SPYRUS Ships Secure Storage Devices With FIPS 140-2 Encryption

PRESS RELEASE

San Jose, California " February 8, 2010 " SPYRUS, Inc., today announced that their secure storage devices implement the XTS-AES data encryption algorithm as specified in the National Institute for Science and Technology (NIST) Special Publication 800-38E (January 2010). XTS-AES is a mode of operation of the Advanced Encryption Standard (AES) algorithm specifically designed to protect storage media through sector-based encryption.

The NIST publication approves the XTS-AES mode of operation as an option for protecting the confidentiality of data on storage devices. According to the publication, "XTS-AES provides more protection than the other approved confidentiality-only modes against unauthorized manipulation of the encrypted data." NIST recently approved adding XTS-AES to the FIPS 140-2 security standard.

SPYRUS is the industry leader in using XTS-AES to protect secure storage devices with hardware-based encryption. Their Hydra PC Digital Attach USB encryption device first shipped with XTS-AES in 2008, and the newly released Kingston DataTraveler 5000 employs the identical XTS-AES cryptographic engine, algorithms, and key strengths. Both Secured by SPYRUS products use Suite B elliptic curve cryptography with P-384 keys to provide the strongest available protection for the AES-256 media encryption keys.

"The XTS-AES encryption mode is a key element of Kingston's new DataTraveler 5000 USB flash drive," said Mark Akoubian, Business Manager, Secure USB Products, Kingston Digital'. "We are pleased that the adoption of this standard strengthens Kingston's leadership position to protect our customers with the latest and most robust approved technology solution for flash drive data encryption."

SPYRUS became an early adopter of XTS-AES because of the enhanced protection it provides against attacks on sector-based media. The more widely used sector-based encryption schemes, such as the ECB and CBC modes of operation, have always been problematic because the required 128-bit initialization vector is incompatible with disk layout schemes. XTS-AES solves this problem by introducing a "tweak" to each encrypted block. By logically XOR-ing the encrypted "tweak" with the plaintext before encrypting the block, and then XOR-ing it again with the ciphertext after the encryption, XTS-AES is equivalent to double encryption of the text, using two different keys. The result prevents several sophisticated attacks specific to sector-based encrypted data stores. For a detailed explanation of these attacks and how XTS-AES deals with them, see http://en.wikipedia.org/wiki/Disk_encryption_theory.

"InfoGard, through FIPS 140-2 validation testing of SPYRUS and Kingston products, has known of their use of XTS-AES, which can now be officially tested as a FIPS-approved algorithm. SPYRUS is to be commended for their foresight in adopting this scheme, even before NIST had adopted it as an official FIPS-approved algorithm," said Ken Kolstad, General Manager of InfoGard Laboratories, the market leader in FIPS 140-2 independent validations.

"SPYRUS is committed to implementing the very best leading-edge encryption technology within our products. We were the first hardware vendor to implement Suite B throughout our entire product line, and the first to implement XTS-AES in a high-assurance encryption device," said Tom Dickens, Chief Operating Officer for SPYRUS. "We will continue to ensure that our customers enjoy the best validated technology for their sensitive data assets. In this context, the inclusion of XTS-AES by NIST as a FIPS-approved algorithm is a highly positive development for the consumer in the assurance of data encryption on sector-based media."

About SPYRUS, Inc.

SPYRUS holds patents in the U.S. and abroad that enable solutions for secure authentication, secure communication, and full disk encryption, as well as patents relating to data protection and rights management for digital content. Secured by SPYRUS security technology is designed, developed, and manufactured in the USA to meet FIPS 140-2 standards. SPYRUS products support the strongest commercially available cryptographic algorithms, including elliptic curve cryptography (ECC), AES, and SHA-2, collectively known as Suite B. In December 2007, the Hydra PC Personal Encryption Device became the first, and as yet the only, commercially available USB encryption device to be approved for protecting U.S. Government tactical classified data at the Secret level and below, when used in accordance with the approved operational security doctrine. SPYRUS is headquartered in San Jose, California. See www.spyrus.com for more information.

SPYRUS, the SPYRUS logo, Hydra Privacy Card and Hydra PC are either registered trademarks or trademarks of SPYRUS, Inc., in the U.S. and/or other jurisdictions. All other company, organization and product names are trademarks of their respective organizations.