BlackBerry Enterprise Solution Security Version 4.1.0 Technical Overview © 2006 Research In Motion Limited. All rights reserved. www.blackberry.com BlackBerry Enterprise Solution Security Contents Wireless security ....................................................................................................................................................... 4 BlackBerry Enterprise Solution security ............................................................................................................... 4 New security features..........................................................................................................................................6 BlackBerry encryption keys ....................................................................................................................................6 Master encryption key.........................................................................................................................................6 Message key..........................................................................................................................................................9 Content protection key ......................................................................................................................................10 Grand master key.................................................................................................................................................11 BlackBerry symmetric key encryption algorithms .............................................................................................12 Standard BlackBerry message encryption......................................................................................................12 BlackBerry wireless messaging security..............................................................................................................14 Receiving an email message on the BlackBerry device................................................................................14 Sending an email message from the BlackBerry device ..............................................................................14 Message attachment viewing security ............................................................................................................15 PIN messaging.....................................................................................................................................................15 SMS and MMS messaging ................................................................................................................................ 16 Controlling unsecured messaging .................................................................................................................. 16 Extending BlackBerry device messaging security ............................................................................................ 16 PGP Support Package ....................................................................................................................................... 16 PGP encryption.................................................................................................................................................... 17 S/MIME Support Package .................................................................................................................................18 S/MIME encryption............................................................................................................................................ 19 Decrypting and reading messages on the BlackBerry device using Lotus Notes API 7.0.....................20 Protecting stored data............................................................................................................................................21 Protecting stored messages on the messaging server .................................................................................21 IT policy signing and storage on the BlackBerry device.............................................................................. 22 Application password encryption and storage on the BlackBerry device................................................ 22 Protected storage of user data on a locked BlackBerry device.................................................................. 22 Protected storage of master encryption keys on a locked BlackBerry device......................................... 23 Protected storage of master encryption keys on a BlackBerry device during a reset............................24 Cleaning the BlackBerry device memory .......................................................................................................24 BlackBerry architecture component security ....................................................................................................25 BlackBerry Infrastructure .................................................................................................................................26 BlackBerry Enterprise Server ...........................................................................................................................26 © 2006 Research In Motion Limited. All rights reserved. www.blackberry.com BlackBerry Enterprise Solution Security Messaging server ...............................................................................................................................................26 BlackBerry configuration database.................................................................................................................26 BlackBerry MDS Services databases ..............................................................................................................28 Protecting the BlackBerry Infrastructure connections ....................................................................................28 SRP authentication ............................................................................................................................................29 BlackBerry Router protocol authentication ...................................................................................................30 Wireless enterprise activation authentication ...............................................................................................31 TCP/IP connection............................................................................................................................................. 