Ironically, Tory MPs might be using WhatsApp encryption to plot … – The indy100

Conservative MPs are reportedly plotting the end of Theresa May's premiership via the very communication method she has campaigned against for so long - encrypted WhatsApp messages.

It's almost as beautiful as calling a snap election, after repeatedly promising you wouldn't, to "strengthen your mandate," only to end up with a minority government forced into discussions with the DUP.

According to reports in theWashington Post, some Conservative MPs are now using WhatsApp to discuss who they could replace her with:

Former minister Ed Vaizey told theBBCthat he supports May staying on, but that Tories were discussing possible replacements.

Asked whether members were calling one another to plot May's ouster this weekend, he denied it.

'That's so 20th century,' he said. 'It's all on WhatsApp.'

As part of her campaign Maypledged wide-ranging internet regulation planswhich could force internet companies to let intelligence services read private communications.

The manifesto read:

Some people say it is not for government to regulate when it comes to technology and the internet. We disagree.

The Tories demand that social media companies - like WhatsApp, for example - remove privacy features in order to 'better combat terrorism', as opposed to not cutting police numbers.

The Investigatory Powers act, commonly known as the 'Snooper's Charter', came into lawin December granting security services some of the widest-ranging spying powers in the world and permitting authorities to read browsing records.

The Prime Minister's plans to regulate the internet and encryption werecriticised as "making life easier for terrorists"by campaign group Open Rights Groups.

Jim Killock, the campaign group's executive director, said:

If successful, Theresa May could push these vile networks into even darker corners of the web, where they will be even harder to observe.

Last December,The Telegraphreportedthat Conservative Brexiteers operated within aWhatsApp group of more than 40 members, apparently to agree'lines to take' in public appearances.

Steve Baker, a Tory MP and group admin said at the time:

That requires instant communication, which is what we use the WhatsApp group for... It is extremely effective.

More:How the UK passed the most invasive surveillance law in democratic history and what we can do about it

More:Map: Did your MP vote for the controversial Snoopers' Charter?

More here:
Ironically, Tory MPs might be using WhatsApp encryption to plot ... - The indy100

Samsung has added its Secure Folder app and file encryption tool to the Play Store – Android Police

The march of Samsung apps moving to Google Play continues. This time it's Secure Folder that has made its way over to every Android Police reader's favorite app store. Whatever it is you might need to keep hidden from prying eyes, now you have one more way to keep the app up-to-date. Unfortunately, it seems that it's limited to Samsung devices.

For the unfamiliar, Secure Folder is an app by Samsung that allows you to store sensitive information in a secure, encrypted folder. Files and applications can both be moved to the secure folder, and it can be locked by a pin, password, pattern, or fingerprint. You can keep an entire user profile separated and encrypted via the app, making it that much easier to hide your double life as a world-renowned pigeon fancier. It's also tied to Samsung's Knox security platform as well so any tampering with the device, such as rooting or a custom ROM, will lock out access to the folder.

I was able to pull the app down onto a tablet I have with a build.prop that was modified with a fictitious device name (long story), but even then it wouldn't launch. Sideloading the APK on other devices also resulted in failure, so unless you have a Samsung phone or tablet, you are probably out of luck. For non-Samsung users, this is less ( ) and more _()_/, but if you have a compatible device, now you have one more way to keep the app updated.

Now the question is, which Samsung app will be next to move to Google Play? If you've got a Samsung device that somehow doesn't have Secure Folder installed, give it a try at Google Play below, or over on APK Mirror.

Read the original here:
Samsung has added its Secure Folder app and file encryption tool to the Play Store - Android Police

Weakened and unstable British PM declares war on encryption – Fudzilla

Gotta blame someone

UK PM Theresa May has failed to notice that bringing out too many unpopular policies can make even an unelectable leftie like Jeremy Corban look viable.

In the middle of negotiating with even less electable born-again Christian homophobic climate change deniers from Northern Ireland to prop up her government, May announced that she was going to take out encryption.

"We cannot allow this ideology the safe space it needs to breed," May said.Yet that is precisely what the internet and the big companies that provide internet-based services provide. We need to work with allied democratic governments to reach international agreements that regulate cyberspace to prevent the spread of extremist and terrorism planning. We need to do everything we can at home to reduce the risks of extremism online."

Of course all this shows that she does not understand how it works. It means stopping Britons from installing software that comes from software creators who are out of her jurisdiction.

Digital activist and author Cory Doctorow described May's call as "a golden oldie, a classic piece of foolish political grandstanding.May says there should be no 'means of communication' which 'we cannot read' and no doubt many in her party will agree with her, politically. But if they understood the technology, they would be shocked to their boots.

"If you want to secure your sensitive data either at rest on your hard drive, in the cloud, on that phone you left on the train last week and never saw again or on the wire, when youre sending it to your doctor or your bank or to your work colleagues, you have to use good cryptography.

"Use deliberately compromised cryptography, that has a back door that only the 'good guys' are supposed to have the keys to, and you have effectively no security. You might as well skywrite it as encrypt it with pre-broken, sabotaged encryption."

Excerpt from:
Weakened and unstable British PM declares war on encryption - Fudzilla

Enigma: Why the fight to break Nazi encryption still matters – CNET – CNET

This is the Enigma machine that enabled secret Nazi communications. Efforts to break that encoding system ultimately helped make D-Day possible.

It was night when three British sailors and a 16-year-old canteen assistant boarded a sinking U-boat off the coast of Egypt. A spotlight shone on them from the HMS Petard, the Royal Navy destroyer that had hunted down the German submarine and now slowly circled the vessel. The U-boat's commander lay dead below the hatch as water poured in from a crack in the hull.

The four men began searching the ship, but not for survivors. They were looking for codebooks.

These red-covered guides were vital to breaking a diabolical code that made Nazi radio messages unintelligible. The Germans had been using a typewriter-like machine to encrypt their communications. They called it Enigma and were sure the code was unbreakable.

