Information freedom for open source users.

Hugh Pickens writes “Network World summarizes an RSA Conference panel discussion in which former NSA technical director Brian Snow said that cryptographers for the NSA have been losing ground to their counterparts in universities and commercial security vendors for 20 years, but still maintain the upper hand in the sophistication of their crypto schemes and in their ability to decrypt. ‘I do believe NSA is still ahead, but not by much — a handful of years,’ says Snow. ‘I think we’ve got the edge still.’ Snow added that that in the 1980s there was a huge gap between what the NSA could do and what commercial encryption technology was capable of. ‘Now we are very close together and moving very slowly forward in a mature field.’ The NSA has one key advantage (besides their deep staff of Ph.D. mathematicians and other cryptographic experts who work on securing traffic and breaking codes): ‘We cheat. We get to read what [academics] publish. We do not publish what we research,’ he said. Snow’s claim of NSA superiority seemed to rankle some members on the panel. Adi Shamir, the “S” in the RSA encryption algorithm, said that when the titles of papers in NSA technical journals were declassified up to 1983, none of them included public key encryption; ‘That demonstrates that NSA was behind,’ said Shamir. Snow replied that when technologies are developed separately in parallel, the developers don’t necessarily use the same terms for them.”

Read more of this story at Slashdot.

KentuckyFC writes “Quantum cryptography uses the quantum properties of photons to guarantee perfect secrecy. But one of its lesser known limitations is that it only works if Alice and Bob are perfectly aligned so that they can carry out well-defined polarization measurements on the photons as they arrive. Physicists say that Alice and Bob must share the same reference frame. That’s OK if Alice and Bob are in their own ground-based labs, but it’s a problem in many other applications, such as ground-to-satellite communications or even in chip-to-chip communications, because it’s hard to keep chips still over distances of the order of the wavelength of light. Now a group of UK physicists have developed a way of doing quantum cryptography without sharing a reference frame. The trick is to use entangled triplets of photons, so-called qutrits, rather than entangled pairs. This solves the problem by embedding it in an extra abstract dimension, which is independent of space. So, as long as both Alice and Bob know the way in which all these abstract dimensions are related, the third provides a reference against which measurements of the other two can be made. That allows Alice and Bob to make any measurements they need without having to agree ahead of time on a frame of reference. That could be an important advance enabling the widespread use of quantum cryptography.”

Read more of this story at Slashdot.

Colonel Korn writes “Ubisoft’s recent announcement that upcoming games would require a constant internet connection in order to play has been discussed at length on Slashdot (‘The Awful Anti-Pirate System That Will Probably Work’). Many were of the opinion that this new, more demanding DRM would have effectiveness to match its inconvenience, at least financially justifying its use. Others assumed that it would be immediately cracked, as is usually the case, leaving the inconvenience for paying customers and resulting in a superior product for pirates. As usual, the latter group was right. Though Ubisoft won’t yet admit it, Skid-Row managed to crack the new DRM less than a day after it was first released.”

Read more of this story at Slashdot.

alphadogg writes “Three University of Michigan computer scientists say they have found a way to exploit a weakness in RSA security technology used to protect everything from media players to smartphones and e-commerce servers. RSA authentication is susceptible, they say, to changes in the voltage supply to a private key holder. While guessing the 1,000-plus digits of binary code in a private key would take unfathomable hours, the researchers say that by varying electric current to a secured computer using an inexpensive purpose-built device they were able to stress out the computer and figure out the 1,024-bit private key in about 100 hours – all without leaving a trace. The researchers in their paper outline how they made the attack (PDF) on a SPARC system running Linux.”

Read more of this story at Slashdot.

HavanaF writes “Online backup is practical, but can it offer any privacy? The Dutch security company Safeberg developed an Offline Private Key Protocol, with an asymmetric key scheme. The protocol demands that the private (decryption) key be stored away from the ’source’ computer, which presumably is ‘too vulnerable.’ The catch is that the private key needs to be fairly large to be secure: a 4,096-bit RSA key should suffice for some years. But how to store an 800-character key offline? Safeberg introduces a machine readable paper key, with the 4k-bit key crammed in a giant 2D Datamatrix barcode. This video on key strength tells the story.”

