Oh, the fight continues...

seriously... what the heck is up with these people...

they are sooo stupid that they have to keep going in the dirty way...

seriously...

let us geeks be...

FYI, I heard about this on the IEEE Tech Forum. I'm flabbergasted by TI's response. You'd think they would see this as an opportunity for some free advertising.

I. Guess. Not.

I'm not a TI calculator power user (though I have one in the inventory). I prefer my HP50g, but this... this is ridiculous. Please keep us apprised and let outsiders such as myself know if we can help (e-mails, letters, whatever).

This is one good thing about TI's threats. We get more publicity. Interestingly enough, this reduces sales like the NSpire, which all of TI's money is on, and increases sales of the calculators that have been cracked.

So not only is it bad publicity, but also bad marketing.

> ... this reduces sales like the NSpire, which all of TI's money is on ...

Keep fantasizing.

And how is this a fantasy? As far as graphing calculators are concerned, they're pouring all their money, time, security, and effort into the Nspire series.
If you disagree, I'd like to know why.

Texas Instruments develops processors. Graphing calculators aren't their bread and butter.

However, it's truly an amazing time to be a coder - seeing them squirm when this community's genius takes those wondrous devices to a whole new dimension, well beyond the company's control.

Long live the TI Community, and keep the code alive!

If a company has a segment that makes xyz and it makes a profit then what does it matter that it is not their "bread and butter" ?

That's the trip-up, nyall. You assumed the calc business is still profitable.

Having met various TI employees and interns throughout college, I can tell you calcs are only around 3% of their bottom line. Now that the economy's taken a dump, the pressure's on the education division keep this product line in the black.

Their latest reaction is baffling at first, but the reasoning is perfectly obvious if you understand who their customers are. Schools, CollegeBoard, ACT, Kaplan Inc, and other institutes have been hostile toward the whole 3rd-party OS issue for years. Now that calcs are a blank slate for anything we can cook up, TI must show their partners they won't take the situation laying down--even if it's a lost cause. Either way, this will be the stall tactic until new deals are made, or some kind anti-hacking revision rolls out. This line of reasoning may sound alien and incomprehensible from a coder's standpoint, but I witness it on a daily basis in the business world.

There is nothing they can do to combat this. The most they could do is start to sign OSes with a different key, and then require that to download one of their OS upgrades, you first have to install one of their certificate/license updates which would embed that key in our certificates.

That's plagued with problems because:
1. Lots of people have screwed up their certificates by now, and by releasing this kind of update, it just plain wouldn't work for some or possibly even brick them. Then they'd have to replace them.
2. Any key they come up with would be cracked in a week by us, so it would be a futile cat-and-mouse game between their releasing new updates and our factoring the keys.

So all they can do is threaten us legally, and with the help of the EFF, even that option is being taken out. So they're just screwed.

Aren't the 68k signing keys embedded in the boot code, not in the certificate area like the Z80 ones? If so, it's impossible for them to replace those keys, thanks to their own protection mechanisms.

Yes and no. Both Z80 and 68k calcs include the OS validation keys in the boot code. Certificate files, however, also include copies of the same keys. I don't know how it works on the 68ks, but on the Z80s, at least, any keys found in the certificate are used in preference to the built-in keys in the boot code.

In any case, each key is identified by a particular hexadecimal ID (e.g., 0104 is the standard "freeware" app signing key for the 83+/84+.) Every signed OS or app must contain an 801x or 811x field in its header, which specifies the ID of the key used to sign it.

So if TI really wanted to, they could switch to using a different key for new OS versions (presumably requiring users of older calculators to install a certificate upgrade before installing the new OS.) They could also modify new calculators to accept only OSes signed with the newer keys.

Yes, although those keys would be cracked within a week as well.

There is no way for TI to defend against this. Case closed.

What if the next batch of ti84s introduces several hundred new bootloaders, each with a new key or even larger keys.

