Functionality

The Padlock 2 ships without a PIN defined. To enter one, simply press and hold the lock button until both the red and green LEDs light up. After which you can enter a pin between 4 and 10 digits. To confirm, one has to reenter it after hitting the lock button once again. From that moment on, the stick is inaccessible until the right PIN is entered. One has to enter the code when the Padlock 2 is not connected. If this is not done the red LED will blink once the flash drive is inserted into the USB port.


Once the correct PIN is entered, the green LED lights up, after which you can plug it into the PC and the data is accessible. If you enter the wrong PIN or none at all, the red LED denotes the fact that the Padlock 2 is still locked down and the data still encrypted. While a brute force attack may be possible, the Padlock 2 disables itself for two minutes after five unsuccessful PIN entries.

Corsair has also enabled the setting of a master PIN, which allows IT administrators to reset the user PIN. So if a company hands out the drives to their employees, the administrator sets his own master PIN in case the employee forgets his own personal PIN to access the Padlock 2. Once this master PIN is entered, the user PIN is reset and the Padlock 2 unlocked. The user may then set a new PIN to lock the device and its contents. Please note that entering the master PIN does not erase any data. From this we can infer that data inside the flash chip is not encrypted using the user's PIN, but using a key that is stored inside the drive controller.

Another important feature is that when you hold the key icon button and 0 or 1 for three seconds, then enter 911 as password, it will erase all data on the flash drive and remove both the master and user PIN. So even if you lose your passwords you can restore the drive to brand new factory conditions, just don't tell your friends!


During the reviewing process, W1zzard asked if the unit really had 10 buttons or if a PIN like 01234 equaled 11234, as both 0 and 1 shared one button. This would mean that the Padlock 2 does not give the user user to choose from 10 digits, but from a mere 5. Curious as I was, I took my sharpest kitchen knife and went to work, taking the Padlock 2 apart. Upon removing the rubber casing, the fairly compact flash drive along with simple buttons can be viewed. At this point it started to look like there are really only five buttons and the top "key" one instead of 10 distict ones for the PIN. But just to make sure I dug deeper.


After removing the plastic shell, the single PCB is exposed. The Padlock 1 used two seperate pieces of PCB, one of which held the flash chip and one the IC which simply cut off power until the right PIN was entered. Corsair has improved on the design by including a seperate battery and covering the PCB with a substance to make the de-soldering of the IC pretty much impossible.

This got us thinking if we could circumvent the 2 minute lock-down after five consecutive wrong PIN entries by cutting the battery off afterwards. Sure enough, as soon as the unit looses contact to the battery for a split second the countdown is no longer in effect and the user has five new tries without the intended wait. That coupled with the fact that there are only 5 digits available make the Padlock 2 reduces the number of possible combinations greatly. Luckily, the device does not automatically flash the red or green LED once the correct length (but possibly incorrect PIN) has been entered. To confirm the entered PIN, the user has to hit the "key" button. Thus there is no way of finding out the actual length of the correct PIN by trial and error.

I should also mention, that even though you could design a circuit that cuts off battery power and checks for data accessibility after every PIN entry, you will still have to enter the PIN manually. This means that, while a brute force is still possible, it would take much longer than just a few minutes, even though only five digits are at your disposal.

Performance

At first I thought that the encryption method based on FBE, as there is no wait and the file are available immediately. But Corsair has let me know, that it is VBE - volume based encryption. While all the functional attributes point towards an FBE (immediate availability of the files, somewhat slow performance), a volume based encryption means that the entire flash memory is encrypted and decrypted at once, thus all the file are available when connected. Such a decrypt of 8 GB takes time, so I am not sure how Corsair manages to do so instantly, thus I am a bit wary of their protection method.

Remember that temporary files may remain on your system during normal operation unless the host system is encrypted as well. The Windows EFS system is a good start to encrypt the content, but is no match to industry created application.