From 1ee32c3d0eac8577822a667474c474060b25d90a Mon Sep 17 00:00:00 2001 From: dschuermann Date: Mon, 29 Dec 2014 11:54:18 -0800 Subject: [PATCH] Updated Alternative Passphrase Methods (markdown) --- Alternative-Passphrase-Methods.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/Alternative-Passphrase-Methods.md b/Alternative-Passphrase-Methods.md index e48bca3..9172d8e 100644 --- a/Alternative-Passphrase-Methods.md +++ b/Alternative-Passphrase-Methods.md @@ -3,18 +3,19 @@ As a general mechanism, we can add a non-exportable direct key signature to any Exemplary types of such auxiliary information could be flags that the passphrase should be entered as a pin, lock pattern, or obtained via nfc. ### NFC +* Easily be lost together with the smartphone +* Protects against shoulder surfing +* Remote readable when in pocket? ### Lockpattern +* Weak: Offline brute force attacks +* Smudge attacks ### PIN +* Weak: Offline brute force attacks ## Export As on private key export for a new extra long passphrase to protect against offline attacks! ## Attack model -| Attack | Passphrase | NFC | PIN | Lockpattern | -|-------- |--- |--- |--- |--- | -| Offline brute force attacks | yes | yes | no | no | -| Lend smartphone to other guy | | | | | -| Shoulder surfing | no | yes | no | no | -| Smudge attacks | yes | yes | yes | no | \ No newline at end of file +Differentiate between offline attacks and attacks where an attacker has only short access to the smartphone UI. \ No newline at end of file