The last time I updated my calculator's OS, ti-connect did everything for me including downloading the new OS. It wouldn't be that hard for TI to update ti-connect so that it downloads an OS that has been signed for your specific bootloader.

Though this would probably ruin unit to unit updates.

They would have to sign two different OS for each calculator. Besides, we could still easily crack any key they put out with boinc.

What if a new bootloader ups the key size to 1024 bits ?

two weeks, then. You saw the determination of the original hackers. The difference is, that with more publicity, more people will help out. ;-)

If someone makes an installer for it, then people can simply install the file, and help crack the key. It doesn't matter how long it is, we'll crack it eventually. There's nothing TI can do.

More bits = exponentially harder. Even with more people taking a hand. Its an interesting topic I've spent a few hours reading about. Sometime in 2010 researchers expect to complete factoring a 768 bit number.

Here's one source (Remove spaces)
https://documents.epfl.ch/ users/l/le/lenstra/ public/papers/ecdl2.pdf

quote:
At this point in time a brute-force attack against 1024-bit RSA would require about two years on a few million compute cores with many tens of gigabytes of memory per processor or mainboard.

As nyall mentioned above, using a 1024 bit key would in fact be safe from us cracking it with BOINC. If you are unfamilar with how binary works, then just realize that every extra bit you throw on doubles the range of numbers you can represent. (2 bits can represent 4 numbers, 3 bits can represent 8 numbers...)

It should also be noted for anyone new for crypto stuff in general, although we have demonstrated that a 512 bit key is terribly unsecure for RSA (a public key crypto algorithm), much smaller keylenghts are still very secure for symetric key algorithms like AES. 256 bits is a perfectly respectible keylength in AEW for example. (symetric key crypto would be useless for this application however).

Sorry, somehow forgot to add this:

I think that it is very unlikely that we will ever have to worry about 1024 bit keys on these calulators. Assuming it was even possible, the change would surely be anything but trivial. Legal spamming is far easier for them.

Actual Arguing:
Um... why shouldn't I assume that they are profitable? Because its a bad economy? Because they've sunk a lot of money into the nspires which aren't selling like hotcakes? I don't really like arguing these things without numbers. Regardless of how bad the economy is kids are still going to school.

Rambling conjecturing:
The 2007 annual report said that their calculator division in both 2006 and 2005 made ~300 million in profit off of ~500 million in revenue. Seems pretty good to me. I would like newer numbers but unfortunately the 2008 annual report now lumps the calculator division under 'other'.

Also those profit margins seem pretty massive to me considering the number of used calculators out there in those years (in 2006 TI sold their 40 millionth graphing calc), so I wonder if people are really buying used? Granted unemployment is now close to 10% which is double the unemployment in 2006, so maybe more people bought used calculators for their kids in 2009. Thats hard to guess without knowing household incomes in these respective years.

TI's 2009 annual report will be interesting. It will also be interesting to see any statistics the government will release when they have everyone's 2009 tax fillings.

First the original statement to which I was disagreeing in its entirety:

> This is one good thing about TI's threats. We get more publicity. Interestingly enough, this reduces sales like the NSpire, which all of TI's money is on, and increases sales of the calculators that have been cracked.

Calculators are purchased by parents because their kid's teachers tell them to. I really doubt these parents are going onto google and doing enough research to find that there are these other calculators with that could be upgraded with 3rd party OS's. And even if they did there aren't yet any such OS's that have math capabilities that can compete.

From my experiance, a lot of kids have already been avoiding the nspire because it doesn't have any good games. I really don't think that it's a stretch to say that this publicity will help increase these calculator's desirability. Even if most kids will have no idea what a 3rd party OS even is, seeing news articles about calculator researchers hacking them is sure to excite a few.

If you want to help, you might consider donating to the EFF if you can.

"you might consider donating to the EFF if you can."

Done. And they even accepted Paypal!