So I installed an nShield Connect HSM and a Windows Server 2012 R2 machine. I wanted to achieve two goals:

(1) Using the a nShield HSM (aka enrollment)

(2) Use the nShield Support Software (v. 11.70 is recommended for Windows Server 2012 R2) to support OpenSSL's chil engine

Part I : Enrolling a Net HSM

This was rather obvious, use the IP address of the server so that the nFast server connects to that remote server. I will use CLIENT as the name of the client machine and SERVER as the nShield Connect HSM connected on the network.

1. Find out the device's kNeti Hash and Electronic Serial Number (ESN)
       anokneti.exe [Hsm-IP-Addr]
2. Copy the output of the above command and paste after the [IP] below
       nethsmenroll.exe [Hsm-IP-Addr] [Output from Anonkneti]
3. Success! You should be able to run nfkminfo.exe and enquiry.exe without errors.

Useful Hints

• Make the directory containing the config and keys fully controllable by your normal/power user. This is set in the environment variable %NFAST_KMDATA%
• Windows Server 2012 R2 CAPI keys and containers are *sometimes* made without the proper permissions, so running icacls to reset permissions on the %NFAST_KMDATA%\local directory works wonders.

Part II: Using the OpenSSL CHIL Engine

The few differences found are subtle but definitely very important.      

1. Setup some environment variables, from the command prompt run the following commands.
       SET LD_LIBRARY_PATH=%NFAST_HOME%\toolkits\hwcrhk
       SET LIBPATH=%NFAST_HOME%\toolkits\hwcrhk
       SET OPENSSL_CONF=%NFAST_HOME%\lib\ssleay\openssl.cnf
2. nCipher provides an OpenSSL config file that is almost ready to use. But sometimes it points to the wrong DLL depending on how you installed your software. The file path is: %NFAST_HOME%\lib\ssleay\openssl.cnf and you should check under the [chil] section. For my particular setup, the section looks like below, notice in bold the path matches the value stored in %NFAST_HOME%:
       [chil_section]
       SO_PATH=c:\nCipher\nfast\toolkits\hwcrhk\nfhwcrhk.dll
3. I highly recommend setting up the path variable so that the nCipher-provided version of OpenSSL is used (0.9.8e 23 Feb 2007). This version is located in the %NFAST_HOME%\bin
       SET PATH=C:\nCipher\nfast\bin;%PATH%
4. Now, the engine should be properly configured. To verify run the following command.
       openssl.exe engine -t chil
5. Expected output is below.
            (chil) CHIL hardware engine support
       [ available ]
6. Congratulations! You are DONE!

Is the car manufacturer to blame? Or the roads that let the bandit travel with the stolen car? The alarm manufacturer? Or yourself, for not handling your keys properly and safely?

Recent attacks, such as the ones performed on Opera recently, and previous to other corporations are similar. Having read multiple sources, it does not seem that anyone is even looking at the way the keys were protected. Most people think that keys are protected by default with some magical OS features, but the reality software is software, for things that are as important as cryptographic keys that relate your company to a digital publisher identity, you need something more. This is where special purpose hardware devices come into play. Widely known as Hardware Security Modules, or HSMs; these devices are incapable of leaking keys, even when the software that uses the keys is compromised. The reason for this is that most of these have hardware that prevents this from happening, regardless of whether you are an domain admin or hacker. I have to admit setting these up is not completely straightforward, and there is a cost associated around it. There is also a price to pay when your software gets hacked and is responsible for letting hackers steal people's information (see PSN hacks for reference). Simple mechanisms ARE available, an example is a $10 smart card. With some research and smarts those $10 will net you a lot of ROI down the road.

Some of the comments I have read include this one: “It’s become clear that certificate-based attacks have become the attack vector of choice. Organizations must implement effective controls to ensure the safety of their network.” - Jeff Hudson, CEO Venafi. This completely overlooks the key management as an issue, and exemplifies the common thinking around organizations. There is nothing bad about securing your infrastructure, but the cryptographic keys are misunderstood individuals, they require much more care, so they must be protected at rest, in use and in transit (well NO transit is preferred). As long as the IT Security Pro's keep making these mistakes, the statement from Mr. Hudson around certificates being used as an attack vector will remain true. Its the most bang for buck, if you had 37 minutes (see: Opera hacking @ https://threatpost.com/opera-hack-certificate-theft-redirects-thousands-to-malware/#comment-93022) what would you take? The jewels! Of course, the most valuable assets.

