Tamper-evident paper-mail box for secure distribution of one-time pads

A simple device for secure transportation of OTP keycards, solves the problem of secure distribution of encryption keys. Tampering will be detected.
This is part three in a series about secure communication:
1. Random Number Generator [150116]
2. One-time pad OTP Crypto System [160510]
3. Tamper-evident paper-mail box for secure distribution of one-time pads (this article)
After having generated one-time pads (see Part 2) using the true random-number generator (see Part 1), the SD cards containing the keyfiles need to be transported securely to a remote peer. This device enables the secure transportation through any papermail or any similar carrier. Opening the metal box and reading the contents of the SD card can't be prevented, but then the recipient will be warned and this OTP keyfile will never be used for encryption. The eavesdropper will then only end up wil gigabytes of useless random numbers.
Description of operation:
-The circuit inside an aluminum box is powered with one CR2032 button battery. Totaly enclosed inside the aluminum box, with only two drilled holes for IRDA interface.
-The area around the SD card inside the box is "protected" by two open-plate capacitors and one phototransistor.
-If the Cx1 or Cx2 capacitance, or T1 illumination changes significantly, the SRAM zeroisation is triggered. The same happens if the battery voltage drops too low, or if a wrong "challenge" sequence is entered through the IRDA.
-If a recipient enters a correct "challenge" sequence through the IRDA, the correct "response" sequence is returned through the IRDA. Now the recipient knows that nobody has tampered with the box during the tranportation. The random number sequence on received SD card is now OK to be used for encryption.
-Both "challenge" and "response" sequences are kept in MCU SRAM. They are defined through the IRDA before sending a packet through a papermail. The SRAM bytes are inverted bitwise every 1 second to avoid various "burn-in" effects inside SRAM memory.
1. Random Number Generator [150116]
2. One-time pad OTP Crypto System [160510]
3. Tamper-evident paper-mail box for secure distribution of one-time pads (this article)
After having generated one-time pads (see Part 2) using the true random-number generator (see Part 1), the SD cards containing the keyfiles need to be transported securely to a remote peer. This device enables the secure transportation through any papermail or any similar carrier. Opening the metal box and reading the contents of the SD card can't be prevented, but then the recipient will be warned and this OTP keyfile will never be used for encryption. The eavesdropper will then only end up wil gigabytes of useless random numbers.
Description of operation:
-The circuit inside an aluminum box is powered with one CR2032 button battery. Totaly enclosed inside the aluminum box, with only two drilled holes for IRDA interface.
-The area around the SD card inside the box is "protected" by two open-plate capacitors and one phototransistor.
-If the Cx1 or Cx2 capacitance, or T1 illumination changes significantly, the SRAM zeroisation is triggered. The same happens if the battery voltage drops too low, or if a wrong "challenge" sequence is entered through the IRDA.
-If a recipient enters a correct "challenge" sequence through the IRDA, the correct "response" sequence is returned through the IRDA. Now the recipient knows that nobody has tampered with the box during the tranportation. The random number sequence on received SD card is now OK to be used for encryption.
-Both "challenge" and "response" sequences are kept in MCU SRAM. They are defined through the IRDA before sending a packet through a papermail. The SRAM bytes are inverted bitwise every 1 second to avoid various "burn-in" effects inside SRAM memory.
Updates from the author
lux36 5 years ago
Firmware was improved for more stable operation and power-saving.
IrDa interface schematics (18kb)
Firmware for both Atmel AVR MCUs (130kb)
lux36 5 years ago
So, a module with unrecoverable analog memory is added. This can be used, for example with analog camera film tape. First, a picture containing and additional response code is taken with an analog camera. Then, the film is put inside a small dark cylinder, along with a magnesium flash bulb. The recepient enters the challenge code and opens the box. Then he will develop the film and check the contents of the picture (this is an additional "response" to correct challenge).
In case of tampering, the Mg photo-flash bulb will fire and over-expose the film, so the information on it will be irreversibly destroyed.
lux36 5 years ago
lux36 6 years ago
Secure box schematics (28kb)
Firmware for both Atmel MCUs (106kb)
lux36 6 years ago
img-20181011-232454.jpg (814kb)
img-20181011-232507.jpg (698kb)
Used for 2-way communication with the box. Secret codes entering and checking. (789kb)
lux36 6 years ago
Problems with data remanence (695kb)
Johannes Roeder 6 years ago
lux36 6 years ago
Poul Borg Petersen 6 years ago
eduino.io #oetelx 6 years ago
I will just think aloud here...
