Data Storage Security Based on Hardware Uniqueness: Resilience Analysis and Scheme Modernization

This study investigates the resilience of a key container binding to the hardware configuration of the "PC – USB drive" system, utilized in budget software and hardware solutions for cryptographic information protection. In these systems, the encryption key is stored not on a certified token but on a standard USB drive as a secure container. The binding is further reinforced by linking the container to unique hardware identifiers, including serial numbers and models of the motherboard and storage device, as well as manufacturer and device identifiers. It is posited that, without knowledge of these identifiers, an attacker will be unable to recover the key, even if they possess the file and password. The focus of the research is the security model of such solutions and the method for deriving the container key from a password and hardware fingerprint. The objective of this work is to provide a methodologically sound assessment of the achieved resilience and to address a common overestimation of security inherent in these solutions, particularly when assuming the secrecy of hardware identifiers and underestimating the speed of password brute-force attacks. A structural analysis of the reference scheme, a formalized attacker model consisting of eight scenarios, evaluation of residual entropy of hardware identifiers, recalculation of resistance to password guessing based on published GPU speeds, and computational experiments on a software prototype implementing both schemes with domestic algorithms (Kuznetsik, Stribog, R 50.1.111-2016) are presented. The findings indicate that at contemporary GPU speeds, the probability of successfully guessing the password during its validity period for the original scheme increases from 4·10^-6 to 0.09 (one processor) and 0.72 (eight processors), contradicting claims of practical impossibility of such guessing. Furthermore, hardware identifiers lack confidentiality for a local attacker and yield limited uncertainty (on the order of 40 bits) for external threats. An upgraded scheme is proposed, utilizing key derivation PBKDF2 (HMAC-Stribog), encryption via Kuznetsik in counter mode, and integrity verification through message authentication codes. The experiment confirmed the correctness of this approach and a significant reduction in brute-force attack speed by several orders of magnitude. The practical conclusion drawn is that hardware binding serves as an additional barrier rather than a replacement for robust key derivation from the password.