When he was head of GCHQ, Robert Hannigan said some pretty clueless things about the Internet and encryption. For example, in 2014, he accused tech companies of 'facilitating murder', and joined in the general demonization of strong crypto. Last year, he called for technical experts to work more closely with governments to come up with some unspecified way around encryption. Nobody really knew what he meant when he said:

"I am not in favor of banning encryption. Nor am I asking for mandatory back doors. Not everything is a back door, still less a door which can be exploited outside a legal framework."

Now, speaking to the BBC, he has clarified those remarks, and revealed how he thinks governments should be dealing with the issue of end-to-end encryption. As he admits:

"You can't uninvent end-to-end encryption, which is the thing that has particularly annoyed people, and rightly, in recent months. You can't just do away it, you can't legislate it away. The best that you can do with end-to-end encryption is work with the companies in a cooperative way, to find ways around it frankly."

He emphasized that backdoors are not the answer:

"I absolutely don't advocate that. Building in backdoors is a threat to everybody, and it's not a good idea to weaken security for everybody in order to tackle a minority."

So what is the solution? This:

"It's cooperation to target the people who are using it. So obviously the way around encryption is to get to the end point -- a smartphone, or a laptop -- that somebody who is abusing encryption is using. That's the way to do it."

As Techdirt reported earlier this year, this is very much the approach advocated by top security experts Bruce Schneier and Orin Kerr. They published a paper describing ways to circumvent even the strongest encryption. It seems that Hannigan has got the message that methods other than crypto backdoors exist, some of which require cooperation from tech companies, which may or may not be forthcoming. It's a pity that he's no longer head of GCHQ -- he left for "personal reasons" at the beginning of this year. But maybe that has given him a new freedom to speak out against stupid approaches. We just need to hope the UK government still listens to him.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Read the rest here:
Former Head Of GCHQ Says Don't Backdoor End-To-End Encryption, Attack The End Points - Techdirt

In a letter to a watchdog lawmaker last week, the Department of Defense confirmed that it will finally, in 2018, join the 21st century and use a popular basic encryption tool to help make emails to and from .mil addresses more secure. What does that mean for your badass joe.schmuckatelli@centcom.mil account? Lets break it down.

The Defense Information Systems Agency confirmed to Democratic Sen. Ron Wyden of Oregon, a Senate intelligence committee member, that by next year, the Pentagons .mil email will implement STARTTLS for enhanced email encryption a longstanding application that Wyden has called a basic, widely used, easily-enabled cybersecurity technology.

The move came after years of poking around by the reporters at Vice and some tough talk from Wyden questioning how the militarys 4.5 million-user cloud-based email service had never implemented STARTTLS before.

I cant think of a single technical reason why they wouldnt use it, one former U.S. Special Operations Command IT whiz told Vice. A hacker and former Marine similarly told the outlet: The military should not be sending any email that isnt encrypted, period. Everything should get encrypted, absolutely everything. Theres no excuse.

Vices Motherboard blog has a nice breakdown of STARTTLS, which is whats called an opportunistic encryption app. Basically, when your email server and a recipients email server hook up to exchange info, STARTTLS sets up the exchange on the fly as an encrypted transaction. When your emails are sent out into the world without encryption, opportunistic or otherwise, they are as readable as postcards, per Vice:

When your email provider doesnt support STARTTLS, your email might be encrypted going from your computer to your provider, but it will then travel across the internet in the clear (unless you used end-to-end encryption.) When your email provider, and the email provider of the person youre sending the email to, both support STARTTLS, then the email is protected as it travels across.

Kinda, yeah, but not super-big. STARTTLS has been around since 2002, and Gmail first implemented it in 2004. Vice points out that Google and your other popular private email and social-media sites including Microsoft, Yahoo, Twitter, and Facebook have already integrated STARTTLS. In the wake of the NSA surveillance disclosures by contractor Edward Snowden, Facebook led a very public charge to get more sites to use STARTTLS to keep the feds from looking at your emails.

So theres nothing new here; DoD is simply catching up to a basic encryption technology thats been around for a decade and a half long enough now that the vast majority of emails you send and receive communicate with another STARTTLS-equipped server. It has some weaknesses, and it aint PGP encryption, but its a good start.

Well, you probably already know from experience that no Pentagon-level IT policy changes overnight. But more than that, keeping mail.mil STARTTLS-free has also given the military a lot more freedom to snoop through your emails a freedom DISA was probably reluctant to give up. In a letter to Wyden in April, DISA deputy director Maj. Gen. Sarah Zabel said the agencys software regularly sweeps incoming soldier email for phishing scams, viruses, and the like.