You seem to have a box with random data and someone must unlock it to access this random data you generated.
1) The random data inside the box is the private key you want to use for the exchange and encryption of your future data transport?
2) This random data is the encrypted message?
3) The data is something else?
4) The data is not valueable, because you destroy it first change anything unexpected happens? So you must have a way to request the data again and have some secure vault for requesting this data from?
The key to unlock the 'data in the box' needs to be given to the receiver in a way that it is not being intercepted or could be related/correlated to the box that it can unlock, is that the problem? (the chicken egg problem)
It is more important that someone else does NOT get the data than that you get the data?
I would suggest reading some papers or books on the basic principles of encryption and getting a feel of what already has been done.
I personally have a copy of the 1994 edition of "Cryptography: Protocols, Algorithms, and Source Code in C" by Bruce Scheier.
Whenever I think about something "smart and original", I look in the book and find someone already has done it before and thought about it a lot more than I could. (most things have already been invented)
So my basic question is : What is the specific use case, what problem are you trying to solve?
Good luck,
Edwin van den Oetelaar
lux36 6 years ago
thank you for your interest for my projects. This project is a logical sequel to my two previous projects:
1.) TRUE RANDOM NUMBER GENERATOR, published in Elektor March/April issue 2017:
https://www.elektormagazine.com/labs/random-number-generator-150116
Generates gigabytes of random numbers from electronic noise, to be used for one-time pad encryption.
2.) ONE-TIME PAD CRYPTO SYSTEM, designed PCB, tested prototype, to be published in Elektor soon:
https://www.elektormagazine.com/labs/one-time-pad-otp-crypto-system
A system for OTP encrypted communication, online or offline. See the project page.
Like with any symmetric crypto system, secure distribution of keys is a problem. An SD card contains the key. Hand-to-hand delivery is one way. Paper-mailing is another way. This device solves the problem of secure paper-mailing.
lux36 6 years ago
After a reception of the packet, the recepient does the following:
1.) He simply calls the sender (or sends him an e-mail), and informs him about the reception . Both sides can now use any unsecure communication channel.
2.) Sender now gives him both challenge and response codes. Please note that now it is completely irrelevant if this communication is intercepted (unsecure channel is used), when the box is in secure place (recepinet's hands). A potential eavesdropper would need to have the codes before, so he could open the box (now the SRAM will zeroise), take the SD card, read the data from the SD, put the card back, close the box, and re-enter both codes to SRAM to cover up everything.
3.) Recepient communicates with the box through the IRDA. Enters the challenge and checks the response.
4.) If the response is correct, it means that there was no tampering during the transport.
5.) The recepient now opens the box and takes the SD card. Secure communication through OTP crypto system is now clear to start.
lux36 6 years ago
1.) Yes, this is the OTP random number sequence generated with the TRNG, to be used for OTP encryption.
2.) This random data is a random meaningless sequence that is to be used for encryption of sensitive data if the box gets delivered to the recepient without tampering along the way. This data is not an encrypted message - anyone can open the box along the way and read it and eventually decrypt it, so we don't risk that.
3.) The answer is at 1.)
4.)
-You don't actually destroy the data on the SD because zeroising the data in SD card is very slow and difficult. You simply declare it invalid and insecure by zeroising the the challenge and response in MCU SRAM which is much easier.
-If the box has been tampered with, the recepient can use his RNG to generate a new sequence on a new SD card and send it to the original sender. Maybe it won't be tampered with this time... No special secure vault is needed, every pair of peers can generate the random numbers from their RNGs.
-Check my answer to Poul Borg Petersen about the challenge-response procedure to check for possible tampering during the transport. As you can see, intercepting it is actually no big deal if the secure key (random seauence) on the SD hasn't been read. The only problem is if somebody manages to actually alter the challenge or response, but this is much harder to do.
-Someone else getting the data is not a problem because this is a meningless random sequence. It is enough to simply warn the recepinet about it.
-I read "Secrets and lies" from Bruce Schneier and also "Applied Cryptography" from the same author. Basically I like Bruce as an expert, although I don't share his harsh legalistic attitudes - like calling Kevin Mitnick "a convicted criminal hacker".
-A good RNG and a good crypto device solve the problem of virtually unbreakable OTP encryption. Tamper-evident box solves a problem of secure distribution of OTP keys. I am not a very good mathematician, so I trust OTP method because its mathematical background is very simple. That's why I chose the OTP.