The British were determined to prove them wrong.

Wading past bodies through slowly rising water, First Lieutenant Anthony Fasson, Able Seamen Colin Grazier and Kenneth Lacroix, and young Tommy Brown found the captain's quarters and began searching drawers and breaking into cabinets. They found two codebooks written in red, water-soluble ink: the Short Weather Cipher, used to condense weather reports into a seven-letter message, and the Short Signal Book, used to report convoy sightings, along with other documents.

While Grazier and Fasson continued to search below, Brown carried the books up the ladder of the sub's conning tower to a waiting boat. They were racing against time as seawater poured into the submarine.

On his third trip up the ladder, Brown called for his shipmates to come up, too -- but it was too late. U-559 sank before Fasson and Grazier could escape that night in October 1942. As Hugh Sebag-Montefiore recounts in "Enigma: The Battle for the Code," their bravery helped changed the course of World War II.

The U-boat codes created by Enigma were especially hard to break, and the Allies found themselves locked out for weeks or months at a time. But several months after they recovered the codebooks from U-559 -- on March 19, 1943 -- cryptographers stationed in Britain's Bletchley Park broke through into U-boats' Enigma-coded messages and were never fully locked out again.

From then on, their efforts only improved. By September of that year, the Allies were reading encrypted U-boat messages within 24 hours of intercepting them. The breakthrough allowed the Allies to decrypt detailed field messages on German defenses in Normandy, the site of the impending D-Day invasion. And the machines themselves advanced the world's technology -- pushing forward ideas about computer programming and memory.

"I'd call it the key to computing," says Ralph Simpson, a retired computer expert and amateur Enigma historian.

The years since have given us a cat-and-mouse game between codebreakers and cryptographers, with each side trying to outwit the other. Those battles are still raging. But they're no longer confined to blackboards and spinning rotors on crude computers. They move at the speed of electrons flowing through your computer's processor.

Today's computer-enabled encryption -- technology that scrambles what unauthorized viewers see -- is so complex that computers can't break it unless it's been used incorrectly. It's so powerful that the US government and others have tried to legally require tech companies to unlock their own encryption, as was the case with Apple and the government last year over a terrorist's locked iPhone.

And today's encryption is so useful that dissidents, spies and terrorists rely on it to protect their conversations.

The innovation won't stop. Future advances in quantum computing might be able to crack even perfectly implemented encryption. That's led mathematicians to pre-emptively try to make encryption even stronger.

It's a cycle without end in sight.

Before the internet wove its way into our lives, encryption was pretty much something businesses and governments used to protect sensitive data, like financial documents and Social Security records.

"Mostly it was banks, diplomatic services and the military who used cryptography throughout history," says Bill Burr, a retired cryptographer from the US National Institute of Standards and Technology.

The internet increased the use of encryption, as business and governments sent information over networks that hackers and spies could easily intercept. But few regular people went out of their way to use encryption as part of daily life. Maybe your paranoid friend would encrypt his email, forcing you to use extra software to read it.

That changed after disclosures by former NSA contractor Edward Snowden, who in the summer of 2013 revealed the existence of government mass surveillance programs designed to collect reams of information from everything -- our emails, calls and texts. Though we were told the programs weren't designed to target Americans, the disclosures forced us to ask how much information we want to put on the internet -- and potentially expose.

The tech industry has tried to address the problem by offering us another option: encrypting as much of our lives as we can.

What's made this possible was the Engima, and the men, women, mathematicians, computer scientists and linguists who ultimately beat it.

This is their story.

The Enigma has a surprisingly understated design for being such a deadly tool. It could easily be mistaken for a typewriter with a few extra parts, housed in a plain wooden box.

Lifting the lid of an Enigma, a German operator saw what might on first glance seem like two typewriters squished together. One set of keys, closest to the operator, was the actual keyboard to be typed on.

Above it was a second set of keys, laid out just like the keyboard. But when you type on the real keyboard, these letters light up. Type an "a" on the normal keyboard, for example, and "x" lights up above.

So if you start typing a word, each letter lights up in code.

This was Enigma's genius. The German operators didn't need to understand the complex math or electronics that scrambled what they typed on the keyboard. All they knew was that typing "H-E-L-L-O" would light up as "X-T-Y-A-E," for example. And that's the message they sent around.

This jumbling of letters changed each day at midnight, when Nazi commanders would send new settings that Enigma operators would use to turn dials and change the plugs on a board below the keys, all designed to match the day's code. Without the code, the message couldn't be unscrambled.

Enigma was so sophisticated it amounted to what's now called a 76-bit encryption key. One example of how complex it was: typing the same letters together, like "H-H" (for Heil Hitler") could result in two different letters, like "L-N."

That type of complexity made the machines impossible to break by hand, Simpson says.

How impossible? If you gave 100,000 operators each their own Enigma machine, and they spent 24 hours a day, 7 days a week testing a new setting every second, "it would take twice the age of the universe to break the code," Simpson says.

Obviously, codebreaking by hand wasn't going to cut it.

"Because we now have machine encryption for the first time, it took a machine to break it," Simpson says.

Equally fascinating is that Nazi military leaders knew, in theory, that someone could develop a machine-assisted way to speed up their code cracking. But they didn't believe their enemies would put in the time and resources needed.

They were wrong.

14

See Alan Turing's lost notes, found in the walls of Bletchley Park 70 years later

Of course, the UK was very motivated to break the Enigma. German U-boats were sinking hundreds of British ships, costing thousands of lives and choking the country off from vital supplies being shipped from the United States and Canada. What's more, the country was desperate for any advantage in the early days of the war, filled with German bombing campaigns and fears of a land invasion.

So resources, manpower and the lives of sailors like Fasson and Glazier were poured into cracking the Enigma codes. The first result of these efforts was the Bombe.

