The flash controller had an example application, in c, which did this properly, in the vendor's driver packageĢc. Compare password to a hash stored on the deviceĢb. The 'unlock' application (with an interface very reminiscent of those awful 2000s digital camera image download apps) took your password and unlocked the device.Ģ.

The flash controller listed AES as a supported algorithm in its datasheet. From what I could tell, it really could have been AES. This was a FIPS-compliant AES encrypted device. Only found that out by trying to convert the numbers into something sensible and found it decoded properly in Chinese. In one case, the password literally was 'Unlock Device', encoded as Unicode, in Simplified Chinese. With some open source software and (first time I did it) a fair bit of Google, you can learn that the only password you need to inject into the bitstream is completely static. You need a disassembler and a USB protocol sniffer (software or hardware).

If I find your encrypted USB device, chances are really good I can decrypt it over a weekend just out of sheer curiosity.

Encrypting external hard drive