":"https://api.github.com/users/daniel-jozsef/repos","events_url":"https://api.github.com/users/daniel-jozsef/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-jozsef/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-04-25T10:21:08Z","updated_at":"2018-04-26T08:07:23Z","closed_at":null,"author_association":"NONE","body":"Hey, so I'm attempting to build some security-focused apps, for OTP and deterministic password management. There are two things I'd need for these to really rock. A real time clock, and something, anything, that cannot be easily accessed through USB.\r\n\r\nIt might be a baseless hope, but knowing how today's MCUs have all sorts of weird bells and whistles, I'm hoping to some degree that there's a clock in there somewhere. Otherwise users would need to enter date and time to a few seconds' precision by hand for one-time-passwords...\r\n\r\nThe other is that even though having a \"dumb\", airgapped device like this is miles more secure than any smartphone, if confidential data is going to be stored, such as OTP seeds and a master secret for a deterministic password generator, it would be nice to be able to encrypt it with a key that is available only to code actually running on the MCU, and not to anyone who dumps the Flash ROM content through USB. Say, a long enough chip ID, invisible from USB, that could be hashed to get an AES key, or something.\r\n\r\nI'm not expecting a TPM, just something akin to a front door lock. Protecting the secrets from someone who has disassembled the device and hooked up to debug ports is beyond scope, protecting it from someone who has five minutes alone with it to attach it to a computer via USB would be nice to have in scope though."},"comment":{"url":"https://api.github.com/repos/numworks/epsilon/issues/comments/384551564","html_url":"https://github.com/numworks/epsilon/issues/413#issuecomment-384551564","issue_url":"https://api.github.com/repos/numworks/epsilon/issues/413","id":384551564,"user":{"login":"daniel-jozsef","id":6108136,"avatar_url":"https://avatars1.githubusercontent.com/u/6108136?v=4","gravatar_id":"","url":"https://api.github.com/users/daniel-jozsef","html_url":"https://github.com/daniel-jozsef","followers_url":"https://api.github.com/users/daniel-jozsef/followers","following_url":"https://api.github.com/users/daniel-jozsef/following{/other_user}","gists_url":"https://api.github.com/users/daniel-jozsef/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-jozsef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-jozsef/subscriptions","organizations_url":"https://api.github.com/users/daniel-jozsef/orgs","repos_url":"https://api.github.com/users/daniel-jozsef/repos","events_url":"https://api.github.com/users/daniel-jozsef/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-jozsef/received_events","type":"User","site_admin":false},"created_at":"2018-04-26T08:07:23Z","updated_at":"2018-04-26T08:07:23Z","author_association":"NONE","body":"Is that a software-only improvement? How about using the crystal, would that require hardware change?\r\n\r\nA minute per hour drift is entirely useless for OTP. Even a second an hour would make it pointless, but I hope with the crystal, and possibly drift compensation, it could be good.\r\n\r\nFor power consumption, I think the clock should be optional, so if someone doesn't need it, it could be disabled from settings.\r\n\r\nYea thinking the threat model through, possibly using a password-based key to encrypt sensitive data is the way to go."}}
{"actor":{"display_login":"daniel-jozsef"}}