[fprint] About DigitalPersona U.are.U 4500

[Daniel Drake]

Jeff Yang wrote:
> Yes, the encryption is done by the device itself. But is it possible
> that they write their own algorithm to simulate Windows Crypto API to
> encrypt the image so that in their windows driver they can use Windows
> Crypto API to decrypt the image easily? The reason of my guess is that
> the following functions are called in DPCOper2.dll, DPCrStor.dll and
> DPFPApi.dll:

I'm pretty confident that their driver would just push the encrypted 
data into the crypto API and then ask for it to decrypt it. This is 
exactly what we would do on Linux using something like openssl - no 
point reimplementing the world of cryptography.  And we actually already 
do almost exactly this to implement the secret microsoft handshake. We 
use openssl for that -- but it doesn't mean that everyone in the world 
has to use openssl to do the same thing.

Their choice of decryption library is not important. The *knowledge* of 
how to decrypt is what is missing.

Daniel