Raidon rolls out STARAY S Series data encryption boxes

Those that somehow still haven't found a drive or drive enclosure that meets their security / paranoia needs may want to take a gander at one of Raidon's recently released STARAY S Series "data encryption boxes," which offer a number of different security measures to keep your data away from prying eyes. That includes plain-old software password protection on the S1 Series device, fingerprint protection on the S2 model, and keypad-based password protection on the S3 box (pictured above). Otherwise, each one will give you a so-called "X-Zone" partition on the drive that is invisible without the key, along with "S-Code" technology that encrypts the data in the X-Zone. You will have to supply your own 2.5-inch hard drive, however, although the enclosure's screw-free design should at least make that a relatively easy process, assuming you can find one, that is -- it seems like retailers are a little slow to pick these up.

[Via BIOS]

[Funke, Tobias Dr. @ May 2nd 2008 2:46PM]

Raidon?
...I guess it's slightly less menacing than Azbeztoz.

[Brent @ May 2nd 2008 2:49PM]

Meh, these will surely be overpriced...just get a regular external drive and load up Truecrypt.

http://www.truecrypt.org/

[mattydread @ May 2nd 2008 2:55PM]

So if the enclosure is so easy to open, what prevents access to the chip that holds the encryption key?

[phil @ May 2nd 2008 4:54PM]

I work with crypto devices (risk and vuln analysis), and usually there are two main physical safeguards used to deny access to vital components. The least common (or at least I haven't seen it lately) is a UV sensitive PROM holding any stored keys and sensitive routines/algorithms*. As soon as any natural light hits it, it basically resets itself to a "ready to program state".

The other, much more common, is a blob of hardened opaque epoxy over the chip/chips/or daughterboard that bonds with the outer layer of the chip. The opaqueness has two advantages: you can't get the exact model number of the chip to narrow down what pinouts do what, and you can't see how the pins are aligned relative to the rest of the circuit (plus not all the circuits leading into the blob/chip are real) making it difficult to determine how to get meaningful output.


* - of course any company that feels the need to obfuscate or use proprietary crypto routines is a company best not used. Other than *maybe* giving you hints about the possible sizes of the keyspace, knowing what algorithm is used (3DES, AES, Blowfish) is next to useless in trying to decrypt without a key.

[phil @ May 2nd 2008 4:56PM]

I forgot to add:

Plus, if you try to remove or dissolve the epoxy, you end up destroying the chip.

As always, the absolute easiest way to get someone's key for encrypted data is a baseball bat, pliers and a blow torch. (for the slower members: you torture the key owner rather than do crypto-analysis).

[Richy @ May 2nd 2008 6:05PM]

Indeed. I wouldn't class myself as a security specialist (unlike Phil, who seems to know what he's talking about), but I am the lead architect on a a payment card industry data security standards project for a huge multinational company -- so I do pretty much know what I'm talking about (or know people that do!).

And, in most cases we'd say that once someone has physical access to a device, then all bets are off (especially if they have access to a freeze spray!). And, n this case, I'd say that the offerings from this company do appear to be 'security theatre'. In other words, it all sounds reasonable and secure, but actually isn't at all. Kind of like security at an airport. It's not there to stop terrorists blowing up a plane, it's there to make people feel sae about flying (those x-ray machines, or more importantly their operators, will never pick up a carefully concealed explosive device).

Sweet dreams,

RichyS

[Raidon STARAY S @ May 2nd 2008 3:05PM]

Hello, I am Raidon STARAY S and I'm gonna encryptz all ur datazzz

[vincus @ May 2nd 2008 3:13PM]

64 bit "dunno kind" encryption... Id rather use some AES 128 or above capable device...

-v-

[BigD145 @ May 2nd 2008 3:14PM]

I'm guessing I could just pop out that hard drive and put it in my own enclosure. Then ghost the drive and put everything back. Hardware and software keys can be emulated and/or broken.

Instead of buying this thing, I'd rather just take a cheap 2.5" drive enclosure and maybe, I don't know, pop it in my pocket when I need to pee? Just a thought.

[TheGeektoriousBIG @ May 2nd 2008 3:14PM]

So...I guess my pr0n is safe???

[theidoctor.org @ May 2nd 2008 3:26PM]

yea... sounds too complicated... truecrypt is amazing! it almost looks cool though!

[Kwai Noi @ May 2nd 2008 9:37PM]

One of the first signs of snake oil in encryption is when they won't tell you what encryption is used.

Any modern encryption system (AES, Blowfish, Serpent, etc) does not need to be hidden. They are strong enough (with a good key) to be almost unbreakable with a brute force attack.

(anything is possible but if you use a key from here:
https://www.grc.com/passwords it is highly unlikely to be guessed)

Even police and government agencies usually get the key by social engineering the person into revealing it. Or looking at the bottom of the keyboard ;-).

And if you are worried about the government getting your drive and seeing what you have on it you have a lot more problems than would be solved by this thing.

A good place to learn about security is:
http://www.grc.com/securitynow

[Lysander_Spooner @ Aug 6th 2008 1:00AM]

"... if you are worried about the government getting your drive and seeing what you have on it you have a lot more problems than would be solved by this thing." AKA:"if you're not breaking the law, you have nothing to worry about."

So that whole 4th Amendment (et al) thing was just so much bull sh!t and a waste of good parchment?
If there is a just God, people like you will be the first into the boxcars.