/ Cory Doctorow / 8 am Sun, Jun 4 2017

Aaron Swartz once said, "It's no longer OK not to understand how the Internet works."

report this ad

He was talking to law-makers, policy-makers and power-brokers, people who were, at best, half-smart about technology -- just smart enough to understand that in a connected world, every problem society has involves computers, and just stupid enough to demand that computers be altered to solve those problems.

Paging Theresa May.

Theresa May says that last night's London terror attacks mean that the internet cannot be allowed to provide a "safe space" for terrorists and therefore working cryptography must be banned in the UK.

This is a golden oldie, a classic piece of foolish political grandstanding. May's predecessor, David Cameron, repeatedly campaigned on this one, and every time he did, I wrote a long piece rebutting him. Rather than writing a new one for May, I thought I'd just dust off a pair of my Cameron-era pieces (1, 2), since every single word still applies.

Theresa May says there should be no "means of communication" which "we cannot read" -- and no doubt many in her party will agree with her, politically. But if they understood the technology, they would be shocked to their boots.

Its impossible to overstate how bonkers the idea of sabotaging cryptography is to people who understand information security. If you want to secure your sensitive data either at rest on your hard drive, in the cloud, on that phone you left on the train last week and never saw again or on the wire, when youre sending it to your doctor or your bank or to your work colleagues, you have to use good cryptography. Use deliberately compromised cryptography, that has a back door that only the good guys are supposed to have the keys to, and you have effectively no security. You might as well skywrite it as encrypt it with pre-broken, sabotaged encryption.

There are two reasons why this is so. First, there is the question of whether encryption can be made secure while still maintaining a master key for the authorities use. As lawyer/computer scientist Jonathan Mayer explained, adding the complexity of master keys to our technology will introduce unquantifiable security risks. Its hard enough getting the security systems that protect our homes, finances, health and privacy to be airtight making them airtight except when the authorities dont want them to be is impossible.

What Theresa May thinks she's saying is, "We will command all the software creators we can reach to introduce back-doors into their tools for us." There are enormous problems with this: there's no back door that only lets good guys go through it. If your Whatsapp or Google Hangouts has a deliberately introduced flaw in it, then foreign spies, criminals, crooked police (like those who fed sensitive information to the tabloids who were implicated in the hacking scandal -- and like the high-level police who secretly worked for organised crime for years), and criminals will eventually discover this vulnerability. They -- and not just the security services -- will be able to use it to intercept all of our communications. That includes things like the pictures of your kids in your bath that you send to your parents to the trade secrets you send to your co-workers.

But this is just for starters. Theresa May doesn't understand technology very well, so she doesn't actually know what she's asking for.

For Theresa May's proposal to work, she will need to stop Britons from installing software that comes from software creators who are out of her jurisdiction. The very best in secure communications are already free/open source projects, maintained by thousands of independent programmers around the world. They are widely available, and thanks to things like cryptographic signing, it is possible to download these packages from any server in the world (not just big ones like Github) and verify, with a very high degree of confidence, that the software you've downloaded hasn't been tampered with.

May is not alone here. The regime she proposes is already in place in countries like Syria, Russia, and Iran (for the record, none of these countries have had much luck with it). There are two means by which authoritarian governments have attempted to restrict the use of secure technology: by network filtering and by technology mandates.

Theresa May has already shown that she believes she can order the nation's ISPs to block access to certain websites (again, for the record, this hasn't worked very well). The next step is to order Chinese-style filtering using deep packet inspection, to try and distinguish traffic and block forbidden programs. This is a formidable technical challenge. Intrinsic to core Internet protocols like IPv4/6, TCP and UDP is the potential to "tunnel" one protocol inside another. This makes the project of figuring out whether a given packet is on the white-list or the black-list transcendentally hard, especially if you want to minimise the number of "good" sessions you accidentally blackhole.

More ambitious is a mandate over which code operating systems in the UK are allowed to execute. This is very hard. We do have, in Apple's Ios platform and various games consoles, a regime where a single company uses countermeasures to ensure that only software it has blessed can run on the devices it sells to us. These companies could, indeed, be compelled (by an act of Parliament) to block secure software. Even there, you'd have to contend with the fact that other EU states and countries like the USA are unlikely to follow suit, and that means that anyone who bought her Iphone in Paris or New York could come to the UK with all their secure software intact and send messages "we cannot read."

But there is the problem of more open platforms, like GNU/Linux variants, BSD and other unixes, Mac OS X, and all the non-mobile versions of Windows. All of these operating systems are already designed to allow users to execute any code they want to run. The commercial operators -- Apple and Microsoft -- might conceivably be compelled by Parliament to change their operating systems to block secure software in the future, but that doesn't do anything to stop people from using all the PCs now in existence to run code that the PM wants to ban.

More difficult is the world of free/open operating systems like GNU/Linux and BSD. These operating systems are the gold standard for servers, and widely used on desktop computers (especially by the engineers and administrators who run the nation's IT). There is no legal or technical mechanism by which code that is designed to be modified by its users can co-exist with a rule that says that code must treat its users as adversaries and seek to prevent them from running prohibited code.

