Dan Griffin's Blog
Comments on security, PKI, smart cards, cryptography, and entrepreneurship.
Smart card-protected document scanning
November 15, 2008
HP is working with the US DoD to provide multi-function printers that allow document scanning only after a valid smart card has been produced. Read more here.
It’s an interesting scenario, although it got me thinking about some other things. For example, I wonder how they implemented the authentication. Did they create a custom protocol? Not usually a good idea. I wonder how they handle certificate revocation checking, cert extension/usage requirements, and validating the private key. What happens if the printer is unplugged from the network - I can’t scan?
Might be better to use TLS client auth, although it’s still a question of where the server is running, what root certs are trusted, etc.
I was also thinking that a more interesting scenario would be to protect documents left in the printer output tray. In the scanning scenario, I’ve already got my hands on the original document, so what difference does it make that I have to authenticate in order to scan it?
Better that I can’t get my hands on the print out in the first place. Requiring authentication at the printer in order to retrieve the copy would help address that, rather than risking that a document is stolen between the time the print command is issued at the client computer and when the employee walks over to the printer to pick it up.
Permalink |No Comments »
No comments yet.
RSS feed for comments on this post. TrackBack URL