DISA currently rejects over 85% of all DoD email traffic coming from the Internet on a daily basis due to malicious behavior, Zabel wrote. We also inspect for advanced, persistent threats using detection methods developed using national level intelligence. Many of these detection methods would be rendered ineffective if STARTTLS were enabled.

In fact, top civil liberties groups like the ACLU have long called for government agencies to use encryption not just to protect their sensitive info, but to help establish a broad pro-encryption consensus in America: If the government gets to encrypt its data, then why shouldnt free American citizens get the same right? Such a norm might not sit well with government agencies, like the NSA, CIA, and FBI, who rely on signals surveillance to further intelligence and investigative aims.

Beyond that, if the military has to triage its IT systems for info security, its probably going to tackle unclassified email servers last, after focusing on secure and closed systems like SIPRNET, the National Military Command Center, and Link 16 tactical data transmission networks.

Well, that was DISAs initial suggestion: Using STARTTLS could make it harder for the Pentagon to catch and neutralize viruses in your emails. But its decision to migrate everyones mail.mil accounts to a new STARTTLS gateway by July 2018 suggests whatever kinks the application threw in DISAs surveillance have now been worked out.

In the meantime, the service is still adamant that you shouldnt be passing any sensitive info or clicking any weird links in your nonsecure mail.mil account in the first place, so, you know, keep not doing that.

Yeah: Download less porn. Seriously. Even if its virus-free, that much cant be healthy, man.

Also, remember the cardinal rule of opsec:

WATCH MORE:

Continue reading here:
The Military Will Start Encrypting Emails. Here's What That Means ... - Task & Purpose

Encryption software is software that uses cryptography to prevent unauthorized access to digital information.[1][2] Practically speaking, people use cryptography today to protect the digital information on their computers as well as the digital information that is sent to other computers over the Internet.[3] As software that implements secure cryptography is complex to develop and difficult to get right,[4] most computer users make use of the encryption software that already exists rather than writing their own.

As encryption software is an important component in providing protection from cybercrime, there are many, many software products that provide encryption. Because there are so many software products that provide encryption, a good way to begin understanding this topic is classification by categorization.

Software encryption uses a cipher to obscure the content into ciphertext, so one way to classify this type of software is by the type of cipher used. Ciphers can be categorized into two categories: public key ciphers, also known as asymmetric ciphers, and symmetric key ciphers. Thus, encryption software may be said to based on public key or symmetric key encryption.

Another way to classify software encryption is to categorize its purpose. Using this approach, software encryption may be classified into software that encrypts "data in transit" and software that encrypts "data at rest".

As it turns out, these two types of classifications has something in common: that is, data in transit generally uses public key ciphers, and data at rest generally uses symmetric key ciphers.

However, software encryption is not as simple at that.

To begin with, symmetric key ciphers can be further subdivided into stream ciphers and block ciphers. Stream ciphers typically encrypt plaintext a bit or byte at a time, and are most commonly used to encrypt real-time communications, such as audio and video information. The key is used to establish the initial state of a keystream generator, and the output of that generator is used to encrypt the plaintext. Block cipher algorithms split the plaintext into fixed-size blocks and encrypt one block at a time. For example, AES processes 16-byte blocks, while its predecessor DES encrypted blocks of eight bytes.

Also, there is also a well-known case where PKI is used for data in transit of data at rest.

Data in transit is data that is being sent over a network. When the data is between two endpoints, any confidential information may be vulnerable to snooping. To maintain the confidentiality of the transmission, the payload (confidential information) can be encrypted to protect its confidentiality, as well as its integrity and non-repudiation.[5]

Often, the data in transit is between two entities that do not know each other - such as visiting a website. As establishing a relationship and securely sharing an encryption key to secure the information that will be exchanged, a set of roles, policies, and procedures to accomplish this has been developed; it is known as the public key infrastructure, or PKI. Once PKI has established a secure connection, a symmetric key can be shared between endpoints. A symmetric key is preferred to over the private and public keys as a symmetric cipher is much more efficient (uses less CPU cycles) than an asymmetric cipher.[6][7]

Below are some examples of software that provide this type of encryption.

Data at rest refers data that has been saved to persistent storage. Generally speaking, data at rest is encrypted by a symmetric key.

As mentioned previously, there are many, many software products that provide encryption. This Wikipedia article lists and compares the these software products by providing several tables that demonstrate their features. While these products are all listed under "disk" encryption, this may be a bit misleading.

In looking at this table that compares whether the encryption software works at the disk, partition, file, etc. layer, there just doesn't seem to be enough room to capture all the options. That's because encryption may be applied at different layers in the storage stack. For example, encryption can be configured at the disk layer, on a subset of a disk called a partition, on a volume, which is a combination of disks or partitions, at the layer of a file system, or within userland applications such as database or other applications that run on the host operating system.