This, then, is what Theresa May is proposing:

* All Britons' communications must be easy for criminals, voyeurs and foreign spies to intercept

* Any firms within reach of the UK government must be banned from producing secure software

* All major code repositories, such as Github and Sourceforge, must be blocked

* Search engines must not answer queries about web-pages that carry secure software

* Virtually all academic security work in the UK must cease -- security research must only take place in proprietary research environments where there is no onus to publish one's findings, such as industry R&D and the security services

* All packets in and out of the country, and within the country, must be subject to Chinese-style deep-packet inspection and any packets that appear to originate from secure software must be dropped

* Existing walled gardens (like Ios and games consoles) must be ordered to ban their users from installing secure software

* Anyone visiting the country from abroad must have their smartphones held at the border until they leave

* Proprietary operating system vendors (Microsoft and Apple) must be ordered to redesign their operating systems as walled gardens that only allow users to run software from an app store, which will not sell or give secure software to Britons

* Free/open source operating systems -- that power the energy, banking, ecommerce, and infrastructure sectors -- must be banned outright

Theresa May will say that she doesn't want to do any of this. She'll say that she can implement weaker versions of it -- say, only blocking some "notorious" sites that carry secure software. But anything less than the programme above will have no material effect on the ability of criminals to carry on perfectly secret conversations that "we cannot read". If any commodity PC or jailbroken phone can run any of the world's most popular communications applications, then "bad guys" will just use them. Jailbreaking an OS isn't hard. Downloading an app isn't hard. Stopping people from running code they want to run is -- and what's more, it puts the whole nation -- individuals and industry -- in terrible jeopardy.

Thats a technical argument, and its a good one, but you dont have to be a cryptographer to understand the second problem with back doors: the security services are really bad at overseeing their own behaviour.

Once these same people have a back door that gives them access to everything that encryption protects, from the digital locks on your home or office to the information needed to clean out your bank account or read all your email, there will be lots more people wholl want to subvert the vast cohort that is authorised to use the back door, and the incentives for betraying our trust will be much more lavish than anything a tabloid reporter could afford.

If you want a preview of what a back door looks like, just look at the US Transportation Security Administrations master keys for the locks on our luggage. Since 2003, the TSA has required all locked baggage travelling within, or transiting through, the USA to be equipped with Travelsentry locks, which have been designed to allow anyone with a widely held master key to open them.

What happened after Travelsentry went into effect? Stuff started going missing from bags. Lots and lots of stuff. A CNN investigation into thefts from bags checked in US airports found thousands of incidents of theft committed by TSA workers and baggage handlers. And though aggressive investigation work has cut back on theft at some airports, insider thieves are still operating with impunity throughout the country, even managing to smuggle stolen goods off the airfield in airports where all employees are searched on their way in and out of their work areas.

The US system is rigged to create a halo of buck-passing unaccountability. When my family picked up our bags from our Easter holiday in the US, we discovered that the TSA had smashed the locks off my nearly new, unlocked, Travelsentry-approved bag, taping it shut after confirming it had nothing dangerous in it, and leaving it completely destroyed in the words of the official BA damage report. British Airways has sensibly declared the damage to be not their problem, as they had nothing to do with destroying the bag. The TSA directed me to a form that generated an illiterate reply from a government subcontractor, sent from a do-not-reply email address, advising that TSA is not liable for any damage to locks or bags that are required to be opened by force for security purposes (the same note had an appendix warning me that I should treat this communication as confidential). Ive yet to have any other communications from the TSA.

Making it possible for the state to open your locks in secret means that anyone who works for the state, or anyone who can bribe or coerce anyone who works for the state, can have the run of your life. Cryptographic locks dont just protect our mundane communications: cryptography is the reason why thieves cant impersonate your fob to your cars keyless ignition system; its the reason you can bank online; and its the basis for all trust and security in the 21st century.

In her Dimbleby lecture, Martha Lane Fox recalled Aaron Swartzs words: Its not OK not to understand the internet anymore. That goes double for cryptography: any politician caught spouting off about back doors is unfit for office anywhere but Hogwarts, which is also the only educational institution whose computer science department believes in golden keys that only let the right sort of people break your encryption.

(Image: Facepalm, Brandon Grasley, CC-BY))

report this ad

report this ad

When Eric Trump raises money for kids cancer charities at his annual Eric Trump Foundation golf invitational, he boasts that his events are super-efficient because he holds them at his dads Trump National Golf Club in Westchester County, New York, where We get to use our assets 100% free of charge. He lied.

Palmer Luckey, the guy who founded Oculus, sold it to Facebook, and then used the money to fund racist, far-right meme creation in the 2016 election cycle is now running a Peter-Thiel-backed startup to build surveillance technology that could be part of Donald Trumps border wall.

Greg Gianforte is a short-tempered, hyper-conservative Montana political hopeful who is standing for the GOP in a special election for a Congressional seat; he is also invested in Russian firms that are under US sanction.