32 Messaging server to desktop email program connection ........................................................................... 33 BlackBerry Mobile Data System connections ...............................................................................................34 WAP gateway connections ...............................................................................................................................35 Authenticating a user ............................................................................................................................................35 Authenticating a user to a BlackBerry device using a password ...............................................................35 Authenticating a user using a smart card......................................................................................................35 Controlling BlackBerry devices ............................................................................................................................ 37 Controlling BlackBerry device behaviour using IT policy rules.................................................................. 37 Enforcing device and desktop security...........................................................................................................38 Controlling BlackBerry device access to the BlackBerry Enterprise Server.............................................39 Protecting Bluetooth connections on BlackBerry devices ..........................................................................39 Protecting the BlackBerry device against malware .....................................................................................40 Protecting lost, stolen, or replaced BlackBerry devices...................................................................................42 Erasing data from BlackBerry device memory and making the BlackBerry device unavailable ..........43 Unbinding the smart card from the BlackBerry device ...............................................................................43 Related resources ...................................................................................................................................................44 Appendix A: RIM Cryptographic Application Programming Interface..........................................................46 Cryptographic functionality that the RIM Crypto API provides.................................................................46 Appendix B: TLS and WTLS standards that the RIM Crypto API supports ....................................................48 Key establishment algorithm cipher suites that the RIM Crypto API supports ......................................48 Symmetric algorithms that the RIM Crypto API supports.......................................................................... 49 Hash algorithms that the RIM Crypto API supports ................................................................................... 49 Appendix C: Previous version of wired master encryption key generation..................................................50 Previous version of wired master encryption key generation process......................................................50 Appendix D: BlackBerry device wipe process.....................................................................................................51 Appendix E: Ephemeral AES encryption key derivation process....................................................................53 © 2006 Research In Motion Limited. All rights reserved. www.blackberry.com BlackBerry Enterprise Solution Security Wireless security 4 This document describes the security features of the BlackBerry® Enterprise Solution and provides an overview of the BlackBerry security architecture. This document describes the security features that BlackBerry Enterprise Server version 4.1 or later, BlackBerry Desktop Software version 4.1 or later, and BlackBerry Device Software version 4.1 or later support, unless otherwise stated. See the documentation for earlier versions of the BlackBerry Enterprise Server, BlackBerry Desktop Software, and BlackBerry Device Software to determine if a feature is supported in that earlier software version. See the BlackBerry Enterprise Solution Security Acronym Glossary for the full terms substituted by the acronyms in this document. Wireless security Many companies are realizing significant return on investments and productivity gains by extending their enterprise information to mobile employees. With an increased demand for mobile content and the threat of information theft, companies have concerns about addressing security needs and requirements when evaluating wireless solutions. Without an effective security model, your company might expose sensitive corporate data, with financial and legal implications. With the advent of powerful new personal devices such as mobile phones and personal digital assistants that can access and store sensitive corporate data, controlling access to these devices is an important issue. Leaving devices with remote access to sensitive data accessible to potentially malicious users could be dangerous. The BlackBerry Enterprise Solution (consisting of a BlackBerry device, BlackBerry Device Software, BlackBerry Desktop Software, and the BlackBerry Enterprise Server software) is designed to protect your corporation from data loss or alteration in the event of • malicious interception of data on the corporate network, while a user is sending and receiving messages and accessing corporate data wirelessly using the BlackBerry device • an attack intended to steal corporate data, using malicious application code (for example, a virus) • theft of the BlackBerry device • identity theft BlackBerry Enterprise Solution security The BlackBerry Enterprise Solution implementation of symmetric key cryptography is designed to provide confidentiality, integrity, and authenticity implicitly. Concept Description BlackBerry Enterprise Solution implementation confidentiality permits only the intended • Use encryption, which is data scrambling based on a message recipient to view secret key, to make sure that only the intended the contents of a message recipient