Custom-designed by British mathematicians like Alan Turing, Bombes were about the size of three vending machines stacked side by side, with a series of spinning rotators connected in the back by a 26-way cable. They were based on the Polish "Bomba" codebreaking machine, which the Poles were forced to abandon in 1939, after their country was invaded by Germany.

Housed at a secretive intelligence program on the grounds of manor house Bletchley Park, less than 50 miles outside of London, and other nearby installations, the Bombes were run by teams of Navy women.

Each of the Bombe's rotators had letters on it and, as they spun, the machine tested possible solutions to a given Enigma code much faster than a human could.

Researchers like Turing and his team were able to make the Bombes more efficient by using "pinched" codebooks from U-boats and other clues, eliminating thousands of possible solutions.

"If we understand the book, we then know what the submarines are likely to say," says David Kenyon, a research historian at the Bletchley Park Trust.

Breaking into the U-boat's "Shark" code in 1943 set in motion a series of dominoes that ultimately led to the Nazi defeat. Intercepted U-boat messages made the Allies better at sinking the vessels, which contributed to the German Navy's decision to pull its U-boats out of the Atlantic later that year, Kenyon says. That respite allowed the Allies to prepare for D-Day in 1944 and to end the war in 1945.

While codebreaking alone didn't win World War II, it was one of the most powerful weapons invented for that purpose.

"There was no point in the Second World War where the outcome was a foregone conclusion," Kenyon says. There's no telling what might have happened "if you took away any of the factors that were working in the Allies' favor."

35

Photo Tour of Bletchley Park

The work done on the Bombes and other codebreaking machines didn't just aid in the fight against the Nazis. They proved theories about computer programming and data storage, the lifeblood of today's modern computers.

One of these breakthroughs came when the Joseph Desch of the US Navy found a way to speed up the Bombe. The machines could only run so fast, because operators read the results of the codebreaking analysis right off of the wheels themselves. Go any faster and the wheels would spin right past the correct answer.

Desch's solution was a primitive form of digital memory. When the Bombe came upon the correct answer, electrical relays would detect and record it. That let the US Bombes spin more than 17 times faster than the British Bombes.

Then there was Colossus. This machine -- designed not to break Enigma, but rather the more sophisticated Lorenz codes used by the German High Command -- advanced vacuum tube tech that later came to power the world's first true computers, like the ENIAC and Mark-1, and then the first generation of IBM mainframes.

To create a codebreaking machine powerful enough to crack Lorenz, British engineer Tommy Flowers found a way to run more than 2,000 vacuum tubes at once. While it had been theorized this approach could power a programmable computer, Flowers was the first to make it happen.

Flowers himself didn't get a chance to push this technology to its next logical conclusion. But Turing and other Bletchley alums worked at the University of Manchester after the war, creating the Ferranti Mark 1 -- a programmable computer run with vacuum tubes.

That the work at Bletchley showed up later in the first general-purpose computers doesn't surprise Burr. The codebreakers were able to fully understand the workings of Enigma and the Lorenz code create machines to break them at a time when the principles of computing only existed in theory.

"It's hard for me to imagine people smart enough to do that," says Burr, who's an expert in cryptography.

In terms of global politics, encryption was pretty straightforward during World War II. One nation tapped its linguists and mathematicians -- and relied on the heroism of men who boarded sinking U-boats -- to crack the encryption tech of an enemy force.

The world's gotten a lot more complicated since then.

Just as in World War II, law enforcement and spy agencies today try to read the communications of criminals, terrorists and spies. But now that almost everyone uses encryption, a government's ability to break it doesn't just worry our country's enemies -- it concerns us, too.

And despite the advances in computing and encryption since Bletchley Park, we haven't come close to agreeing on when it's okay to break encryption.

Case in point: the 2016 conflict between Apple and the US Federal Bureau of Investigation. The FBI wanted Apple's help breaking into the iPhone of a suspected terrorist, but Apple argued that this could put everyone who uses an iPhone at risk.

Burr, who saw the inside of public controversies over the government breaking encryption during his time at the National Institute of Standards and Technology, says there's no clear path forward.

"There's just a big dilemma there," he says. Creating ways to break encryption "will weaken the actual strength of your security against bad guys of ability. And you have to count among those the state actors and pretty sophisticated and organized criminals."

In their laser-focused effort to crack Nazi encryption, codebreakers like Turing and soldiers like Fasson and Grazier were unlikely to have imagined a world like this. But here it is: the catch-22 of computerized encryption. And it's not going away anytime soon.

Special Reports: CNET's in-depth features in one place.

Tech Enabled: CNET chronicles tech's role in providing new kinds of accessibility.

Read more:
Enigma: Why the fight to break Nazi encryption still matters - CNET - CNET

Infosec17: Society needs to address encryption dilemma – ComputerWeekly.com

According to one of the directors at Interpol we are facing a tsunami of criminality online, says Mary Aiken, forensic cyber psychologist and advisor to the European Cyber Crime Centre (EC3) at Europol.

Find out what are the most appropriate threat intelligence systems and services for your organisation

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

We are going to have to think about governance in this space even though this makes some people uncomfortable, she told Infosecurity Europe 2017 in London.

But if we do not have some form of governance in the cyber context, that will negatively affect real-world social order, she said.

Aikens comments coincide with fresh calls by the European Commission (EC) to give law enforcement new powers to obtain information from online service providers such as Facebook and Google as part of new measures to fight terrorism.

The EC has proposed multiple ways to make it easier for police to retrieve data stored in the cloud directly from technology companies in response to complaints about delays in investigations, reports the Telegraph.

The proposals include allowing security forces in one member state to ask a tech firm directly for data without consulting the authorities in that state, introducing an obligation on tech firms to hand over data to any force from a member state when a legal request is made, and giving police forces direct access to servers so they can copy the data they need.

This third option is kind of an emergency possibility which will require some additional safeguards protecting the privacy of people, Vera Jourova, European Union (EU) justice commissioner, told Reuters. These safeguards would include requiring that law enforcement requests are necessary and proportionate, she added.