Apple makes it hard to not use iCloud, at least for a few things. Since their cloud storage is baked so deeply into iOS, using iTunes on the desktop to manually move files and backup your device can sometimes feel like an awkward step backwards. To give your iPhone more flexibility to manage large files []

Few things are as relaxing than an afternoon laying around in the sun. But no matter how careful you are, wet towels always seem to track some sand back home with you. The Quicksand Mat eliminates this beach-going annoyance by letting sand easily pass through.Whether you use it as a blanket or a buffer to []

Drones are the perfect way to cheaply shoot aerial video, but it can be difficult to accurately point its camera when your view is limited to a tiny smartphone screen. This quadcopter offers a first-person view of the action in immersive 3D, so you can frame your shots as if you were flying.The Micro Drone []

Originally posted here:
Theresa May wants to ban crypto: here's what that would cost, and ... - Boing Boing

Todays interview is with the founders of Virgil Security: Michael Wellman CEO and Dimitri Dain CTO. The subject is cryptography.

Many will say that the idea of creating a firewall and solid defense is not up to date. They will argue that today the threat is already inside the firewall, or what many call the insider threat. In the commercial world, many financial institutions have reduced fraud through encrypting all data. Todays tools do not provide the latency and delay that many think when considering encryption.

Virgil Security has products that work with software developers to give them the ability to build secure products by using cryptography. In fact, with todays proliferation of sensors and other Internet of Things (IoT) devices, encryption is more important than ever.

During the discussion the topic of trust came up frequently. Virgil Security can help developers provide trusted solutions to mathematically ascertain that you are dealing with the authentic data, device, and identity.

Listen to the interview to get a new perspective on cryptography, encryption, and the entire Public Key Infrastructure (PKI)

See the original post:
Opening up the world of cryptography - FederalNewsRadio.com

Bloomberg Government regularly publishes insights, opinions and best practices from our community of senior leaders and decision makers. This column is written byMarc Van Allen and Umer Chaudhry, who both work inJenner & Blocks DC Office.

A quantum computer can solve certain computational problems in fewer steps than a classical computer. While this efficiency presents opportunities in areas such as machine learning and data analytics, it also poses certain risks in cryptography and cybersecurity. As Dr. Daniel Amihud Lidar of the University of Southern California notes: [t]he irony of quantum computing is that if you can imagine someone building a quantum computer that can break encryption in a few decades into the future, then you need to be worried right now.

The U.S. government is currently researching solutions to potential challenges posed by quantum computers. For organizations that operate classified or unclassified national security systems (NSS), and companies that build products used in NSS, the National Security Agency (NSA) recommends moving to a more quantum-resistant Commercial National Security Algorithm Suite. As quantum computers approach market-readiness, cryptography and cybersecurity professionals in all industries should be assessing their security frameworks and the potential of post quantum-resistant encryption techniques to protect their digital communications.

Impact of Quantum Computers on Encryption

Much of todays digital world relies on public key cryptography to ensure secure communication and transactions between parties. While hackers can steal private information by impersonating authorized users, phishing, or installing malicious software on computer networks, traditional computers are unable to crack standard forms of encryption. Anticipating the power of quantum computers, the American Innovation and Competitiveness Act of 2017 requires the Director of the National Institute of Standards and Technology (NIST) to develop cryptography standards and guidelines for future cybersecurity needs, including quantum-resistant cryptography.

A recent NIST report confirms the risk to public key cryptography posed by quantum computing. NIST found that current encryption methods such as the Diffie-Hellman key exchange, Rivest-Shamir-Adleman (RSA) cryptosystem, and the elliptic curve cryptosystem, are vulnerable to quantum computers. Current encryption methods depend on classical computers inability to factor large numbers in a reasonable time. However, decades ago, Peter Shor of Bell Labs demonstrated that theoretically a quantum computer could find the prime factors of an integer much faster than a classical computer. As quantum computers mature and increase in the size of qubits, the threat to current encryption protocols becomes more imminent.

Export Control

For national security, it is important for the U.S. government to regulate the export of high performance computers, encryption technology, and quantum cryptography. U.S. companies working in this area must ensure compliance with the governments Export Administration Regulations (EAR). Necessary licenses must be obtained to export and even transfer encryption and cryptography technology between a U.S. company and its foreign subsidiary.

Post-Quantum Cryptography and Public-Private Collaboration

Research in post-quantum cryptography is underway in the international community. Substantial progress is being made in Europe through the European Union (EU) projects PQCrypto and SAFEcrypto, and in Japan via the CREST Crypto-Match project. In the U.S., NIST has established the Post-Quantum Crypto Project and is gathering comments from experts to standardize one or more quantum-resistant public-key cryptographic algorithms. More recently, President Trumps executive order on cybersecurity directs the Secretaries of Homeland Security and Commerce to jointly lead an open and transparent process [] to improve the resilience of the internet and communication ecosystem. As a result, NIST has reissued its draft Cybersecurity Framework, seeking comments from industry by June 30, 2017.