can view the contents of the message. integrity enables a message • Protect each message that the BlackBerry device sends recipient to detect if a with one or more message keys comprised of random third-party altered the information, which is designed to prevent third-party message data in transit decryption or alteration of the message data. between the message • Enable only the BlackBerry Enterprise Server and the sender and the message BlackBerry device to know the value of the master recipient encryption key, recognize the format of the decrypted and decompressed message, and automatically reject a message either one receives that is encrypted with the wrong master encryption key and therefore does not produce the required message format upon decryption. www.blackberry.com BlackBerry Enterprise Solution Security BlackBerry Enterprise Solution security 5 Concept Description BlackBerry Enterprise Solution implementation authenticity enables the message • Require that the BlackBerry device authenticate itself recipient to identify and to the BlackBerry Enterprise Server to prove that it trust the identity of the knows the master encryption key before the BlackBerry message sender Enterprise Server can exchange the unique master encryption key with, and send data to the BlackBerry device. The BlackBerry Enterprise Solution is designed so that data remains encrypted (in other words, it is not decrypted) at all points between the BlackBerry device and the BlackBerry Enterprise Server. Only the BlackBerry Enterprise Server and the BlackBerry device have access to the data that they send between them. Thus, third-parties, including service providers, cannot access potentially sensitive company information in a decrypted format. Message failure occurs automatically if the BlackBerry device cannot recognize the message format produced by the BlackBerry Enterprise Server decryption process, or if the BlackBerry Enterprise Server receives a message encrypted with the wrong master encryption key. If message failure occurs, the BlackBerry device prompts the user to generate a new master encryption key (required). BlackBerry Enterprise Solution feature Description protect data • Encrypt data traffic in transit between the BlackBerry Enterprise Server and the BlackBerry device. • Encrypt data traffic in transit between your messaging and collaboration server and a user’s desktop email program. • Use secure protocols to connect the BlackBerry Enterprise Server to the BlackBerry Infrastructure. • Encrypt data on the BlackBerry device. • Encrypt data in the BlackBerry configuration database. • Authenticate a user to the BlackBerry device using a smart card with a password or passphrase. protect encryption keys • Encrypt encryption keys on the BlackBerry device. control BlackBerry device connections • Control which BlackBerry devices can connect to the BlackBerry Enterprise Server. • Control Bluetooth® connections to and from the BlackBerry device. • Control BlackBerry Smart Card Reader connections. control BlackBerry device and BlackBerry • Send wireless commands to turn on and turn off BlackBerry Desktop Software functionality device functionality, delete information from BlackBerry devices, and lock BlackBerry devices. • Send IT policies to customize security settings for a user or a group on a BlackBerry Enterprise Server. • Enforce BlackBerry device and BlackBerry Smart Card Reader passwords. www.blackberry.com BlackBerry Enterprise Solution Security BlackBerry encryption keys 6 New security features Feature Software versions supported Description protect master • BlackBerry Enterprise Server Encrypt the master encryption keys encryption keys on the version 4.1 (all platforms) stored on the BlackBerry device in BlackBerry device flash memory using 256-bit AES. • Java™ based BlackBerry devices that are running BlackBerry device software version 4.1 or later support smart cards with • BlackBerry Smart Card Reader Use the BlackBerry Smart Card Reader the BlackBerry Smart version 1.0 accessory to enable a user to Card Reader authenticate and communicate • Bluetooth-enabled BlackBerry wirelessly with a supported Bluetooth- devices that support Bluetooth enabled BlackBerry device. specification version 1.1 and are running BlackBerry device See the BlackBerry Smart Card Reader software version 4.0.0 or later Security White Paper for more information. • BlackBerry Enterprise Server version 4.0.2 (with the S/MIME IT Policy template imported) or BlackBerry Enterprise Server version 4.0.3 or later (all platforms) send and receive PGP® • PGP Support Package version 4.1 Permit a user who is already sending messages and receiving PGP protected messages • BlackBerry Enterprise Server using their desktop email program to version 4.0 Service Pack 2 or later send and receive PGP protected for Microsoft Exchange messages, and decrypt and read • BlackBerry Enterprise Server received PGP protected messages version 4.1 for IBM Lotus Domino using their BlackBerry device. • Java based BlackBerry devices See the PGP Support Package White that are running BlackBerry device Paper for more information. software version 4.1 or later decrypt and read IBM® • BlackBerry Enterprise Server Use Lotus Notes® API 7.0 to Lotus Notes-encrypted version 4.1 for IBM Lotus Domino automatically decrypt messages on the and S/MIME-encrypted BlackBerry device that the sender has • Java based BlackBerry devices messages encrypted using either IBM Lotus that are running BlackBerry device Notes or S/MIME encryption. software version 4.1 or later BlackBerry encryption keys By default, the BlackBerry Enterprise Solution generates the master encryption key and message key that the BlackBerry Enterprise Server and BlackBerry devices use to encrypt and decrypt all data traffic between them. You can also enable the BlackBerry device to generate and use the content protection key to encrypt user data while the BlackBerry device is locked, and generate and use the grand master key to encrypt the master encryption key while the BlackBerry device is locked. Master encryption key The master encryption key is unique to the BlackBerry device. To send and receive messages, all master encryption keys stored on the BlackBerry Enterprise Server and the BlackBerry device must match. If the stored keys do not match, the BlackBerry device or the BlackBerry