If you are like me and many bilingual folks, the overall experience is best when using English for menus, options, etc. But it is a major "fail" when the auto-correct feature, works in the menu language only. So yes, they made this fix with the WP7. You can add multiple keyboard layouts, and it will automatically change the auto-correct language, and NOT the menus, and options. This is AWESOME! This made my wife's iPhone 4 very jealous! This makes texting, and writing on Facebook SO much better!

I like it, so how do I do it!?

Steps:

1. Open the "Settings" app
2. Scroll down to "Keyboard" and select it
3. Select the first option (Defaults to US or whatever they set on your carrier)
4. Select whichever ones you want

When you open a messaging window, there will be a keyboard language icon on the bottom, so you can switch languages and dictionaries on the fly. Ain't that cool!

Where's the beef?

Let's cut through the chase, the device is awesome and works very well. I do have a big living room, so I spared 10 feet of space no problem. I do have good lighting conditions as well, so I had to do close to no calibration. My kids loved it and the 4 year-old has been sweating while playing. As a health-conscious parent, this was critical for my purchasing decision, I wanted my kids to be active. I have a two year old and she already has the Kinect expectation, she believes that the TV can “see” her and she waves at the game to play it. The only real thing it lacks at this moment is the game selection. It has great games, started with nicely. But I want to see the next blockbuster, which I suspect will come sooner rather than later. Other than this, we have witnessed a game changer, our kids will most likely laugh at us when we show them a controller device 20 years from now.

Wish List

Games I wish would come out (*hint*) for the Kinect that would definitely be blockbusters on my head:

1. Grand Theft Auto Kinect Edition – Come on, you can run, punch, kick, shoot, drive with the device. This is only a natural for this thing.
2. Kinect Star Wars – Thankfully, this is already in the works. I can imagine myself buying two small light sabers from a toy store and wielding them for the ultimate Jedi experience.
3. Martial Arts Trainer – We have enough zumba, Tai-Chi and dancing, let’s do Karate and Judo!
4. RPG – Come on, chanting spells, and making hand gestures to throw a fireball have definite appeal.
5. Shooter – I realize that these will probably require a hybrid approach, so someone needs to come up with a simple hand-wrapped controller
6. Power Glove – Okay, it’s not a game, but how complimentary to the whole experience would THAT be? I’m thinking about the Nintendo Power glove. You can do analog and fine-hand controls, maybe add in a fire button, even better trigger motion!

So I installed a Net HSM and a Windows Server 2008 R2 machine. I wanted to achieve two goals:

(1) Using the a Net HSM (aka enrolling)

(2) Use the HSM to support OpenSSL/MSCAPI at the same time

Update: I am using Windows 7 Enterprise for the client, using version 11.11 of the nCipher tools on both machines.

Part I : Enrolling a Net HSM

This was rather obvious, use the IP address of the server so that the nFast server connects to that remote server. I will use CLIENT as the name of the client machine and SERVER as the Net HSM installed on the network.

• 1. Enroll the SERVER on the CLIENT (replace IP with the IPv4 address of the SERVER):

nethsmenroll.exe -p -V [IP]

• 2. Enroll the server in RFS syncing (assumes SERVER has RFS already setup)

rfs-sync .exe --setup --no-authenticate [IP]

• 3. Sync the client files.

rfs-sync.exe -U

• 4. Success! You should be able to run nfkminfo.exe and enquiry.exe without errors.

Useful Hints

• I usually "restart" nFast Server service after every step that requires changes to the configuration.
• Make the directory containing the config and keys fully controllable by your normal/power user. In Win7 this directory is C:\PROGRAMDATA\nCipher.
• Windows Server 2008 R2 keys and containers are made without the proper permissions, so running icacls *.* /reset on the KMDATA\local directory works wonders.

Part II: Using nCipher with OpenSSL

I used the Andrea Campi's great blog post as a starting point for this, so some of the credit goes to him.

The few differences found are subtle but definitely very important.      

