FSB Russia Certifies Rutoken Chip 3127 with Five-Year Cryptographic Key Validity
Aktiv has obtained an FSB Russia certificate for its embedded microcontroller Rutoken Chip 3127 under security classes KS1 and KS2. Following additional research, the validity period of the device's private cryptographic keys has been extended to five years.
The chip forms part of the Rutoken ECP 3.0 3127 product line and is designed for equipment that requires long-term cryptographic protection. Target platforms include servers, ATMs, workstations, tablets, biometric systems, industrial equipment, and IoT devices that must independently verify trust relationships while human operators focus on other tasks.
Rutoken Chip 3127 stores cryptographic keys in non-extractable form, authenticates users and devices, checks the integrity of system components, and enables trusted boot. At every stage it can validate executable code to prevent unauthorized modifications. The microcontroller also supports data encryption, derivation of session and derived keys, secure software updates, and protected TLS and VPN connections.
For data exchange over open channels the chip implements the CRISP protocol that complies with GOST R 71252-2024. Hardware-level protections include continuous monitoring of supply voltage and the integrity of the protective layer covering the die. Any detected physical tampering attempt triggers immediate blocking of operations. A dummy branch execution mechanism performs false commands to mask power consumption and timing information against side-channel attacks.
The company reports that Rutoken Chip 3127 has already completed pilot deployments. One project integrated the microcontroller into the OVISION biometric access control systems. Completion of the certification process is expected to enable serial production use in devices deployed within critical information infrastructure.
Related articles
AKIT Requests Temporary Permission for Russian Companies to Transfer Personal Data Abroad After Data Center Incidents
The Association of Internet Trade Companies (AKIT) has sent a formal letter to Russian Prime Minister Mikhail Mishustin proposing a temporary exemption from strict data localization rules. The measure would allow affected companies to move critical systems and Russian citizens' personal data to data centers in friendly countries when domestic infrastructure is unavailable due to accidents or damage. Members including Ozon, Wildberries, Cooper, and Yandex Market argue that services must continue operating even if Russian facilities are compromised. The proposed special regime would apply only after an officially confirmed incident, require compliance with information security standards, and end no later than March 1, 2028. After recovery, companies would be required to return to normal data processing within Russia. Expert Alexey Muntyan noted that the mechanism activates only after incidents occur and questioned whether countries should be selected based on data protection levels rather than political alignment.
Anthropic Model Reconstructs NSA Seeds for NIST Elliptic Curves in Under 30 Minutes
An internal Anthropic research model traced the origins of the five seeds used by the NSA to generate the NIST elliptic curves P-192, P-224, P-256, P-384, and P-521. The discovery resolves a 25-year-old question that arose when the curves were standardized in FIPS 186-2 for ECDSA in 2000. Researchers combined analysis of 1990s random number generators, 34 generator-output combinations, and lattice reduction techniques to identify lrand48 initialized with Unix timestamps from May 1997 to April 1998. The P-256 seed corresponds to the 1842nd candidate from a run started on 16 August 1997, and example seeds from ANSI X9.62 follow the same pattern. The work does not demonstrate any cryptographic break or backdoor in the curves and does not recommend changes to production systems. Several questions remain open, including the seed for curve B-163 and the reason certain candidate values were discarded.
Bitget Bans Residents of Russia, Kazakhstan and Belarus, Sets Strict Deadlines for Position Closure and Asset Withdrawal
Cryptocurrency exchange Bitget has updated its user agreement to prohibit residents of Russia, Kazakhstan and Belarus from using its services. The changes took effect on 16 October, with affected users receiving individual notifications via email, the mobile app and push alerts. New trading, orders and subscriptions were disabled at 10:00 Moscow time on 18 October. Users must close all positions and withdraw assets by 10:00 Moscow time on 21 October, after which remaining positions will be liquidated automatically and account access will be restricted. The exchange has not disclosed the specific reason for the decision in its public statement. The move underscores how access to crypto platforms can be terminated by changes in terms of service rather than technical issues or user credentials.
Encrypt Don't Trust: Securing Palm Vein Biometrics from Sensor to Access Control Server
An in-depth technical analysis explores how to protect palm vein biometric data in access control systems using a security-by-design approach. The article emphasizes that biometric templates cannot be changed like passwords, making robust protection essential against physical theft, insider threats, and presentation attacks. It details the application of Zero Trust principles, minimizing the Trusted Computing Base, and implementing hardware roots of trust such as Secure Boot and encrypted non-volatile memory. Russian regulatory requirements including 152-FZ, Government Decree No. 1119 for data protection levels, FSTEC Order No. 21, and FSB Order No. 378 are mapped directly to technical controls like mTLS, OSDP v2.2, and liveness detection. Threat actor profiles ranging from external attackers to privileged insiders are analyzed with specific countermeasures for each segment of the data path. The piece concludes that trust must be compressed to the hardware root, server room, and dual-operator registration process while everything else relies on verifiable cryptography and auditing.