EU justice ministers are aiming to put forward a proposal for future legislation in this regard by the end of the year or early 2018.

According to Aiken, there are three aims in apparent conflict, which are privacy, collective security and the aim of the vitality of the tech industry.

To achieve a balance in cyber space, none of those aims can have primacy over the other, she said, adding that she is very concerned from a policing and governance point of view that there are encrypted domains that are effectively beyond the law or cannot be accessed easily when necessary.

It will be almost impossible real-time to deliver on collective security when this information in obfuscated, she said, suggesting there needs to be a conversation about how best to resolve these tensions.

We need to stop thinking about things like cyber security and child development in silos and start joining the dots, said Aiken.

It is all connected. We cant look at any one problem in isolation. Hackers dont wake up at 15 and decide to become a hacker. Theres a developmental pathway to hacking, and if we can understand that and address that early on, then we can start tackling that problem over time.

The UK has shown incredible leadership in this regard, said Aiken, in terms of access to online pornography, which is very damaging for young people and looking at online age verification, which is critical in terms of child protection.

This is an issue that everyone in society should be concerned about, she said, because in time these children will begin to shape society. When we are all sitting in a nursing home, they are the ones who are going to be running the country, and they may not have the level of empathy that is conducive to looking after everybody else.

Asked about concerns from the information security community about giving advantages to criminals by making data more accessible to law enforcement, Aiken said this is the crux of the debate, but without being prescriptive about what should be done, there have to be checks and balances in place.

Effectively, if we see increasing amounts of negative behaviour associated with wide use of encryption across social media platforms, for example, and that has a negative impact, then we are going to have to think about it again and have a conversation about where robust encryption is appropriate and where it is not, she said.

See more here:
Infosec17: Society needs to address encryption dilemma - ComputerWeekly.com

VSAN Encryption: What it is, what it does and how to use it – TechTarget

VMware vSAN 6.6 is the first software-defined storage offering of its kind to include native hyper-converged infrastructure...

Enjoy this article as well as all of our content, including E-Guides, news, tips and more.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

encryption within the hypervisor. VSAN 6.6 builds data-at-rest encryption into the vSAN kernel, enables it at the cluster level and encrypts all objects in the vSAN data store. This new feature is called vSAN Encryption.

Cybersecurity is a top priority for most companies, so vSAN Encryption is a welcome addition to vSAN. IT administrators have long been reluctant to deploy encryption at the OS level or allow applications owners to encrypt their apps and data. VSAN Encryption eliminates this issue by encrypting the entire vSAN data store.

VSAN Encryption is hardware-agnostic, which means admins can deploy the storage hardware device of their choice without the need for expensive self-encrypting drives.

VSAN Encryption is available for both hybrid and all-flash configurations and requires a key management server (KMS) compliant with Key Management Interoperability Protocol 1.1 in order to associate with vCenter Server. VSAN Encryption performs encryption with a xor-encrypt-xor-based tweaked-codebook mode withciphertext stealing (XTS) Advanced Encryption Standard (AES) 256 cipher at both the cache and capacity tier -- anywhere data is at rest. VSAN Encryption is also compatible with vSAN all-flash efficiency features, such as deduplication, compression and erasure coding; this means it delivers highly efficient and secure storage. Data is encrypted as it enters the cache tier and, as it destages, is decrypted. Finally, the data is deduplicated and compressed as it enters the capacity tier, where it is encrypted again.

VSAN Encryption is compatible with vSAN all-flash efficiency features, such as deduplication, compression and erasure coding; this means it delivers highly efficient and secure storage.

VSAN Encryption's cryptographic mechanics are similar to those of vSphere 6.5 VM Encryption. Both use the same encryption library, provided you have a supported KMS. In fact, you can use the same KMS for both vSAN Encryption and VM Encryption. However, that's where the similarities end. VM Encryption occurs on a per-VM basis via vSphere API for I/O filtering, whereas vSAN Encryption encrypts the entire data store.

The other major difference is that vSAN Encryption is a two-level encryption method: It uses a key encryption key (KEK) to encrypt a data encryption key (DEK). The DEK is a randomly generated key that encrypts data on each disk. Each vSAN host stores the encrypted DEKs but does not store the KEK on disk. If the host requires the KEK, it requests it from the KMS.

VSAN Encryption occurs when vCenter Server requests an AES-256 KEK from the KMS. VCenter Server only stores the KEK's ID, not the key itself. The ESXi host then encrypts disk data with the industry standard AES-256 XTS mode. Each disk has a different randomly generated DEK. Each ESXi host then uses the KEK to encrypt its DEKs and stores the encrypted DEKs on disk. As mentioned before, the host does not store the KEK on disk. If a host reboots, it requests the KEK with the corresponding ID from the KMS. The host can then decrypt its DEKs as needed.

The host uses a host key to encrypt core dumps, not data. All hosts in the same cluster use the same host key. VSAN Encryption generates a random key to re-encrypt the core dumps when it collects support bundles. Use a password when you encrypt the random key.

When an encrypted vSAN host reboots, it does not mount its disk groups until it receives the KEK, which means this process can take several minutes or more to complete. Also, encryption can be CPU-intensive. Intel AES New Instructions (AES-NI) significantly improves encryption performance, so enable AES-NI in your system's Basic Input/Output System.

To encrypt data with vSAN Encryption, first add a KMS to your vCenter Server and establish a trusted connection with it. Do not deploy your KMS on the data store you intend to encrypt because, if a failure should occur, hosts in the vSAN cluster must communicate with the KMS.

Select the vCenter Server to which you wish to deploy the KMS and, under the Configure tab, select Key Management Servers and add your KMS details.

Figure 1 shows options for establishing a trusted connection between vCenter, ESXi hosts and KMS. Once you choose one of these options, you can enable encryption in your vSAN cluster.