The U.S. government will likely be amongst the largest buyers of quantum computers. Therefore, companies with substantial investments in quantum computing such as Google,IBM, and Microsoft should consider working with the U.S. government to develop standards and guidance regarding risks and challenges presented by quantum computers. Such interaction may also help educate government stakeholders on the benefits of leveraging quantum computers to solve important problems through data analytics, machine learning, and artificial intelligence.

Read more:
Cybersecurity and cryptography in the post-quantum world - Bloomberg Government (blog)

British Prime Minister Theresa May has responded to last nights attack in central London in part by calling for tighter controls on online communication. Her words have outraged some technologists who say that the proposal is both unacceptable and at fundamental odds with the spirit of the Internet.

"We cannot allow this ideology the safe space it needs to breed," May said. "Yet that is precisely what the Internet, and the big companies that provide Internet-based services, provide. We need to work with allied democratic governments to reach international agreements that regulate cyberspace to prevent the spread of extremist and terrorism planning. And we need to do everything we can at home to reduce the risks of extremism online."

She added: "We need to deprive the extremists of their safe spaces online."

The comments continue a string of anti-privacy declarations from Mays Conservative government including calls in March for a so-called backdoor to the WhatsApp secure messaging service and major increases in Internet control. May was a sponsor of the Investigatory Powers Act that gave the U.K. government broad surveillance powers.

Get Data Sheet , Fortunes technology newsletter.

Even as they mourned a tragedy that left several Londoners dead and scores injured, commentators showed little but contempt for Mays perspective.

In a long screed, author and BoingBoing co-editor Cory Doctorow eviscerated Mays comments as a classic piece of foolish political grandstanding from a politician who doesnt understand technology very well. Restricting cryptography or building the kind of backdoors that May wants would cripple the Internet as we know it, Doctorow argues: "There's no back door that only lets good guys go through it." Besides, he adds, it cant even be done from a technical standpointthe Internet simply isn't built for top-down administration.

"There is no legal or technical mechanism by which code that is designed to be modified by its users can co-exist with a rule that says that code must treat its users as adversaries and seek to prevent them from running prohibited code," he writes.

Zack Beauchamp at Vox points out that Mays desire for a digital lockdown probably couldnt prevent attacks like the one that happened in London, even if it could be implemented. Thats because, as May herself has made clear, theres no sign that the attackers were part of a broader terrorist network, or connected to perpetrators of other recent attacks. Crude attacks of this sort, says Beauchamp, generate few digital warning signs.

"Its hard to catch people who plan their attacks quickly and dont communicate widely," he writes. "You cant stop someone from driving their car to a crowded area and ramming pedestrians."

Writing at the Guardian , Charles Arthur says May's proposed Internet regulations "open a Pandora's box" of complication.

"The British government could insist that the identities of people who search for certain terror-related words on Google or YouTube or Facebook be handed over," Arthur writes. "But then whats to stop the Turkish government, or embassy, demanding the same about Kurdish people searching on 'dangerous' topics?"

The denizens of 4chan, the popular (and often anonymous) Internet message board and community, were less refined but no less forceful in their analysis of Mays position.

Among the reproducible comments from its "Internet Regulation" section: "they dont care about terrorism they want control over population" and a sarcastic "BAN THE INTERNET."

Not everyone agrees. John Mann, Member of Parliament for England's northern Bassetlaw district, offered support for May's position. "I repeat, yet again, my call for the internet companies who terrorists have again used to communicate to be held legally liable for content," he tweeted Sunday morning.

Meanwhile some prominent Brits such as media personality Piers Morgan have tried to draw attention to massive cuts made to British police forces under May and the Conservatives. Mays critics are blaming those cuts, rather than online freedom of speech, for enabling recent attacksan argument that could seriously weaken Mays anti-terrorism position in advance of a national election on Thursday.

Read more here:
Britain PM Theresa May Calls to 'Regulate Cyberspace' And Critics Are Going Ballistic - Fortune

The phantom of the quantum computer is keeping academia and the IT industry on high alert, says Infineons Thomas Pppelmann (pictured).

Quantum computer attacks on todays cryptography are expected to become reality within the next 15 to 20 years, says Infineon.

Once available, quantum computers could solve certain calculations much faster than todays computers, threatening even best currently known security algorithms such as RSA and ECC.

Various internet standards like Transport Layer Security (TLS), S/MIME or PGP/ GPG use cryptography based on RSA or ECC to protect data communication with smart cards, computers, servers or industrial control systems. Online banking on https sites or instant messaging encryption on mobile phones are well-known examples.

Infineon implemented a post-quantum key exchange scheme on a commercially available contactless smart card chip. Key exchange schemes are used to establish an encrypted channel between two parties. The deployed algorithm is a variant of New Hope, a quantum-resistant cryptosystem also explored successfully by Google on a development version of the Chrome browser.

In a world of quantum computers, PQC (post-quantum cryptography) should provide a level of security that is comparable with what RSA and ECC provide today in the classical computing world, says Infineon.

However, to withstand quantum calculation power, key lengths need to be longer than the usual 2048 bits of RSA or the 256 bits of ECC. Nevertheless, the researchers at Infineon were able to implement New Hope on a commercially available security chip without requiring additional memory space and hence a larger chip size.