With full disk encryption, the entire disk is encrypted (except for the bits necessary to boot or access the disk when not using an unencrypted boot/preboot partition).[8] As disks can be partioned into multiple partitions, partition encryption can be used to encrypt individual disk partitions.[9][9] Volumes, created by combinining two or more partitions, can be encrypted using volume encryption.[10] File systems, also composed of one or more partitions, can be encrypted using file system encryption. Directories are referred to as encrypted when the files within the directory are encrypted.[11][12] File encryption encrypts a single file. Database encryption acts on the data to be stored, accepting unencrypted information and writing that information to persistent storage only after it has encrypted the data. Device-level encryption, a somewhat vague term that includes encryption-capable tape drives, can be used to offload the encryption tasks from the CPU.

As demonstrated by this Wikipedia article there are a large number of encryption software products in this space. For that reason it does not seem prudent to attempt to capture all of that information in this article. Instead, it is recommended to look into one or more of these articles.

When there is a need to securely transmit data at rest, without the ability to create a secure connection, userland tools have been developed that support this need. These tools rely upon the receiver publishing their public key, and the sender being able to obtain that public key. The sender is then able to create a symmetric key to encrypt the information, and then use the receivers public key to securely protect the transmission of the information and the symmetric key. This allows secure transmission of information from one party to another.

Below are some examples of software that provide this type of encryption.

Read this article:
Encryption software - Wikipedia

This statement was originally published on article19.org on 4 July 2017.

ARTICLE 19 joins 82 other organisations in the following letter, calling on governments to protect strong encryption.

To the leaders of the world's governments,

We urge you to protect the security of your citizens, your economy, and your government by supporting the development and use of secure communications tools and technologies, rejecting policies that would prevent or undermine the use of strong encryption, and urging other leaders to do the same.

Encryption tools, technologies, and services are essential to protect against harm and to shield our digital infrastructure and personal communications from unauthorized access. The ability to freely develop and use encryption provides the cornerstone for today's global economy. Economic growth in the digital age is powered by the ability to trust and authenticate our interactions and communicate and conduct business securely, both within and across borders.

Some of the most noted technologists and experts on encryption recently explained (PDF) that laws or policies that undermine encryption would "force a U-turn from the best practices now being deployed to make the Internet more secure," "would substantially increase system complexity" and raise associated costs, and "would create concentrated targets that could attract bad actors." The absence of encryption facilitates easy access to sensitive personal data, including financial and identity information, by criminals and other malicious actors. Once obtained, sensitive data can be sold, publicly posted, or used to blackmail or embarrass an individual. Additionally, insufficiently encrypted devices or hardware are prime targets for criminals.

The United Nations Special Rapporteur for freedom of expression has noted, "encryption and anonymity, and the security concepts behind them, provide the privacy and security necessary for the exercise of the right to freedom of opinion and expression in the digital age." As we move toward connecting the next billion users, restrictions on encryption in any country will likely have global impact. Encryption and other anonymizing tools and technologies enable law yers, journalists, whistleblowers, and organizers to communicate freely across borders and to work to better their communities. It also assures users of the integrity of their data and authenticates individuals to companies, governments, and one another.

We encourage you to support the safety and security of users by strengthening the integrity of communications and systems. All governments should reject laws, policies, or other mandates or practices, including secret agreements with companies, that limit access to or undermine encryption and other secure communications tools and technologies.

Users should have the option to use - and companies the option to provide - the strongest encryption available, including end-to-end encryption, without fear that governments will compel access to the content, metadata, or encryption keys without due process and respect for human rights. Accordingly:

Governments should not ban or otherwise limit user access to encryption in any form or otherwise prohibit the implementation or use of encryption by grade or type;

Governments should not mandate the design or implementation of "backdoors" or vulnerabilities into tools, technologies, or services;

Governments should not require that tools, technologies, or services are designed or developed to allow for third- party access to unencrypted data or encryption keys;

Governments should not seek to weaken or undermine encryption standards or intentionally influence the establishment of encryption standards except to promote a higher level of information security. No government should mandate insecure encryption algorithms, standards, tools, or technologies; and

Governments should not, either by private or public agreement, compel or pressure an entity to engage in activity that is inconsistent with the above tenets.

Strong encryption and the secure tools and systems that rely on it are critical to improving cybersecurity, fostering the digital economy, and protecting users. Our continued ability to leverage the internet for global growth and prosperity and as a tool for organizers and activists requires the ability and the right to communicate privately and securely through trustworthy networks.

We look forward to working together toward a more secure future.

Read the letter in full

See the article here:
Global coalition urges "Five Eyes" to respect encryption - IFEX