It's incredibly easy to turn on vSAN Encryption. Simply select the vSAN cluster and navigate to the Configure tab. Under Settings, select General. Click the Edit button and tick the boxes next to "Turn ON vSAN" and "Encryption." Be sure to select the appropriate KMS cluster.

In this window, you'll also see options to "Erase disks before use" and "Allow Reduced Redundancy." "Erase disks before use" wipes existing data from storage devices as they are encrypted. Be aware that this increases the disk reformatting time.

If your vSAN cluster already has a significant number of VMs deployed to it and you're concerned that there isn't sufficient available capacity to evacuate the disk group prior to encryption, the "Allow Reduced Redundancy" option reduces the VM's protection level to free up space to carry out the encryption. This method doesn't evacuate data to other hosts in the cluster; it just removes each disk group, upgrades the on-disk format and adds the disk group back. All objects remain available but with reduced redundancy.

Once you click OK, vSAN will reformat all of the disks in the group. This is a rolling format in which vSAN removes one disk group at a time, evacuates the data from those disk groups, formats each disk to on-disk version 5.0, re-creates the disk group and moves on to the next. This can take a considerable amount of time, especially if vSAN needs to migrate large amounts of data on the disks during reformatting.

Be aware that if, at any point, you choose to disable vSAN Encryption, vSAN will perform a similar reformatting process to remove encryption from the disks.

If you need to regenerate the encryption keys, you can do so within the vSAN configuration user interface. There are two methods for regenerating a key. The first is a high-level re-key where a new KEK encrypts the existing DEK. The other is a complete re-encryption of all data with KEKs and DEKs. This option takes significant time to complete, as all data must be re-encrypted with the new key.

To generate new encryption keys, click the Configure tab. Under vSAN, select General and then click Generate New Encryption Key. This opens a window in which you can generate new encryption keys, as well as re-encrypt all data in the vSAN cluster. To generate a new KEK, click OK. The DEKs will be re-encrypted with the new KEK.

VMware cashes in on HCI trend in vSAN 6.5 and 6.6

Why data-at-rest security is on the rise

Best of the best enterprise encryption tools in 2016

See the original post here:
VSAN Encryption: What it is, what it does and how to use it - TechTarget

Enigma: Why the fight to break Nazi encryption still matters – News … – WDEF News 12

It was night when three British sailors and a 16-year-old canteen assistant boarded a sinking U-boat off the coast of Egypt. A spotlight shone on them from the HMS Petard, the Royal Navy destroyer that had hunted down the German submarine and now slowly circled the vessel. The U-boats commander lay dead below the hatch as water poured in from a crack in the hull.

The four men began searching the ship, but not for survivors. They were looking for codebooks.

These red-covered guides were vital to breaking a diabolical code that made Nazi radio messages unintelligible. The Germans had been using a typewriter-like machine toencrypttheir communications. They called it Enigma and were sure the code was unbreakable.

The British were determined to prove them wrong.

Wading past bodies through slowly rising water, First Lieutenant Anthony Fasson, Able SeamenColin GrazierandKenneth Lacroix, andyoung Tommy Brownfound the captains quarters and began searching drawers and breaking into cabinets. They found two codebooks written in red, water-soluble ink: the Short Weather Cipher, used to condense weather reports into a seven-letter message, and theShort Signal Book, used to report convoy sightings, along with other documents.

While Grazier and Fasson continued to search below, Brown carried the books up the ladder of the subs conning tower to awaiting boat. They were racing against time as seawater poured into the submarine.

On his third trip up the ladder, Brown called for his shipmates to come up, too but it was too late. U-559 sank before Fasson and Grazier could escape that night in October 1942. As Hugh Sebag-Montefiore recounts in Enigma: The Battle for the Code, their bravery helped changed the course of World War II.

Play Video

SciTech

A rare manuscript written by British mathematician and code-breaker Alan Turing has gone up for auction along with several other pieces of comput

The U-boat codes created by Enigma were especially hard to break, and the Allies found themselves locked out for weeks or months at a time. But several months after they recovered the codebooks from U-559 on March 19, 1943 cryptographers stationed in BritainsBletchley Parkbroke through into U-boats Enigma-coded messages and were never fully locked out again.

From then on, their efforts only improved. By September of that year, the Allies were reading encrypted U-boat messages within 24 hours of intercepting them. The breakthrough allowed the Allies to decrypt detailed field messages on German defenses in Normandy, the site of the impending D-Day invasion.And the machines themselves advanced the worlds technology pushing forward ideas about computer programming and memory.

Id call it the key to computing, says Ralph Simpson, a retired computer expert and amateur Enigma historian.

The years since have given us a cat-and-mouse game between codebreakers and cryptographers, with each side trying to outwit the other. Those battles are still raging. But theyre no longer confined to blackboards and spinning rotors on crude computers. They move at the speed of electrons flowing through your computers processor.

Todays computer-enabled encryption technology that scrambles what unauthorized viewers see is so complex that computers cant break it unless its been used incorrectly. Its so powerful that the US government and others have tried to legally require tech companies to unlock their own encryption, as was the case withAppleand the government last year over a terrorists lockediPhone.

And todays encryption is so useful that dissidents, spies and terrorists rely on it to protect their conversations.

The innovation wont stop. Future advances in quantum computing might be able to crack even perfectly implemented encryption. Thats led mathematicians to pre-emptively try to make encryption even stronger.

Its a cycle without end in sight.

Before the internet wove its way into our lives, encryption was pretty much something businesses and governments used to protect sensitive data, like financial documents and Social Security records.

Mostly it was banks, diplomatic services and the military who used cryptography throughout history, says Bill Burr, a retired cryptographer from the US National Institute of Standards and Technology.

The internet increased the use of encryption, as business and governments sent information over networks that hackers and spies could easily intercept. But few regular people went out of their way to use encryption as part of daily life. Maybe your paranoid friend would encrypt his email, forcing you to use extra software to read it.

Play Video

Evolving Technologies

Modern technology has transformed the playing field for spies and hackers all over the world. Lindsey Boerma reports.

