USB Type-C Authentication Program Announced

By Nathan Kirsch

The USB Implementers Forum (USB-IF) announced the launch of its USB Type-C Authentication Program yesterday as an optional USB security protocol. The new USB Type-C Authentication specification defines cryptographic-based authentication for USB Type-C chargers and devices. USB Type-C is the must have connection on the latest notebooks, smartphones and other many other devices since it allows faster data transfer speeds, more power delivery and simplicity with its reversible design over the older USB Type-A interface.

The goal here is to protect consumers from non-compliant USB chargers and to mitigate risks from malicious firmware/hardware in USB devices attempting to exploit your USB connection. Malware has been delivered via USB for years, so using 128-bit cryptography to validate and digitally sign USB Type-C devices makes sense. With this new protocol, host systems can confirm the authenticity of a USB device, USB cable or USB charger, including such product aspects as the capabilities and certification status. The handshake begins right when the USB connection is made and before any power or data can be transferred between devices. DigiCert was selected by the organization to manage the PKI and certificate authority services for the program.

This sounds good, but future devices might be designed to only accept fully-compliant chargers and rejecting others as they would be seen as hazardous devices. Apple is a member of the USB-IF, so this move was likely backed by Apple as it sounds like something they’d like to implement future iPhones, iPads, and other devices that will have USB Type-C ports. It will also provide manufacturers some protection against cheap poorly designed chargers that might blow up or cause an electrical fault on their products. The downside for consumers it that it will likely add to the price of ‘approved’ USB Type-C chargers and cables as well as limit the number of ‘approved’ third party peripherals you can use.

WD My Passport USB Type-C Cable Adapter

USB Type-C Authentication Highlights:

  • A standard protocol for authenticating certified USB Type-C chargers, devices, cables and power sources
  • Support for authenticating over either USB data bus or USB Power Delivery communications channels
  • Products that use the authentication protocol retain control over the security policies to be implemented and enforced
  • Relies on 128-bit security for all cryptographic methods
  • Specification references existing internationally-accepted cryptographic methods for certificate format, digital signing, hash and random number generation