Microcrypt Technologies Ltd.

Home Portfolio Hardware GOST Key Keeper

GOST Key Keeper

The security of any cryptographic facility is defined not only through reliability of the applied cryptoalgorithms, but also through the included possibilities of organizational and technical protection of the key data. The main disadvantage of any purely software tool of cryptographic protection is the weak protection of the secret keys allocated in files on the replaceable carriers, as a rule. In such implementations the only way to protect the secret keys from unauthorized access is the appliance of the password on which base the encryption of the key information is fulfilled. However, in practice, the password to a file can be tried in the quite acceptable time, by the usage of the method of "brute force", in the combination with «dictionary attack». A file protected by the password is attackable by three reasons:

  • the amount of attempts of the password selection is not limited;
  • the password is selected from essentially limited set of "easy to remember" variants by the concrete user;
  • password attack process can be parallelized with non-limiting.

The hardware key carriers protected by a password or a PIN-code are applied for reliable protection of the secret keys from unauthorized access. Such carriers limit the amount of attempts of the password input for access to the key; and if the key carrier is "active", it also ensures secretion of a key throughout whole period of its usage (a key is applied inside the carrier only and stays within it).

If a key carrier is used for protection from unauthorized access (for example, encryption of files or disk storages), in the case of its loss or damage the data protected by means of an appropriate key become unavailable, that is equivalent to their erasure. Therefore, the backup copies of secret keys have to be made or the multiuser data access with the separate key carriers is to be provided in that sort of applications, Considering, that ideology of the active key carrier (AKC) assumes impossibility of "extract" of the key value from the carrier, the task of the key data backup from AKC is not trivial.

We offer hardware-software complex “GOST Key Keeper” based on active key carriers, which allows solving both specified problems effectively: safe storage and application of keys, and also possibility of their backup. The used AKC supports domestic standards of cryptographic protection: GOST 28147-89 and DSTU 4145-2002.

The hardware-software complex «GOST Key Keeper» consists of the unified software for PC, several AKCs in the form of smart cards and the appropriate reader of smart cards. Besides, the AKC of the given complex is integrated with the software «Secure Virtual Drive».

The software of the complex includes:

  • Software of handling of the keys on AKC.
  • Software libraries of the appliance of the keys stored on AKCs.

Hardware in the "USB-token" modification:

  • Two or more smart cards of SIM format.
  • Reader of SIM-cards in the form of USB-token.

Hardware in the "smart card" modification:

  • Two or more full-size smart cards.
  • USB-reader for the contact smart cards.

All AKCs used as a part of one complex are identical by their type. The quantity of AKCs is not limited and defined by the quantity of the users in the protected system, and also by the backup requirements. Every AKC of the complex contains three applications by default:

  • One copy of the “Storage Keys” application - handling with the keys of the access to the storages of information and other informational resources.
  • Two copies of the “Transport Keys” application - handling with the keys for protection of communications and "business" transactions.

The “Storage Keys” application is intended for generation, storage and appliance of the secret keys of the symmetric ecryption algorithm GOST 28147-89. The standard configuration of the application supports up to 5 "long-time" keys with the length of 512 bits (the substitution tables or S-blocks), and up to 4 "session" keys with the length of 256 bits can be associated with each of them. Thus, the application supports up to 20 keys for GOST 28147-89, that can be diversified for various applications.

The installation of the keys of this application should be carried out on a workstation protected from unauthorized access.

Functional features of the “Storage Keys” application:

  • Separation of keys set of GOST 28147-89 onto the named groups on the basis of the sharable associated substitution table (S-block).
  • Configurable structure of the key system of GOST 28147-89 (at the stage of initialization of smart cards).
  • Referencing of the unique 8-byte identifier and also the text name to each key,
  • Maximum length of the name of the key or group is 16 Latin characters (case-insensitive).
  • Storing of the identifiers, and the names of the keys and groups is fulfilled in AKC.
  • Impossibility of "extracting" of the keys values from AKC.
  • Use of hardware random numbers generators (RNG) for generation of the key data.
  • Possibility of "complication" of the hardware RNG output through appliance of the interactive RNG.
  • Function of generation of the substitution tables steady against the attacks of the linear and differential cryptanalysis.
  • Possibility of creation of the secret keys backup copies (at the stage of their installation only).
  • Access isolation to the keys, stored in AKC on the basis of two roles: "Administrator" (keys handling) and "User" (usage of the keys only), protected by different PIN-codes.
  • Support of the PUK-code of the restoring of the "Administrator" blocked PIN-code.
  • Blocking of the PIN/PUK-code after 15 sequential unsuccessful attempts of authentication (the limit can be reduced).

The “Transport Keys” application is intended for protection of communications from threats of confidentiality, authenticity and privicy. The application ensures generation, storing and appliance of the personal keys for the digital signature and the "directed" encryption, and also pair of secret keys («Pre-shared Secret») for symmetric encryption algorithm GOST 28147-89. The keys from the group «Pre-shared Secret» can be installed only at the moment of applications initialization. They can be used by providers of services for authentication of clients/subscribers, for support of additional level of confidentiality and for protection from cloning of carriers.

There are two copies of this application on the AKC in the standard configuration. That allows support of the protected interaction with two absolutely independent providers of services. Each copy is protected by the independent system of PIN-/PUK-codes and also independent from the application “Storage Keys”, that allows practicing even a multi-user usage of AKC.

 

The Application “Transport Keys” configuration:

  • The key of the digital signature algorithm DSTU 4145-2002 with the length of 191 bits (support of two versions of the key: active and next);
  • Key for the key agreement DH scheme on the basis of DSTU 4145-2002 with the length of 191 bits (support of two versions of the key: active and next);
  • One "long-term" key (substitution table) for GOST 28147-89 with the length of 512 bits and two "session" keys associated with it with the length of 256 bits (all three keys are installed only at application initialization).
  • One pair of PIN-/PUK-codes for access isolation to the application keys, (by default, the maximum quantity of unsuccessful attempts of authentication is 15).
  • RNG for generation of all secret keys for asymmetric algorithms.

Configuration of the applications in AKC can be changed upon demand of the customer. Besides, the different-type AKC may be used in the complex simultaneously: either SIM-form cards or full-size cards with appropriate readers.