That changed after disclosures by former NSA contractorEdward Snowden, who in the summer of 2013 revealed the existence of government mass surveillance programs designed to collect reams of information from everything our emails, calls and texts. Though we were told the programs werent designed to target Americans, the disclosures forced us to ask how much information we want to put on the internet and potentially expose.

Thetech industryhas tried to address the problem by offering us another option: encrypting as much of our lives as we can.

Whats made this possible was the Engima, and the men, women, mathematicians, computer scientists and linguists who ultimately beat it.

This is their story.

The Enigma has a surprisingly understated design for being such a deadly tool. It could easily be mistaken for a typewriter with a few extra parts, housed in a plain wooden box.

Lifting the lid of an Enigma, a German operator saw what might on first glance seem like two typewriters squished together. One set of keys, closest to the operator, was the actual keyboard to be typed on.

Above it was a second set of keys, laid out just like the keyboard. But when you type on the real keyboard, these letters light up. Type an a on the normal keyboard, for example, and x lights up above.

So if you start typing a word, each letter lights up in code.

This was Enigmas genius. The German operators didnt need to understand the complex math or electronics that scrambled what they typed on the keyboard. All they knew was that typing H-E-L-L-O would light up as X-T-Y-A-E, for example. And thats the message they sent around.

This jumbling of letters changed each day at midnight, when Nazi commanders would send new settings that Enigma operators would use to turn dials and change the plugs on a board below the keys, all designed to match the days code. Without the code, the message couldnt be unscrambled.

Enigma was so sophisticated it amounted to whats now called a 76-bit encryption key. One example of how complex it was: typing the same letters together, like H-H (for Heil Hitler) could result in two different letters, like L-N.

That type of complexity made the machines impossible to break by hand, Simpson says.

How impossible? If you gave 100,000 operators each their own Enigma machine, and they spent 24 hours a day, 7 days a week testing a new setting every second, it would take twice the age of the universe to break the code, Simpson says.

Obviously, codebreaking by hand wasnt going to cut it.

Because we now have machine encryption for the first time, it took a machine to break it, Simpson says.

Equally fascinating is that Nazi military leaders knew, in theory, that someone could develop a machine-assisted way to speed up their code cracking. But they didnt believe their enemies would put in the time and resources needed.

They were wrong.

Of course, the UK was very motivated to break the Enigma. German U-boats were sinking hundreds of British ships, costing thousands of lives and choking the country off from vital supplies being shipped from the United States and Canada. Whats more, the country was desperate for any advantage in the early days of the war, filled with German bombing campaigns and fears of a land invasion.

So resources, manpower and the lives of sailors like Fasson and Glazier were poured into cracking the Enigma codes. The first result of these efforts was the Bombe.

Play Video

Sunday Morning

Anthony Mason visits with actor Benedict Cumberbatch to talk about his role as mathematician Alan Turing in The Imitation Game, a new film reco

Custom-designed by British mathematicians likeAlan Turing, Bombes were about the size of three vending machines stacked side by side, with a series of spinning rotators connected in the back by a 26-way cable. They were based on the Polish Bomba codebreaking machine, which the Poles were forced to abandon in 1939, after their country was invaded by Germany.

Housed at a secretive intelligence program on the grounds of manor houseBletchley Park, less than 50 miles outside of London, and other nearby installations, the Bombes were run by teams of Navy women.

Each of the Bombes rotators had letters on it and, as they spun, the machine tested possible solutions to a given Enigma code much faster than a human could.

Researchers like Turing and his team were able to make the Bombes more efficient by using pinched codebooks from U-boats and other clues, eliminating thousands of possible solutions.

If we understand the book, we then know what the submarines are likely to say, says David Kenyon, a research historian at the Bletchley Park Trust.

Breaking into the U-boats Shark code in 1943 set in motion a series of dominoes that ultimately led to the Nazi defeat. Intercepted U-boat messages made the Allies better at sinking the vessels, which contributed to the German Navys decision to pull its U-boats out of the Atlantic later that year, Kenyon says. That respite allowed the Allies to prepare for D-Day in 1944 and to end the war in 1945.

While codebreaking alone didnt win World War II, it was one of the most powerful weapons invented for that purpose.

There was no point in the Second World War where the outcome was a foregone conclusion, Kenyon says. Theres no telling what might have happened if you took away any of the factors that were working in the Allies favor.

The work done on the Bombes and other codebreaking machines didnt just aid in the fight against the Nazis. They proved theories about computer programming and data storage, the lifeblood of todays modern computers.

One of these breakthroughs came when the Joseph Desch of the US Navy found a way to speed up the Bombe. The machines could only run so fast, because operators read the results of the codebreaking analysis right off of the wheels themselves. Go any faster and the wheels would spin right past the correct answer.

Deschs solution was a primitive form of digital memory. When the Bombe came upon the correct answer, electrical relays would detect and record it. That let the US Bombes spin more than 17 times faster than the British Bombes.

Then there was Colossus. This machine designed not to break Enigma, but rather the more sophisticated Lorenz codes used by the German High Command advanced vacuum tube tech that later came to power the worlds first true computers, like the ENIAC and Mark-1, and then the first generation of IBM mainframes.

To create a codebreaking machine powerful enough to crack Lorenz, British engineer Tommy Flowers found a way to run more than 2,000 vacuum tubes at once. While it had been theorized this approach could power a programmable computer, Flowers was the first to make it happen.

Flowers himself didnt get a chance to push this technology to its next logical conclusion. But Turing and other Bletchley alums worked at the University of Manchester after the war, creating theFerranti Mark 1 a programmable computer run with vacuum tubes.

That the work at Bletchley showed up later in the first general-purpose computers doesnt surprise Burr. The codebreakers were able to fully understand the workings of Enigma and the Lorenz code create machines to break them at a time when the principles of computing only existed in theory.

Its hard for me to imagine people smart enough to do that, says Burr, whos an expert in cryptography.