Read more of this story at Slashdot.

agoston.horvath writes “I’ve written a HOWTO on replacing Mac OS X’s built-in encryption (FileVault) with the well-known FUSE-based EncFS. It worked well for me, and most importantly: it is a lot handier than what Apple has put together. This is especially useful if you are using a backup solution like Time Machine. Includes Whys, Why Nots, and step-by-step instructions.”

Read more of this story at Slashdot.

Trailrunner7 writes “Security researcher Joshua Wright has developed a simple attack that allows him to recover the passwords for any Verizon MiFi device. The MiFi is essentially a tiny, portable wireless AP, and Wright’s attack uses a simple and effective technique to get default passwords by using the device’s SSID and some existing password attacks on the encryption protocols the MiFi employs. Result: complete 0wnage of any MiFi.”

Read more of this story at Slashdot.

Hugh Pickens writes “Dr. Dobbs reports that a cracking algorithm using brute force methods can analyze the entire DES 56-bit keyspace with a throughput of over 280 billion keys per second, the highest-known benchmark speeds for 56-bit DES decryption and can accomplish a key recovery that would take years to perform on a PC, even with GPU acceleration, in less than three days using a single, hardware-accelerated server with a cluster of 176 FPGAs. The massively parallel algorithm iteratively decrypts fixed-size blocks of data to find keys that decrypt into ASCII numbers. Candidate keys that are found in this way can then be more thoroughly tested to determine which candidate key is correct.”

Read more of this story at Slashdot.

An anonymous reader writes “Mobile Magazine writes about a blogger named Notrax who has tested 15 methods of secure encryption for mobile phones; out of those he found only 3 could not be cracked at some level. ‘12 of them were “worthless.” It’s easy to take the software at face value when it “tells you” that the call is secured. But how does someone actually go about being sure that it is secured? Notrax did some digging and discovered he could break in to almost all of them in under 30 minutes.’” (Above link is to a slightly older description of Notrax’s approach; then, it was 9 out of 10 products that were worthless, instead of 12 out of 15.)

Read more of this story at Slashdot.

nine-times writes “After many years in IT, I’ve been surprised to notice how much of my traffic is still unencrypted. A lot of businesses that I interact with (both business and personal) are still using unencrypted FTP, and very few people use any kind of encryption for email. Most websites are still using unencrypted HTTP. DNSSEC seems to be picking up some steam, but still doesn’t seem to be widely used. I would have thought there would be a concerted effort to move toward encryption for the sake of security, but it doesn’t seem to be happening. I wanted to ask the Slashdot community, what do you think the hold up is? Are the existing protocols somehow not good enough? Are the protocols fine, but not supported well enough in software? Is it too complicated to manage the various encryption protocols and keys? Is it ignorance or apathy on the part of the IT community, and that we’ve failed to demand it from our vendors?”

Read more of this story at Slashdot.

An anonymous reader writes “According to a Check Point survey of 224 IT and security administrators, over 40% of businesses in the last year have more remote users connecting to the corporate network from home or when traveling, compared to 2008. The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users. Yet, regardless of the growth in remote users, just 27% of respondents say their companies currently use hard disk encryption to protect sensitive data on corporate endpoints. In addition, only 9% of businesses surveyed use encryption for removable storage devices, such as USB flash drives. A more mobile workforce carrying large amounts of data on portable devices leaves confidential corporate data vulnerable to loss, theft and interception.”

Read more of this story at Slashdot.

Trailrunner7 writes “A group of cryptographers has developed a new attack that has broken Kasumi, the encryption algorithm used to secure traffic on 3G GSM wireless networks. The technique enables them to recover a full key by using a tactic known as a related-key attack, but experts say it is not the end of the world for Kasumi. Kasumi, also known as A5/3, is the standard cipher used to encrypt communications on 3G GSM networks, and it’s a modified version of an older algorithm called Misty. In the abstract of their paper, the cryptographers say the attack can be implemented easily on one standard PC. ‘In this paper we describe a new type of attack called a sandwich attack, and use it to construct a simple distinguisher for 7 of the 8 rounds of KASUMI with an amazingly high probability of 214. By using this distinguisher and analyzing the single remaining round, we can derive the complete 128 bit key of the full KASUMI by using only 4 related keys, 226 data, 230 bytes of memory, and 232 time. These complexities are so small that we have actually simulated the attack in less than two hours on a single PC, and experimentally verified its correctness and complexity.’”