Standardization bodies are expected to agree on one or multiple PQC algorithms within the next few years before governments and industries mandate the migration. Infineon is actively participating in the development and standardization process in order to enable a smooth transition and to address security challenges that may arise in the advent of quantum computers.

Read the rest here:
Infineon future-proofs cryptography - Electronics Weekly - Electronics Weekly

Ciao Group recently announced a refreshed business plan to concentrate on developing locally sourced technology and telecommunication services within frontier and emerging economic markets. The Company is in the process of changing its name to NuMelo Technology as part of the business plan refresh.

Learn more about Ciao Group / NuMelo Technology on the Company's website and check back frequently to keep up with the Company's progress to include the two acquisitions anticipated in the near future.

http://www.numelotechnology.com

http://www.otcciau.com

About NuMelo Technology, Inc:

NuMelo Technolgy is dedicated to discovering and developing innovative technology within the world's emerging and frontier markets.NuMelo brings the experience and resources to identify communication technology innovators within the worlds emerging and frontier markets and develop with them marketing and capitalization strategies to overcome the hurdles identified by the World Bank currently hindering the proliferation of emerging and frontier telecommunication services to achieve the corresponding alpha return potential.

Disclaimer/Safe Harbor: This news release contains forward-looking statements within the meaning of the Securities Litigation Reform Act. The statements reflect the Company's current views with respect to future events that involve risks and uncertainties. Among others, these risks include the expectation that any of the companies mentioned herein will achieve significant sales, the failure to meet schedule or performance requirements of the companies' contracts, the companies' liquidity position, the companies' ability to obtain new contracts, the emergence of competitors with greater financial resources and the impact of competitive pricing. In the light of these uncertainties, the forward-looking events referred to in this release might not occur.

Contact NuMelo Technology: Info@otcciau.com +1-866-294-9306

SOURCE Ciao Group, Inc.

More:
Ciao Group Announces New Cryptography Division to Develop ... - PR Newswire (press release)

Make any enquiry about computer security, and you will almost immediately fall over the terms cryptography and encryption (and also decryption), but what exactly is meant by this?

The dictionary (in my case the Oxford English), defines cryptography as hidden writing. It has been around for a very long time. The Ancient Egyptians, the Arabs and the Romans developed their own encryption systems.

Cryptography is used whenever someone want to send a secret message to someone else, in a situation where anyone might be able to get hold of the message and read it. It was often used by generals to send orders to their armies, or to send messages between lovers. The most famous encryption machine invented was the Enigma, used in the Second World War to send military messages. (Several books and at least one film have featured Enigma encryption.)

One of the best examples of early cryptography is the Caesar cipher, named after Julius Caesar because he is thought to have used it even if he didn't actually invent it.

It works like this. Take a piece of paper and write along the top edge the alphabet. Take another piece of paper and do the same thing. You should then have two lines of letters like this:

Now write your message. SEND MONEY TONIGHT

Move one of your pieces of paper along to the right one or more letters so that they no longer line up. That should look like this:

Now every time you see a letter of your message in the top line, write down instead the letter on the bottom line.

SEND MONEY TONIGHT becomes

QCLB KMLCW RMLGEFR

What you have done is performed a cryptographic transformation (encrypted) your message. To do it you have used an algorithm (for each letter in your message, move a number of locations on in the alphabet and write that one down instead) and an encryption key, in this case the value 2 because we moved A two places forwards on the bottom line.

All we have to do now is make sure that the person receiving our message knows the encryption key and the algorithm. As long as they know it's the Caesar cipher and the encryption key is 2 they can put their lower line two places to the right, and by taking each letter of the message and writing down the letter immediately above it, they can re-create the original message.

However, if you think about it, the Caesar cipher wasn't all that brilliant. After all, it didn't have many encryption keys. A value of zero meant that you didn't actually encrypt anything, as did 26 because it also moved A under A. An enemy, knowing that was the algorithm, therefore only had to try a relatively small number of encryption keys before finding yours. By just trial and error he could run quickly through all 25 possible encryption keys on just the first word. As soon as he finds a real word the system is broken.

Until we started using computers, these ciphers, with very much better algorithms and much more complex encryption keys were the order of the day. However, the basic approach to this way of creating secret messages has not really changed. So now you understand the basic method used in any symmetric cipher.

Taking our example above, the operation is as follows:

now you have an encrypted message (ciphertext). The recipient then:

Now they have the original message back (plaintext). This is called a symmetric cipher because you use the same algorithm and the same key to carry out both encryption and decryption. There are other types of cipher systems but they are covered in other encryption white papers.

The quality of the algorithm and encryption key combination (as we saw with the Caesar cipher, making the key bigger on its own did not actually make the encryption any stronger at all) were the factors that made the strength of the system. However, until there was some automation you could not use really complex methods because it simply took too long to encrypt and decrypt messages.

Thanks to computers we are now able to do these things much faster and better than Caesar, or, indeed Enigma. There are many encryption algorithms available far harder to break than the Caesar cipher. These encryption algorithms have strange names, such as Rijndahl, Blowfish, RC2, RC4, Triple DES, CAST. They have key sizes that are enormous by comparison to our Caesar cipher.

