Thread: Iron key

Anyone using a iron key, just for another layer of protection?

No I have not tried it yet, but I checked it out and it sounds like is has potential.......



IronKey is an Internet security and privacy company located in Sunnyvale, California that was formed in 2005 by David Jevans, with the stated aim of providing security and privacy solutions to both consumers and enterprises. IronKey's founding was partially funded by the U.S. federal government, with a grant of US$1.4 million through the Homeland Security Research Projects Agency,^[1][2][3] and their products have been used extensively by the U.S. government in various areas.^[4][5]

Overview

IronKey manufactures a range of secure USB flash drives, including the IronKey S200 and IronKey D200, which come in three varieties (Basic, Personal, and Enterprise) in sizes ranging from 1 GB to 16 GB (up to 32 GB for the D200). The three versions differ primarily in the software included with them; there are also some hardware differences that prevent the end-user from converting one version to another. All three contain the same level of hardware encryption and are structured with two partitions: an unlocker partition with software handling locking and unlocking, and a secure area. The Basic model has no extra software and is targeted at government and military users, while the Personal includes a portable version of Mozilla Firefox, Identity Manager (an account/password management software), and Secure Sessions. The Enterprise model is intended for corporate and government environments, and is completely configurable by an administrator. As such, it can contain any or all of the software on the Personal edition, along with anti-malware software, RSA, and OTP software.

One of the key design features of the IronKey is a self-destruct mechanism which activates after the user enters his password incorrectly a certain number of consecutive times. On the Personal model ten times is the limit, and on the Enterprise model the count is configurable by the administrator, while the Basic model can be configured to disable this feature entirely. As a safety measure, the device is required to be unplugged and replugged after every three password attempts. After reaching the password limit, the device will delete its encryption keys and instigates a wear level pass on the drive, effectively making the device completely unusable.

A key differentiator of IronKey from software-based encryption solutions is that IronKey's controller does not allow access to the user's data before authentication, even in encrypted form. With a USB drive containing software-encrypted data, full access to the encrypted data is available immediately upon mounting. This allows offline brute-force attacks or cryptanalysis. Instead, with IronKey, the only attack surface available is giving the authentication interface different potential passwords. Because of the (also hardware-based) low limit on password attempts, this makes brute-forcing infeasible. Without getting access to the tamper-resistant hardware, an attacker cannot try hundreds of passwords, let alone the billions required to guess a moderately secure password.

The IronKey S100 has passed FIPS 140-2 Level 2 validation,^[6] and the S200 and D200 have passed FIPS 140-2 Level 3 validation.^[7] As of July 2009, the latter two were the only^[8] USB drives to obtain an Overall Level 3 (although Kingston Technology has stated that Level 3 certification is pending^[9] for their DataTraveler 5000 device).

Bundled software

Secure Sessions is an IronKey-customized fork of the open source Tor anonymizer network, offering similar features to end-users of secure and private web browsing by routing network traffic through a random selection of nodes. Unlike Tor, it only uses private servers (around 22 of them) owned by IronKey in several different countries, including the USA, Canada, Denmark, the Netherlands, and the UK. Users are unable to configure themselves as nodes, which means that the entire system would stop working if IronKey ever ceased operations. While use of all private nodes secures users from potential third-party rogue nodes, it requires the user to trust IronKey alone with their traffic. With a single company (IronKey) controlling all the nodes, a court order against IronKey could result in the entire Secure Sessions network being compromised.

Bump