Read more of this story at Slashdot.

Lucas123 writes with a followup to news we discussed earlier this week that the encryption on NIST-certified flash drives was cracked. “A number of leading manufacturers of encrypted flash drives have warned their customers of a security flaw uncovered by a German company. The devices in question use the AES 256-bit encryption algorithm and have been certified using the FIPS 140-2, but the flaw appears to circumvent the certification process by uncovering the password authentication code on host systems. The National Institute of Standards and Technology said it’s investigating whether it needs to modify its standards to include password authentication software on host systems. Security specialist Bruce Schneier was blunt in his characterization of the flaw: ‘It’s a stupid crypto mistake and they screwed up and they should be rightfully embarrassed for making it.’”

Read more of this story at Slashdot.

An anonymous reader writes “Studios digitally restricting (drm) or locking down content with DVD-CSS not enough for you? Well, get ready, here comes the entertainment cartel’s Holy Grail, all-hardware encryption, via ‘DECE.’ And let’s not forget this little issue.”

Read more of this story at Slashdot.

I Don’t Believe in Imaginary Property writes “Professor Johannes Skaar’s Quantum Hacking group at NTNU have found a new way to break quantum encryption. Even though quantum encryption is theoretically perfect, real hardware isn’t, and they exploit these flaws. Their technique relies on a particular way of blinding the single photon detectors so that they’re able to perform an intercept-resend attack and get a copy of the secret key without giving away the fact that someone is listening. This attack is not merely theoretical, either. They have built an eavesdropping device and successfully attacked their own quantum encryption hardware. More details can be found in their conference presentation.”

Read more of this story at Slashdot.

An anonymous reader writes “The Register reports that the proprietary document format used by the Amazon online store and Amazon’s Kindle has been successfully reverse engineered, allowing these DRM-protected documents to be converted into the open MOBI format. Users of alternative e-book readers rejoice.” Here are the hacker’s notes on the program he is calling “Unswindle,” and here is the (translated) forum where the Kindle challenge was posed and answered.

Read more of this story at Slashdot.

An anonymous reader writes “Moxie Marlinspike, a security researcher well known for his SSL/TLS attacks, today launched a cloud-based WPA cracking service, where for $34 you can test the security of your WPA password. The WPA Cracker Web site states: ‘WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes.’”

Read more of this story at Slashdot.

Lexta writes with an interesting tidbit from IEEE Spectrum: “‘Karsten Nohl, chief research scientist with H4RDW4RE, a Sunnyvale, Calif.-based security research firm, is mounting what could be the most ambitious attempt yet to compromise the GSM phone system.’ The intended approach is to create an open source project to spread the computation of a giant look-up table across more than 80 machines. Interestingly, they’ve openly stated that nVidia’s CUDA technology will be used to execute parallel elements of the problem on GPUs as well.”

Read more of this story at Slashdot.

MBCook sends word on a possible solution to the mystery of the Voynich Manuscript, which we last visited nearly 6 years ago. “The Voynich Manuscript has confounded attempts to decode it for nearly 100 years. A person named Edith Sherwood, who has previously suggested a possible link to DaVinci, has a new idea: perhaps the text is simply anagrams of Italian words. There are three pages of examples from the herb section of the book, showing the original text, the plaintext Italian words, and the English equivalents. Has someone cracked the code?”

Read more of this story at Slashdot.

Over the years, I’ve had several clients use S/MIME to authenticate and encrypt e-mail messages. Unfortunately, encrypting anything end-to-end has problems, including those associated with scanning incoming encrypted messages, checking for data leaks, or indexing for later retrieval. When my clients turn on S/MIME, they are pretty much turning off easy e-mail scanning and retrieval.