Of course, just as computers are able to operate such powerful encryption algorithms, computers can be harnessed to break them. The encryption algorithm DES (Data Encryption Standard) in use for many years to protect banking transactions was considered very strong until the University of Cambridge published a design for a custom machine to break the cipher in minutes, for a manufacturing cost of under $1 million. Fortunately, the encryption algorithms mentioned above are still considered effective.

There are many books available describing encryption and cryptography, either as a history or as a mathematical system or as a guide to use and implementation. The following is a very short list of books appealing to each group.

Originally posted here:
Introduction to Encryption & Cryptography - ArticSoft PGP

The Public-Key Cryptography Standards are specifications produced by RSA Laboratories in cooperation with secure systems developers worldwide for the purpose of accelerating the deployment of public-key cryptography. First published in 1991 as a result of meetings with a small group of early adopters of public-key technology, the PKCS documents have become widely referenced and implemented. Contributions from the PKCS series have become part of many formal and de facto standards, including ANSI X9 documents, PKIX, SET, S/MIME, and SSL.

Further development of PKCS occurs through mailing list discussions and occasional workshops, and suggestions for improvement are welcome. For more information, please contact us.

The draft Version 2.30 of the PKCS #11 specification is now available for 30-day public review. The public review will continue through Wednesday 28-Oct-2009. Please send all comments to pkcs-editor@rsa.com.

See the PKCS #11 page for links to the draft documents.

Contributions for PKCS are welcome! Please read our contribution agreement.

Note: PKCS #2 and PKCS #4 have been incorporated into PKCS #1

Read more here:
Public-Key Cryptography Standards (PKCS) - emclink.net

Why Have Cryptography

Encryption is the science of changing data so that it is unrecognisable and useless to an unauthorised person. Decryption is changing it back to its original form.

The most secure techniques use a mathematical algorithm and a variable value known as a 'key'.

The selected key (often any random character string) is input on encryption and is integral to the changing of the data. The EXACT same key MUST be input to enable decryption of the data.

This is the basis of the protection.... if the key (sometimes called a password) is only known by authorized individual(s), the data cannot be exposed to other parties. Only those who know the key can decrypt it. This is known as 'private key' cryptography, which is the most well known form.

OTHER USES OF CRYPTOGRAPHY

Many techniques also provide for detection of any tampering with the encrypted data. A 'message authentication code' (MAC) is created, which is checked when the data is decrypted. If the code fails to match, the data has been altered since it was encrypted. This facility has may practical applications.

OTHER RESOURCES

The Cryptography Management Toolkit is a resource specifically designed to introduce cryptography in detail. It includes presentations, a comprehensive guide book, check lists, source code for common algorithms, and various other items.

More:
A Cryptography Tutorial and Cryptography Introduction

Latest Articles

A British spy agency is looking for recruits in a group suspicious of government: hackers.

A team of linguists applied statistics-based techniques to translate one of the most stubborn of codes, a German mix of letters and symbols.

A computer scientist discovered that a form of cryptography, believed to have been invented in the 20th century, actually has older roots.

A sculpture at the C.I.A.s headquarters has a secret code in it, and the artist is now offering a bit of help.

A claimed proof for one of the most vexing mathematical problems, P versus NP, set off shock waves online, demonstrating the potential of Web-based collaboration.

Such technical jousting matches are at the heart of the fields of computer security and cryptography.

One of the worlds most prominent cryptographers warned about a hypothetical scenario that could place the security of the global electronic commerce system at risk.

An anonymous computer programmer claims to have hacked the copy protection used in both the HD-DVD and Blu-ray high-definition DVD formats.

The United States Army has for the last month been training detectives of the bomb squad in cryptography to facilitate their work in tracking down the writers of kidnap and threatening letters, it was disclosed yesterday at police headquarters.

A Silicon Valley start-up company on Tuesday plans to unveil a new approach to sending secure electronic messages and protecting data, a simpler alternative to current encryption systems, which use long digital numbers, called public keys. The new company, Voltage Security, which is based here, instead uses another unique identifier as the public key: the message recipient's e-mail address.

LEAD: MOST people even vaguely familiar with computers are aware of two varieties of disks, hard and floppy, on which programs and data are stored. But the lesser-known cartridge disk has lately been gaining popularity with computer users.

Government attempts to control the export of data-scrambling software are an unconstitutional restriction on free speech, a Federal judge said in a ruling made public today. The ruling by Judge Marilyn Hall Patel of Federal District Court in San Francisco is a setback for the Clinton Administration, which has tried to orchestrate a compromise with technology companies that oppose its efforts to control such exports. The Administration seeks to require American companies that develop data-encryption systems to give Government agencies the ability to eavesdrop on data and voice communications.