In terms of global politics, encryption was pretty straightforward during World War II. One nation tapped its linguists and mathematicians and relied on the heroism of men who boarded sinking U-boats to crack the encryption tech of an enemy force.

The worlds gotten a lot more complicated since then.

Just as in World War II, law enforcement and spy agencies today try to read the communications of criminals, terrorists and spies. But now that almost everyone uses encryption, a governments ability to break it doesnt just worry our countrys enemies it concerns us, too.

And despite the advances in computing and encryption since Bletchley Park, we havent come close to agreeing on when its okay to break encryption.

Case in point: the 2016 conflict betweenApple and the US Federal Bureau of Investigation. The FBI wanted Apples help breaking into the iPhone of a suspected terrorist, but Apple argued that this could put everyone who uses an iPhone at risk.

Burr, who saw the inside of public controversies over the government breaking encryption during his time at the National Institute of Standards and Technology, says theres no clear path forward.

Theres just a big dilemma there, he says. Creating ways to break encryption will weaken the actual strength of your security against bad guys of ability. And you have to count among those the state actors and pretty sophisticated and organized criminals.

In their laser-focused effort to crack Nazi encryption, codebreakers like Turing and soldiers like Fasson and Grazier were unlikely to have imagined a world like this. But here it is: the catch-22 of computerized encryption. And its not going away anytime soon.

This article originally appeared on CNET.

2017 CBS Interactive Inc.

Go here to read the rest:
Enigma: Why the fight to break Nazi encryption still matters - News ... - WDEF News 12

MultiChoice welcomes judgement on digital TV encryption – MyBroadband

MultiChoice has welcomed the Constitutional Courts order in favour of the decision made by former communications minister Faith Muthambi regarding no encryption in government set-top boxes.

We trust this will pave the way for the long-awaited migration to digital terrestrial television, said MultiChoice.

The set-top boxes in question will be manufactured locally and distributed to low-incomehouseholds which cannotafford the converter needed to receive a digital TV signal.

South Africas digital migration calls for old analogueTV signals to be switched off, which means these families may have been left without access to TV channels.

The policy of non-encryption will ensure that poor households benefit from and are included in the migration from analogue to digital terrestrial television and that taxpayers are spared millions of rand in unnecessary costs.

MultiChoice said Chief Justice Mogoeng Mogoengs statement on the caseallays any fears raised regarding the implications of the non-encryption policy.

None of the broadcasters, including free-to-air broadcasters, would be required to do any more than they have previously been required to do. Nor would any be deprived of any advantage or privilege currently enjoyed in relation to access to their viewership and profit-making opportunities.

Here is the original post:
MultiChoice welcomes judgement on digital TV encryption - MyBroadband

Encryption: Securing Sensitive Data in Changing Corporate …

Data security has traditionally been seen as a matter of locking down data in a physical location, such as a data center. But as data migrates across networks, borders, mobile devices, and into the cloud and Internet of Things (IoT), focusing solely on the physical location of data is no longer relevant.

To prevent disclosure of sensitive corporate data to unauthorized people in this new corporate environment, data needs to be secured. Encryption and data masking are two primary ways for securing sensitive data, either at rest or in motion, in the enterprise. It is an important part of endpoint security.

Encryption is the process of encoding data in such a way that only authorized parties can access it. Using homomorphic encryption, sensitive data in plaintext is encrypted using an encryption algorithm, generating ciphertext that can only be read if decrypted.

In data masking, fake data replaces real data for users who should not have access to the real data, whether because of their role in the company or because they are attackers. Masking ensures sensitive data is obscured or otherwise de-identified.

Dynamic data masking can transform the data based on the user roles and privileges. It is used to secure real-time transactional systems and improve data privacy, compliance implementation, and maintenance.

With data masking, data is retained in its native form, and no decryption key is necessary. The resulting data set does not contain any references to the original information, making it useless for attackers.

Encryption scrambles data using nonreadable mathematical calculations and algorithms. An encryption system employs an encryption key generated by an algorithm. While it is possible to decrypt the data without possessing the key, significant computational resources and skills would be required if the encryption system is designed properly. An authorized recipient can easily decrypt the message with the key provided by the originator.

If the encryption key is lost or damaged, it may not be possible to recover the encrypted data from the computer. Therefore, enterprises need to set up rigorous key management processes, procedures, and technologies before implementing data encryption technologies.

Organizations should consider how key management practices can support the recovery of encrypted data if a key is lost or destroyed. Those planning on encrypting removable media need to consider how changing keys will impact access to encrypted storage on removable media, such as USB drives, and develop solutions, such as retaining the previous keys in case they are needed.

Encryption can be applied to endpoint drives, servers, email, databases, and files. The appropriate encryption depends upon the type of storage, the amount of data that needs to be protected, environments where the storage will be located, and the threats that need to be stopped.

Public key encryption is one use of public key cryptography, also known as asymmetric cryptography. Digital signature, in which a message is signed with the senders private key and can be verified by anyone who has access to the senders public key, is another well-known use of public key cryptography.

There are three primary types of encryption solutions: full disk encryption, volume/virtual disk encryption, and file/folder encryption. When selecting encryption types, enterprises should consider the range of solutions that meet their security requirements, not just the type that is most commonly used.

The top features that enterprises should consider when choosing an encryption system include centralized policy management, application and database transparency, low latency, key management interoperability, support for hardware-based cryptographic acceleration, support for compliance regulations, and monitoring capabilities.

There are many factors to consider when selecting storage encryption solutions, such as the platforms they support, the data they protect, and the threats they block. Some involve installing servers and software on the devices to be protected, while others can use existing servers, as well as software built into devices operating systems.

Unfortunately, encryption can result in loss of functionality or other issues, depending on how extensive the changes are to the infrastructure and devices. When evaluating solutions, enterprises should compare the loss of functionality with the gain in security capabilities and decide if the tradeoff is worth it. Solutions that require extensive changes to the infrastructure and end user devices should generally be used only when other options cannot meet the enterprises security needs.

