background preloader

A (relatively easy to understand) primer on elliptic curve cryptography.

A (relatively easy to understand) primer on elliptic curve cryptography.
Author Nick Sullivan worked for six years at Apple on many of its most important cryptography efforts before recently joining CloudFlare, where he is a systems engineer. He has a degree in mathematics from the University of Waterloo and a Masters in computer science with a concentration in cryptography from the University of Calgary. This post was originally written for the CloudFlare blog and has been lightly edited to appear on Ars. Readers are reminded that elliptic curve cryptography is a set of algorithms for encrypting and decrypting data and exchanging cryptographic keys. Elliptic curve cryptography (ECC) is one of the most powerful but least understood types of cryptography in wide use today. Be warned: this is a complicated subject, and it's not possible to boil it down to a pithy blog post. The dawn of public key cryptography What you need for a public key cryptographic system to work is a set of algorithms that is easy to process in one direction but difficult to undo. Related:  _Crypto ToolssecurityWeb Pages

Best Free File Encryption Utility. Most if not all of the programs below leave the user exposed to the non-obvious threats described directly above in Cautionary Note #1. AxCrypt provides secure AES-128 encryption of single files using passwords, and optionally key-files as well, which AxCrypt can generate for you. Usage is wonderfully simple. To encrypt a file or files in a folder, just right-click the file or folder and select "encrypt". Note: The AxCrypt install program now uses Open Candy to bundle/install third party software with AxCrypt. "If you are in need of a plain Windows Installer (.msi) installer package, for example for group policy deployment or if you for any other reason want an installer that is entirely free of the OpenCandy code, please register for an account and log on." AES Crypt is a simple program that adds a context menu item in the file system context menu. The short Users Manual for AES Crypt makes the encryption and decreption processes easy to understand.

In surveillance era, clever trick enhances secrecy of iPhone text messages A security researcher has developed a technique that could significantly improve the secrecy of text messages sent in near real time on iPhones. The technique, which will debut in September in an iOS app called TextSecure, will also be folded into a currently available Android app by the same name. The cryptographic property known as perfect forward secrecy has always been considered important by privacy advocates, but it has taken on new urgency following the recent revelations of widespread surveillance of Americans by the National Security Agency. The use of multiple keys makes eavesdropping much harder. Unfortunately, this level of cryptographic protection isn't universal. To do perfect forward secrecy correctly, both parties must be available in near real time so they can swap random bits of data on the fly that will be used to negotiate and ultimately generate the temporary keys. This key negotiation has a way of halting the flow of SMS texts.

CryptoLocker Although CryptoLocker itself is readily removed, files remain encrypted in a way which researchers have considered infeasible to break. Many say that the ransom should not be paid, but do not offer any way to recover files; others say that paying the ransom is the only way to recover files that had not been backed up. Payment often, but not always, has been followed by files being decrypted. Operation[edit] The payload then proceeds to begin encrypting files across local hard drives and mapped network drives with the public key, and logs each file encrypted to a registry key. In November 2013, the operators of CryptoLocker launched an online service which claims to allow users to decrypt their files without the CryptoLocker program, and to purchase the decryption key after the deadline expires; the process involves uploading an encrypted file to the site as a sample, and waiting for the service to find a match, which the site claims would occur within 24 hours. Mitigation[edit] PGPCoder

Cryptography Breakthrough Could Make Software Unhackable | Science As a graduate student at the Massachusetts Institute of Technology in 1996, Amit Sahai was fascinated by the strange notion of a “zero-knowledge” proof, a type of mathematical protocol for convincing someone that something is true without revealing any details of why it is true. As Sahai mulled over this counterintuitive concept, it led him to consider an even more daring notion: What if it were possible to mask the inner workings not just of a proof, but of a computer program, so that people could use the program without being able to figure out how it worked? The idea of “obfuscating” a program had been around for decades, but no one had ever developed a rigorous mathematical framework for the concept, let alone created an unassailable obfuscation scheme. Over the years, commercial software companies have engineered various techniques for garbling a computer program so that it will be harder to understand while still performing the same function. Too Powerful to Exist

RFC 6520 - Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension [Docs] [txt|pdf] [draft-ietf-tls-dt...] [Diff1] [Diff2] [IPR] PROPOSED STANDARD Internet Engineering Task Force (IETF) R. RFC 6520 TLS/DTLS Heartbeat Extension February 2012 Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. 1. 1.1. This document describes the Heartbeat Extension for the Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) protocols, as defined in [RFC5246] and [RFC6347] and their adaptations to specific transport protocols described in [RFC3436], [RFC5238], and [RFC6083]. RFC 6520 TLS/DTLS Heartbeat Extension February 2012 TLS is based on reliable protocols, but there is not necessarily a feature available to keep the connection alive without continuous data transfer. 1.2. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 2. 3. 4. 5. 5.1. 5.2. 6. 7. 8. 9.