A serious security flaw has been discovered in Netscape, the most popular software used for computer transactions over the Internet's World Wide Web, threatening to cast a chill over the emerging market for electronic commerce. The flaw, which could enable a knowledgeable criminal to use a computer to break Netscape's security coding system in less than a minute, means that no one using the software can be certain of protecting credit card information, bank account numbers or other types of information that Netscape is supposed to keep private during on-line transactions.

Last month the United States and 32 other countries agreed to create new international controls on the export of data-scrambling hardware and software. Many nations fear that the most advanced scrambling, which makes it impossible for anyone without the key to decode the data, could thwart efforts by intelligence agencies to track terrorists. Though the issue is a product of the information age, battles over secret coding have far older precedents. Below are excerpts from ''The Victorian Internet'' (Walker & Company, 1998), by Tom Standage, in which he writes about what he calls the ''19th-century precursor'' to the Internet: the electric telegraph invented by Samuel Morse and Charles Wheatstone. Cryptography -- tinkering with codes and ciphers -- was a common hobby among Victorian gentlemen. Wheatstone and his friend Charles Babbage, who is best known for his failed attempts to build a mechanical computer, were both keen crackers of codes and ciphers -- Victorian hackers, in effect. ''Deciphering is, in my opinion, one of the most fascinating of arts,'' Babbage wrote in his autobiography, ''and I fear I have wasted upon it more time than it deserves.''

Two of Israel's leading computer scientists say they have found a way to more easily decode and then counterfeit the electronic cash ''smart cards'' that are now widely used in Europe and are being tested in the United States. The researchers have begun circulating the draft of a paper that points out higher security risks than those discovered last month by scientists at Bell Communications Research.

To try to slow the acceptance of the Linux operating system by governments abroad, Microsoft is announcing today that it will allow most governments to study the programming code of its Windows systems. Under the program, governments will also be allowed to plug their security features instead of Microsoft's technology into Windows. More than two dozen countries, including China and Germany, are encouraging agencies to use ''open source'' software -- developed by programmers who distribute the code without charge and donate their labor to debug and modify the software cooperatively. The best-known of the open source projects is GNU Linux, an operating system that Microsoft regards as the leading competitive threat to Windows.

In an important milestone toward making powerful computers that exploit the mind-bending possibilities of calculating with individual atoms, scientists at the I.B.M. Almaden Research Center, in San Jose, Calif., are announcing today that they have performed the most complex such calculation yet: factoring the number 15. The answer itself was no surprise: 3 and 5, the numbers that divide into 15, leaving no remainder. But the exercise that led to that simple result -- the first factoring of a number with an exotic device called a quantum computer -- holds the promise of one day solving problems now considered impossible, and cracking seemingly impenetrable codes.

The technology that will cashier the linguists, mathematicians and hackers who have traditionally devoted themselves to breaking codes comes with a cool name: quantum cryptography. Ordinary cryptographic systems rely on scrambling messages so thoroughly that only a recipient with a code key can unscramble them. Quantum cryptography uses random codes lacking in any pattern that might offer clues to a code breaker. More important, it allows the parties transmitting the code to send it without the fear that it might be intercepted without their knowledge. The result? Unprecedented secrecy and security -- two commodities that are increasingly rare in a world dominated by the free flow of information. For futurists, the development of quantum cryptography is a kind of cosmic victory for personal privacy. Quantum cryptography is more powerful than any computer or eavesdropping equipment that could ever be built. Its impregnability stems from one of the quantum world's weirder but better-known features: that merely observing a quantum system changes it irreversibly. In the realm of quantum mechanics, measuring any system -- coded pulses of light, for example, in a fiber-optic cable that is infiltrated by a spy -- leaves an unalterable trace that immediately betrays the presence of an eavesdropper.

In the obscure world of computer cryptography, there may be no more self-consciously ornery group of coders than the Cypherpunks, an alliance of some of Silicon Valley's best programmers and hardware designers, who preach absolute privacy in the information age. The Cypherpunks, who often communicate among themselves by electronic mail protected with an encryption system popular in the computing underground, feel certain about one thing: The Government should not be creating a national encoding standard, as the Clinton Administration has recently proposed.

A British spy agency is looking for recruits in a group suspicious of government: hackers.

A team of linguists applied statistics-based techniques to translate one of the most stubborn of codes, a German mix of letters and symbols.

A computer scientist discovered that a form of cryptography, believed to have been invented in the 20th century, actually has older roots.

A sculpture at the C.I.A.s headquarters has a secret code in it, and the artist is now offering a bit of help.

A claimed proof for one of the most vexing mathematical problems, P versus NP, set off shock waves online, demonstrating the potential of Web-based collaboration.

Such technical jousting matches are at the heart of the fields of computer security and cryptography.

One of the worlds most prominent cryptographers warned about a hypothetical scenario that could place the security of the global electronic commerce system at risk.

An anonymous computer programmer claims to have hacked the copy protection used in both the HD-DVD and Blu-ray high-definition DVD formats.

The United States Army has for the last month been training detectives of the bomb squad in cryptography to facilitate their work in tracking down the writers of kidnap and threatening letters, it was disclosed yesterday at police headquarters.

