Submission + - NIST Investigating Mass Flash Drive Vulnerability (computerworld.com)
Lucas123 writes: A number of leading manufactures of encrypted flash drives have warned their customers of a security flaw uncovered by a German company. The devices in question use the AES 256-bit encryption algorithm and have been certified using the FIPS 140-2, but the flaw appears to circumvent the certification process by uncovering the password authentication code on host systems. The National Institute of Standards and Technology said it's investigating whether it needs to modify its standards to include password authentication software on host systems. Security specialist Bruce Schneier was blunt in his characterization of the flaw: "It's a stupid crypto mistake and they screwed up and they should be rightfully embarrassed for making it."