Comments on: various stuffs http://www.reactivated.net/weblog/archives/2005/09/various-stuffs/ they got a skin and they put me in Mon, 06 Feb 2012 21:01:21 +0000 hourly 1 http://wordpress.org/?v=3.1.3 By: dsd’s weblog » Blog Archive » Digital Persona UareU Fingerprint Sensor driver for Linux http://www.reactivated.net/weblog/archives/2005/09/various-stuffs/comment-page-1/#comment-536 dsd’s weblog » Blog Archive » Digital Persona UareU Fingerprint Sensor driver for Linux Sat, 12 Nov 2005 12:43:48 +0000 http://www.reactivated.net/weblog/?p=60#comment-536 [...] I recently mentioned my new project of attempting to write a Linux driver for the “Microsoft Optical Desktop with Fingerprint Reader” keyboard. The keyboard works fine already (its just HID), but the fingerprint reader sensor requires its own driver, which I’m aiming to create. [...] [...] I recently mentioned my new project of attempting to write a Linux driver for the “Microsoft Optical Desktop with Fingerprint Reader” keyboard. The keyboard works fine already (its just HID), but the fingerprint reader sensor requires its own driver, which I’m aiming to create. [...]

]]> By: Fredrik http://www.reactivated.net/weblog/archives/2005/09/various-stuffs/comment-page-1/#comment-360 Fredrik Tue, 20 Sep 2005 15:42:46 +0000 http://www.reactivated.net/weblog/?p=60#comment-360 Regarding the fingerprint reader encryption algorithm, the XTEA algorithm could be a good first bet. I did some Googling, and found this (1) review, where some information regarding the security of Microsoft's standalone device is given. It wouldn't be far fetched to believe that the same hardware is used for Microsoft's standalone and keyboard combo fingerprint readers. The standalone units (at least) are apparently built by Digital Persona according to (2). Coincidentally, the information given about the security in (1) seems to be derived from blog comments in (2), where they describe the workings of an APC fingerprint reader and not the Microsoft one. The source of the information is shady as well, and I'm not 100% sure the mechanics described make much sense. Which is all a bit confusing. I haven't been able to find much information on who built the APC one (as I doubt they do anything besides buying an OEM reader and slapping their name one it) but then I didn't look very hard. Anyway, Microsoft don't recommend using their fingerprint readers for serious security measures, which should mean that it isn't a tamper-resistant hardware platform with a signed key exchange, 256-bit AES encryption and a whole slew of bells and whistles added to that. I guess poking around the driver software would be the best option. Chances are the key is in there somewhere. Hehe, I'm not sure I made much sense above, bit may just be pointless drivel. I stumbled across your blog whilst at the Beagle site and killed some time Googling a subject which interests me (namely security). If I had a similar fingerprint reader myself, I'd offer to help, but unfortunately I don't. (1) - http://www.globetechnology.com/servlet/story/RTGAM.20041115.gtfingernov15/BNStory/TechReviews/ (2) - http://blogs.msdn.com/mswanson/archive/2004/12/03/274170.aspx Regarding the fingerprint reader encryption algorithm, the XTEA algorithm could be a good first bet. I did some Googling, and found this (1) review, where some information regarding the security of Microsoft’s standalone device is given.

It wouldn’t be far fetched to believe that the same hardware is used for Microsoft’s standalone and keyboard combo fingerprint readers.

The standalone units (at least) are apparently built by Digital Persona according to (2). Coincidentally, the information given about the security in (1) seems to be derived from blog comments in (2), where they describe the workings of an APC fingerprint reader and not the Microsoft one. The source of the information is shady as well, and I’m not 100% sure the mechanics described make much sense.

Which is all a bit confusing.

I haven’t been able to find much information on who built the APC one (as I doubt they do anything besides buying an OEM reader and slapping their name one it) but then I didn’t look very hard.

Anyway, Microsoft don’t recommend using their fingerprint readers for serious security measures, which should mean that it isn’t a tamper-resistant hardware platform with a signed key exchange, 256-bit AES encryption and a whole slew of bells and whistles added to that. I guess poking around the driver software would be the best option. Chances are the key is in there somewhere.

Hehe, I’m not sure I made much sense above, bit may just be pointless drivel. I stumbled across your blog whilst at the Beagle site and killed some time Googling a subject which interests me (namely security). If I had a similar fingerprint reader myself, I’d offer to help, but unfortunately I don’t.

(1) – http://www.globetechnology.com/servlet/story/RTGAM.20041115.gtfingernov15/BNStory/TechReviews/
(2) – http://blogs.msdn.com/mswanson/archive/2004/12/03/274170.aspx

]]>