• 1. Setup some environment variables

LD_LIBRARY_PATH=c:\nCipher\nfast\toolkits\hwcrhk
LIBPATH=c:\nCipher\nfast\toolkits\hwcrhk
OPENSSL_CONF=c:\nCipher\nfast\lib\ssleay\openssl.cnf

• 2. nCipher provides an OpenSSL config file that is almost ready to use. But it points to the wrong DLL depending on how you installed your software. The file path is

NFAST_HOME%\lib\ssleay\openssl.cnf

• The section you should verify points to the appropriate DLL is:

[chil_section]
SO_PATH=c:\nCipher\nfast\toolkits\hwcrhk\nfhwcrhk.dll

• 3. I highly recommend setting up the path variable so that the nCipher-provided version of OpenSSL is used. This version is located in the

%NFAST_HOME%\bin

• I did this setting up my own PATH variable

SET PATH=C:\nCipher\nfast\bin;%PATH%

• To verify this, you can run

OpenSSL.exe version

OpenSSL 0.9.8e 23 Feb 2007

• 4. Now you can verify that the CHIL engine is working

openssl.exe engine -t chil

(chil) CHIL hardware engine support

[ available ]

• 5. Congratulations! You are DONE!

Overall: The experience was amazing, I would definitely like to try some games out (and will do so on Nov. 4th)! I expect some game genres to benefit much more than others. I can see dance, fitness, action, adventure and RPG's as the big winners. Fighting might be challenging, you would need somewhat of a physical condition that can take the punishment. I can foresee using the Kinect as an "augmented reality" sort of device, where the use of another device in conjunction with body movements can certainly be very interesting and fun. I can definitly see how Wii can move around and use other sensors to augment the player's experience, the same as the Move. I haven't tried the Move yet, and it would be an interesting trial. I can honestly see people making their own gear to play Kinect games, since it would be cool to make your own physical item, to enhance the experience, not that the experience is on a whole new level as it is. As developers continue to learn how to leverage Kinect (and I hope they eventually open this up for XNA Community Content), and combine this with the Live experience I can definitely see the lines between fact and fiction blur... Now I need the 3D glasses that go with the Kinect in order to get the job done!

(a) Convert image to UDRW (so I could modify the image contents)
(b) Mount the image
(c) Modify contents
(d) Unmount the image
(e) Convert to UDCO (compressed image format, so I could save space and bandwidth)

So between (d) and (e) I was getting a "Resource Temporarily Unavailable" error, with code 35. Looked this up on the internet, and it means that there is a lock on the resource. I ran a "ps -e" command and saw a bunch of diskimage-helper processes, just standing there with a -post-exec parameter. I killed all of the processes related to this and conversion worked fine. So I ran the process again and monitored processes. Again, the process was left running, even after unmounting the image.

Solution: It seems that even though the hdiutil tool, which I used to mount and unmount, has what appear to be equivalent command parameters; they are not equivalent. Changing hdiutil unmount to hdiutil detach solved the problem.

GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

 Enjoy!

• You can mount VHD's (virtual hard disks) as drives.
• You can boot from VHD's!
• New taskbar (good and bad, some like it some don't)
• Libraries
• Gestures
• SPEED
• SPEED
• Did I mention speed?

Yes besides the obvious improvements in overall system responsiveness you got a few little features. One that will probably go under-appreciated are libraries. It just so happens that I like to keep stuff from the same topic together. Not always are the files related to a specific topic only documents, or only videos. So the layout for "My Documents", My Pictures", etc. usually forces me to duplicate the same folder structure on all of them. My C# documents could go into My Documents\CS; consequently my C# projects would be in My Projects\CS; rinse and repeat. While the need for making a folder structure might not change from night into day here, with libraries there is an unlocked potential.

Let me explain libraries real quick. Libraries are basically a flat structure of place-holders. Each place-holder has a description and a list of folders associated to it. This enables a single place for multiple folders to appear as one structure which can be traversed ini various interesting ways not available in the previos file management tools. Tags and name ordering being of most use. Ordering by name will allow you to see all files within those folders in alphabetical order. Ordering by Tags will allow you to group previously-tagged files (not all file types support tags). So how does this help?

 Let's imagine this scenario. I have the following in topics: School, Work, Personal. I make the following structure in a folder somewhere on the disk, maybe in the user profile root? I make a folder structure in that resembles my needs, for example Work\Documents, Work\Videos and Work\Projects. I can look at it in from a top to bottom approach as well. I make Documents\Work, Videos\Work and Projects\Work. I do the same thing with all topics. I then adjust my libraries to reflect this structure (and indexing as well). So my Documents library would contain all documents folders from all topics in one view. I can order all these files in any way I wanted, and if they are tagged then I can find specific sub-topics within a particular topic. Example Work\Documents, tag Crypto would give me all my work documents with the Crypto tag.

Libraries add the definite possibility of adding "views" as an alternate way to organize and search your files. Future enhancements to this feature could really make it an innovative way to make file management. As for now, I am enjoying this neat little feature that has allowed me to simplify how I manage my files.