lemmysmash

u/lemmysmash@beehaw.org
0 posts · 12 comments

Recent posts

No posts.

Recent comments

"We're tired of constantly listening to your largely incomprehensible speech in attempts to extract any valuable for us information from it. It's time for a change, now we want you to upload the gists of that information to our servers yourself — already in a structured and convenient for us format." — said the spokesman.

PIN code throttling can't be implemented properly if hardware doesn't support it. This is the very purpose of the secure element.

It has its own CPU, storage, random number generator and realtime clock. Once a secret (encryption key) is generated inside of it, it can't get unlocked until this very tiny chip allows it. And the chip uses different kind of protections (in case of weak pins — the most prominent one is throttling using its built-in RTC clock).

If there's no secure element, then attacker can just extract the memory chip and easily brute force the encrypted key on the much more powerful (and not throttled by RTC) hardware.

And since the PIN codes are so weak, even the strongest key derivation functions won't help against such bruteforce.