Enterprise Server cannot decrypt and must therefore discard messages that they receive. www.blackberry.com BlackBerry Enterprise Solution Security BlackBerry encryption keys 7 Master encryption key storage The BlackBerry configuration database, the messaging server, and the BlackBerry device flash memory store encryption keys, including the current BlackBerry device master encryption key (in other words, the master encryption key that the BlackBerry device currently uses to encrypt and decrypt message keys). Messaging server platform Messaging server BlackBerry device BlackBerry Enterprise storage location storage location Server storage location IBM Lotus® Domino® the BlackBerry profiles a key store database in the BlackBerry server database flash memory configuration database Microsoft® Exchange the desktop email a key store database in the BlackBerry server program user mailbox flash memory configuration database Novell® GroupWise® server not stored key store database in the BlackBerry flash memory configuration database It is critical to protect the BlackBerry configuration database and the platform-specific master encryption key storage location on the messaging server. See “Messaging server to desktop email program connection” on page 33 and “Protecting the BlackBerry configuration database” on page 26 for information. The BlackBerry configuration database, the messaging server, and the BlackBerry device flash memory can also retain previous and pending master encryption keys. Key state Description previous key(s) The master encryption key(s) that the BlackBerry device used before the current key was generated. The BlackBerry device stores multiple previous keys in flash memory for 7 days, the maximum amount of time that the BlackBerry Enterprise Server queues a pending message for delivery, in case the user creates a new key on the BlackBerry device multiple times while messages are still queued on the BlackBerry Enterprise Server. The messaging server and the BlackBerry configuration database store only the most recent previous key. pending key The master encryption key that you generate in the BlackBerry Manager or the user generates on the BlackBerry device to replace the current master encryption key. Only the messaging server and the BlackBerry configuration database store the pending key. The BlackBerry Desktop Software sends the pending key to the BlackBerry device when the user connects the BlackBerry device to the desktop computer. The current key then becomes the new previous key, and the pending key becomes the new current key. Master encryption key generation Both you and a user can generate and regenerate master encryption keys. Key generation method Initial key generation Key regeneration desktop-based (wired) When a user connects the BlackBerry When the user subsequently device to the desktop computer for the connects the BlackBerry device to first time, the BlackBerry Desktop the desktop computer, the user can Software creates the master encryption initiate regeneration of the master key and sends it to the BlackBerry device encryption key. The BlackBerry and the messaging server. Desktop Software creates the master encryption key and sends it to the BlackBerry device and the messaging server. www.blackberry.com BlackBerry Enterprise Solution Security BlackBerry encryption keys 8 Key generation method Initial key generation Key regeneration wireless Wireless enterprise activation permits a On the BlackBerry device, a user can user to remotely activate a BlackBerry request a new master encryption device on the BlackBerry Enterprise key. The BlackBerry device sends the Server without a physical network key regeneration request to the connection. During the wireless BlackBerry Enterprise Server enterprise activation, the BlackBerry wirelessly. Enterprise Server and the BlackBerry In the BlackBerry Manager, you can device negotiate to select the strongest initiate regeneration of a master algorithm that they both support and use encryption key for a BlackBerry that algorithm to generate the master device. encryption key. Note: See “Wireless enterprise activation authentication” on page 31 for more information. Desktop-based master encryption key generation process In BlackBerry Desktop Software version 4.0 or later, the master encryption key generation function uses the current time as the seed for the C language srand function. The master encryption key generation function then gathers entropy (randomness) using the following process: 1. When prompted by the BlackBerry Desktop Software, the user moves the mouse. The ARC4 encryption algorithm examines the lowest 12 bits of the x and y axes of the new mouse location. If the bits are different from the previous sample, the BlackBerry Desktop Software stores them, generating 3 bytes of randomness. If the bits are the same as the previous sample, no sample is taken. 2. The ARC4 encryption algorithm sleeps for a random interval between 50 and 150 milliseconds, and then samples again. 3. The ARC4 encryption algorithm loops until it gathers 384 bytes. 4. The BlackBerry Desktop Software retrieves 384 bytes of randomness from the MSCAPI, for a total of 768 bytes. 5. The BlackBerry Desktop Software hashes the 384 bytes of randomness from the ARC4 encryption algorithm and the 384 bytes of randomness from the MSCAPI with SHA512 to produce 512 bits of data. The BlackBerry Desktop Software frees the memory associated with the unused bits. 6. The BlackBerry Desktop Software uses the first 256 bits with AES encryption and the first 128 bits with Triple DES encryption to generate the master encryption key. The BlackBerry Desktop Software discards any unused bits. BlackBerry Enterprise Server software versions earlier than 4.0 use a different desktop-based master encryption key generation process. See “Appendix C: Previous version of wired master encryption key generation” on page 50 for more information. Wireless master encryption key generation process To establish and manage master encryption keys wirelessly, the BlackBerry Enterprise Server uses the initial key establishment protocol and the key rollover protocol. Both protocols provide strong authentication: only a BlackBerry device with a valid corporate email address and an activation password can initiate wireless enterprise activation and master encryption key