A Silicon Valley start-up company on Tuesday plans to unveil a new approach to sending secure electronic messages and protecting data, a simpler alternative to current encryption systems, which use long digital numbers, called public keys. The new company, Voltage Security, which is based here, instead uses another unique identifier as the public key: the message recipient's e-mail address.

LEAD: MOST people even vaguely familiar with computers are aware of two varieties of disks, hard and floppy, on which programs and data are stored. But the lesser-known cartridge disk has lately been gaining popularity with computer users.

Government attempts to control the export of data-scrambling software are an unconstitutional restriction on free speech, a Federal judge said in a ruling made public today. The ruling by Judge Marilyn Hall Patel of Federal District Court in San Francisco is a setback for the Clinton Administration, which has tried to orchestrate a compromise with technology companies that oppose its efforts to control such exports. The Administration seeks to require American companies that develop data-encryption systems to give Government agencies the ability to eavesdrop on data and voice communications.

A serious security flaw has been discovered in Netscape, the most popular software used for computer transactions over the Internet's World Wide Web, threatening to cast a chill over the emerging market for electronic commerce. The flaw, which could enable a knowledgeable criminal to use a computer to break Netscape's security coding system in less than a minute, means that no one using the software can be certain of protecting credit card information, bank account numbers or other types of information that Netscape is supposed to keep private during on-line transactions.

Last month the United States and 32 other countries agreed to create new international controls on the export of data-scrambling hardware and software. Many nations fear that the most advanced scrambling, which makes it impossible for anyone without the key to decode the data, could thwart efforts by intelligence agencies to track terrorists. Though the issue is a product of the information age, battles over secret coding have far older precedents. Below are excerpts from ''The Victorian Internet'' (Walker & Company, 1998), by Tom Standage, in which he writes about what he calls the ''19th-century precursor'' to the Internet: the electric telegraph invented by Samuel Morse and Charles Wheatstone. Cryptography -- tinkering with codes and ciphers -- was a common hobby among Victorian gentlemen. Wheatstone and his friend Charles Babbage, who is best known for his failed attempts to build a mechanical computer, were both keen crackers of codes and ciphers -- Victorian hackers, in effect. ''Deciphering is, in my opinion, one of the most fascinating of arts,'' Babbage wrote in his autobiography, ''and I fear I have wasted upon it more time than it deserves.''

Two of Israel's leading computer scientists say they have found a way to more easily decode and then counterfeit the electronic cash ''smart cards'' that are now widely used in Europe and are being tested in the United States. The researchers have begun circulating the draft of a paper that points out higher security risks than those discovered last month by scientists at Bell Communications Research.

To try to slow the acceptance of the Linux operating system by governments abroad, Microsoft is announcing today that it will allow most governments to study the programming code of its Windows systems. Under the program, governments will also be allowed to plug their security features instead of Microsoft's technology into Windows. More than two dozen countries, including China and Germany, are encouraging agencies to use ''open source'' software -- developed by programmers who distribute the code without charge and donate their labor to debug and modify the software cooperatively. The best-known of the open source projects is GNU Linux, an operating system that Microsoft regards as the leading competitive threat to Windows.

In an important milestone toward making powerful computers that exploit the mind-bending possibilities of calculating with individual atoms, scientists at the I.B.M. Almaden Research Center, in San Jose, Calif., are announcing today that they have performed the most complex such calculation yet: factoring the number 15. The answer itself was no surprise: 3 and 5, the numbers that divide into 15, leaving no remainder. But the exercise that led to that simple result -- the first factoring of a number with an exotic device called a quantum computer -- holds the promise of one day solving problems now considered impossible, and cracking seemingly impenetrable codes.

The technology that will cashier the linguists, mathematicians and hackers who have traditionally devoted themselves to breaking codes comes with a cool name: quantum cryptography. Ordinary cryptographic systems rely on scrambling messages so thoroughly that only a recipient with a code key can unscramble them. Quantum cryptography uses random codes lacking in any pattern that might offer clues to a code breaker. More important, it allows the parties transmitting the code to send it without the fear that it might be intercepted without their knowledge. The result? Unprecedented secrecy and security -- two commodities that are increasingly rare in a world dominated by the free flow of information. For futurists, the development of quantum cryptography is a kind of cosmic victory for personal privacy. Quantum cryptography is more powerful than any computer or eavesdropping equipment that could ever be built. Its impregnability stems from one of the quantum world's weirder but better-known features: that merely observing a quantum system changes it irreversibly. In the realm of quantum mechanics, measuring any system -- coded pulses of light, for example, in a fiber-optic cable that is infiltrated by a spy -- leaves an unalterable trace that immediately betrays the presence of an eavesdropper.

In the obscure world of computer cryptography, there may be no more self-consciously ornery group of coders than the Cypherpunks, an alliance of some of Silicon Valley's best programmers and hardware designers, who preach absolute privacy in the information age. The Cypherpunks, who often communicate among themselves by electronic mail protected with an encryption system popular in the computing underground, feel certain about one thing: The Government should not be creating a national encoding standard, as the Clinton Administration has recently proposed.

Read the original here:
Cryptography - The New York Times