Encryption Works: How to Protect Your Privacy in the Age of *** Surveillance. Download: [en] PDF, LibreOffice ODT • [pt] PDF, LibreOffice ODT Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.— Edward Snowden, answering questions live on the Guardian's website The NSA is the biggest, best funded spy agency the world has ever seen. They spend billions upon billions of dollars each year doing everything they can to vacuum up the digital communications of most humans on this planet that have access to the Internet and and the phone network. Defending yourself against the NSA, or any other government intelligence agency, is not simple, and it's not something that can be solved just by downloading an app. Table of Contents Threat Model The NSA is a powerful adversary. Crypto Systems We discovered something. To encrypt something you need the right key, and you need the right key to decrypt it too. Microsoft Corp.

The second operating system hiding in every mobile phone I've always known this, and I'm sure most of you do too, but we never really talk about it. Every smartphone or other device with mobile communications capability (e.g. 3G or LTE) actually runs not one, but two operating systems. Aside from the operating system that we as end-users see (Android, iOS, PalmOS), it also runs a small operating system that manages everything related to radio. Since this functionality is highly timing-dependent, a real-time operating system is required. This operating system is stored in firmware, and runs on the baseband processor. As far as I know, this baseband RTOS is always entirely proprietary. The problem here is clear: these baseband processors and the proprietary, closed software they run are poorly understood, as there's no proper peer review. The insecurity of baseband software is not by error; it's by design. You can do some crazy things with these exploits. This is a pretty serious issue, but one that you rarely hear about.

Windows 8.1 includes seamless, automatic disk encryption—if your PC supports it Since Windows Vista, the upper-tier editions of Windows have supported local disk encryption via a feature called BitLocker Drive Encryption. Like the FileVault feature in newer versions of OS X or the “encrypt device” feature on many Android phones and tablets, you usually need to enable BitLocker manually to take advantage of it. Once enabled, it protects the data on your device from being accessed by someone who walks away with it. However, some mobile devices—including those running iOS, Windows Phone 8, and Windows RT—don’t require users to take device encryption into their own hands. What it does Windows 8.1’s new device encryption treats your x86-based Windows tablet or laptop more like an ARM-based tablet or smartphone. When you first fire up Windows 8.1 on a PC that supports the feature, head to the “PC Info” section in the device settings screen to check your encryption status. What you need (or, your hardware probably doesn’t support this) BitLocker soldiers on

An Overview of Cryptography As an aside, the AES selection process managed by NIST was very public. A similar project, the New European Schemes for Signatures, Integrity and Encryption (NESSIE), was designed as an independent project meant to augment the work of NIST by putting out an open call for new cryptographic primitives. NESSIE ran from about 2000-2003. CAST-128/256: CAST-128, described in Request for Comments (RFC) 2144, is a DES-like substitution-permutation crypto algorithm, employing a 128-bit key operating on a 64-bit block. A digression: Who invented PKC? 3.3. Let me reiterate that hashes are one-way encryption. Hash algorithms that are in common use today include: Message Digest (MD) algorithms: A series of byte-oriented algorithms that produce a 128-bit hash value from an arbitrary-length message. A digression on hash collisions. Without meaning to editorialize too much in this tutorial, a bit of historical context might be helpful.

Heartbleed Bug Cryptography Symmetric-key cryptography, where the same key is used both for encryption and decryption Cryptography prior to the modern age was effectively synonymous with encryption, the conversion of information from a readable state to apparent nonsense. The originator of an encrypted message shared the decoding technique needed to recover the original information only with intended recipients, thereby precluding unwanted persons to do the same. Modern cryptography is heavily based on mathematical theory and computer science practice; cryptographic algorithms are designed around computational hardness assumptions, making such algorithms hard to break in practice by any adversary. Cryptology-related technology has raised a number of legal issues. Terminology[edit] The study of characteristics of languages which have some application in cryptography (or cryptology), i.e. frequency data, letter combinations, universal patterns, etc., is called cryptolinguistics. Classic cryptography[edit]

Data Broker Giants Hacked by ID Theft Service An identity theft service that sells Social Security numbers, birth records, credit and background reports on millions of Americans has infiltrated computers at some of America’s largest consumer and business data aggregators, according to a seven-month investigation by KrebsOnSecurity. The Web site ssndob[dot]ms (hereafter referred to simply as SSNDOB) has for the past two years marketed itself on underground cybercrime forums as a reliable and affordable service that customers can use to look up SSNs, birthdays and other personal data on any U.S. resident. Prices range from 50 cents to $2.50 per record, and from $5 to $15 for credit and background checks. Customers pay for their subscriptions using largely unregulated and anonymous virtual currencies, such as Bitcoin and WebMoney. Until very recently, the source of the data sold by SSNDOB has remained a mystery. Earlier this summer, SSNDOB was compromised by multiple attackers, its own database plundered. Update, 2:05 p.m.