generation. www.blackberry.com BlackBerry Enterprise Solution Security BlackBerry encryption keys 9 Protocol Description initial key establishment • The BlackBerry Enterprise Server uses this protocol during wireless protocol enterprise activation to establish the initial master encryption key. • This protocol uses SPEKE to bootstrap from an activation password, enabling a BlackBerry device to establish long term public keys and a strong, cryptographically protected connection with a BlackBerry Enterprise Server. key rollover protocol • The BlackBerry device and the BlackBerry Enterprise Server use this protocol to regenerate a master encryption key, based on the existing master encryption key. When a user physically connects the BlackBerry device to the desktop computer, if a pending key exists, the current master encryption key on the BlackBerry device becomes a previous key and the pending key replaces the current key. If no pending key exists, the BlackBerry Desktop Software creates a new master encryption key for the user. • This protocol generates the master encryption key using existing long-term public keys and the ECMQV algorithm to negotiate a common key in such a way that an unauthorized party cannot calculate the same key. • This protocol achieves perfect forward secrecy. The new master encryption key is independent of the previous key. Knowledge of the previous master encryption key does not permit an attacker to learn the new master encryption key. Message key The BlackBerry Enterprise Server generates one or more message keys, which are designed to protect the integrity of data such as short keys or large messages, for each message that the BlackBerry device sends. If a message contains several datagrams and exceeds 2 KB, the BlackBerry Enterprise Server generates a unique message key for each datagram. Each message key is comprised of random information, which makes it difficult for a third-party to decrypt, re- create, or duplicate the key. The message key is a session key; the BlackBerry device does not store the message key persistently but frees the memory associated with it after using it in the decryption process. Message key generation process The BlackBerry Enterprise Server is designed to seed a DSA PRNG function to generate a message key using the following process: 1. The BlackBerry Enterprise Server obtains random data from the BlackBerry device for the seed, using a technique derived from the initialization function of the ARC4 encryption algorithm. 2. The BlackBerry Enterprise Server uses the random data to permute the contents of a 256-byte (2048-bit) state array. If the MSCAPI is installed on the computer on which the BlackBerry Enterprise Server software is running, the BlackBerry Enterprise Server also requests 512 bits of randomness from the MSCAPI to increase the amount of entropy. 3. The BlackBerry Enterprise Server inputs the state array into the ARC4 algorithm to further randomize the array. 4. The BlackBerry Enterprise Server draws 521 bytes from the ARC4 state array. Note: The BlackBerry Enterprise Server draws the additional 9 bytes (512 + 9=521) to make sure that the pointers before and after the call are not in the same place, and to take into account that the first few bytes of the ARC4 state array might not be truly random. www.blackberry.com BlackBerry Enterprise Solution Security BlackBerry encryption keys 10 5. The BlackBerry Enterprise Server uses SHA512 to hash the 521-byte value to 64 bytes. 6. The BlackBerry Enterprise Server uses the 64-byte value to seed a NIST-approved DSA PRNG function. See Federal Information Processing Standard – FIPS PUB 186-2 for more information on the DSA PRNG function. The BlackBerry Enterprise Server stores a copy of the seed in a file. When the BlackBerry Enterprise Server restarts, it reads the seed from the file and uses the XOR function to compare the stored seed with the new seed. 7. The DSA PRNG function generates 128 pseudo-random bits for use with Triple DES and 256 pseudo-random bits for use with AES. 8. The BlackBerry Enterprise Server uses the pseudo-random bits with the appropriate algorithm to generate the message key. Content protection key When you turn on or the user turns on content protection on the BlackBerry device, the BlackBerry device generates encryption keys, including the content protection key, that are designed to encrypt the user data on the BlackBerry device in the following scenarios: Scenario Encryption process BlackBerry device is locked The BlackBerry device frees the memory that it associates with the content protection key and the ECC private key that it stores in RAM. The BlackBerry device then uses the ECC public key, an asymmetric key, to encrypt new user data that it receives. BlackBerry device is unlocked The BlackBerry device decrypts the content protection key and the ECC private key in flash memory. The BlackBerry device then uses the ECC private key and the content protection key to decrypt user data on the BlackBerry device. See “Protected storage of user data on a locked BlackBerry device” on page 22 for more information. Content protection key generation process When you turn on or the user turns on content protection of data for the first time, the following process occurs: 1. The BlackBerry device uses the NIST-approved DSA PRNG to randomly generate the content protection key, a semi-permanent 256 bit AES encryption key. 2. The BlackBerry device generates an ECC key pair. 3. The BlackBerry device prompts the user to type their BlackBerry device password. 4. The BlackBerry device derives an ephemeral 256 bit AES encryption key from the BlackBerry device password, in accordance with PKCS #5 (the password-based cryptography standard). See “Appendix E: Ephemeral AES encryption key derivation process” on page 53 for more information. 5. The BlackBerry device uses the ephemeral key to encrypt the content protection key and the ECC private key. 6. The BlackBerry device stores the encrypted content protection key, the encrypted ECC private key, and the ECC public key in flash memory. Note: If the user changes their BlackBerry device password, the BlackBerry device uses the new password to derive a new ephemeral key and uses the new ephemeral key to re-encrypt the encrypted versions of the content protection key and the ECC private key in flash memory. www.blackberry.com