IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 10
DEVICE SECURITY
Data Encryption Keys
»
AES key generated by onboard Random Number Generator
»
AES key generated at initialization time and encrypted with hash of user password
»
No backdoors: AES key cannot be decrypted without the user password
»
AES key never leaves the hardware and is not stored in NAND flash
Data Protection
»
Secure volume does not mount until password is verified in hardware
»
Password try-counter implemented in tamper-resistant hardware
»
Once the password try-count is exceeded, the device will initiate a permanent self-destruct
sequence
»
Sensitive data and settings are stored in hardware
APPLICATION SECURITY
Device Password Protection
»
USB command channel encryption to protect device communications
»
Password-in-memory protection to protect against cold-boot and other attacks
»
Virtual Keyboard to protect against keyloggers and screenloggers
The device password is hashed using salted SHA-256 before being transmitted to the device
firmware over a secure USB channel. It is stored in an extremely inaccessible location in the
protected Cryptochip hardware. The hashed password is validated in hardware (there is no
―getPassword‖ function that can retrieve the hashed password). Only after the password is
validated is the AES encryption key decrypted.The password try-counter is also implemented in
hardware to prevent memory rewind attacks.
IDENTITY MANAGER PROTECTION
The Identity Manager and your online account work together, allowing you to back up your
online passwords to your Online Security Vault. First, you must unlock your device using two-
factor authentication.Your passwords are securely stored in a hidden, hardware-encrypted area
inside the device (not in the file system), being first locally encrypted with 256-bit AES, using
randomly generated keys encrypted with a SHA-256 hash of your device password.All of this
data is then doubly encrypted with 128-bit or 256-bit AES hardware encryption.
When you back up your passwords online, your device performs a complicated public key
cryptography handshake with IronKey’s services using RSA 2048-bit keys. After successful
authentication, your encrypted block of password data is securely transmitted over SSL to your
encrypted Online Security Vault.