An encryption protocol is a series of steps and message exchanges designed to achieve a specific security objective.

To ensure compatibility and functionality, enterprises should use standard-conforming encryption protocols such as Internet Protocol Security (IPSec), Secure Socket Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH), Secure/Multipurpose Internet Mail Extensions (S/MIME), and Kerberos. Each has advantages and disadvantages. Some overlap in functionality, but each tends to be used in different areas.

IPSec provides encryption at the IP packet level and requires low-level support from the operating system and a configured server. Since IPSec can be used as a tunnel to secure packets belonging to multiple users and hosts, it is useful for building virtual private networks and connecting remote machines. The next-generation Internet Protocol, IPv6, comes with IPSec built in, but IPSec also works with IPv4.

SSL and TLS work over the Transmission Control Protocol (TCP) and link up with other protocols using TCP, adding encryption, server authentication, and authentication of the client. TLS is an upgrade to SSL that strengthens security and improves flexibility. SSL and TLS are the primary method for securing Web transactions, such as the use of https instead of http in URLs. A widely used open-source implementation of SSL is OpenSSL.

S/MIME is a standard for public key encryption and signing MIME data. With S/MIME, administrators have an e-mail option that is more secure than the previously used Simple Mail Transfer Protocol (SMTP). S/MIME brings SMTP to the next level, allowing widespread e-mail connectivity without compromising security.

SSH is the primary method of securing remote terminals over the internet and for tunneling Windows sessions. SSH has been extended to support single sign-on and general secure tunneling for TCP streams, so it is often used for securing other data streams. The most popular implementation of SSH is the open-source OpenSSH. Typical uses of SSH allows the client to authenticate the server, and then the user enters a password to authenticate the user. The password is encrypted and sent to the other system for verification. To prevent man-in-the-middle attacks, in which communication between two users is monitored and modified by an unauthorized third party, SSH records keying information about servers with which it communicates.

Kerberos is a protocol for single sign-on and user authentication against a central authentication and key distribution server. Kerberos works by giving authenticated users tickets, granting them access to various services on the network. When clients then contact servers, the servers can verify the tickets. Kerberos is a primary method for securing and supporting authentication on a local area network. To use Kerberos, both the client and server have to include code since not everyone has a Kerberos setup, complicating the use of Kerberos in some programs.

Most of the major security firms provide data encryption software for the enterprise. Here is a sampling of available enterprise data encryption software, which includes full disk encryption (for more in-depth discussions of vendors who provide full disk encryption, see eSecurity Planets articles 7 Full Disk Encryption Solutions to Check out and Full Disk Encryption Buyers Guide):

Check Point Full Disk Encryption Software Blade provides automatic security for data on endpoint hard drives, including user data, operating system files, and temporary and erased files. Multifactor pre-boot authentication ensures user identity, while encryption prevents data loss from theft.

Dell Data Protection Encryption Enterprise enables IT to enforce encryption policies, whether the data resides on the system drive or external media. Designed for mixed vendor environments, it also will not interfere with existing IT processes for patch management and authentication.

HPE SecureData Enterprise uses both encryption and data masking to secure corporate data. HPE SecureData de-identifies data, rendering it useless to attackers, while maintaining usability and referential integrity for data processes, applications, and services. It uses Hyper Format-Preserving Encryption, a high-performance format-preserving encryption.

IBM Guardium Data Encryption provides encryption capabilities to help enterprises safeguard on-premises structured and unstructured data and comply with industry and regulatory requirements. This software performs encryption and decryption operations with minimal performance impact and requires no changes to databases, applications, or networks.

McAfee (Intel Security) Complete Data Protection provides its own encryption tools and supports Apple OS X and Microsoft Windows-native encryption, system encryption drives, removable media, file shares, and cloud data. It also integrates with McAfees other enterprise security tools, such as data loss prevention.

Microsoft BitLocker Drive Encryption provides encryption for Windows operating systems only and is intended to increase the security surrounding computer drives. Having BitLocker integrated with the operating system addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers.

Sophos SafeGuard Encryption is always on, allowing for secure collaboration. Synchronized encryption protects data by continuously validating the user, application, and security integrity of a device before allowing access to encrypted data.

Symantec Endpoint Encryption provides endpoint encryption and removable media encryption with centralized management, as well as email, file share, and command-line tools. It also integrates with the companys data loss prevention technology.

Trend Micro Endpoint Encryption provides full disk encryption, folder and file encryption, and removable media encryption. It can also manage Microsoft BitLocker and Apple FileVault.

WinMagic SecureDoc Enterprise Server (SES) offers enterprises control over their data security environment, ensuring security and transparency in regular workflow. With full disk encryption and PBConnex technology, SES enables customers to streamline their IT processes.

In addition to these data encryption software solutions, enterprises could benefit from employing other encryption tools. An eSecurity Planet slideshow advises IT pros to build a portfolio of encryption tools to leverage each ones strengths. And for the DIY crowd, VeraCrypt offers an open source encryption option.

eSecurity Planet offers six tips for stronger encryption:

do not use old encryption ciphers

use longer encryption keys

encrypt in layers

store encryption keys securely

ensure that encryption implementation is done properly

consider external factors, such as digital signature compromise.

Increasingly, enterprises are adopting cloud computing and deploying Internet of Things (IoT) devices to improve efficiencies and reduce costs. However, these technologies can pose additional risks to corporate data.

Encryption could help secure the data, but not many enterprises are opting for that solution. For example, only one-third of sensitive corporate data stored in cloud apps is encrypted, according to a survey of more than 3,400 IT and IT security pros by the Ponemon Institute and Gemalto.

At the same time, close to three-quarters of respondents believe that cloud-based apps and services are important to their companys operations, and an overwhelming 81 percent expect the cloud to become more important in the near future.

Data encryption can be more challenging in the cloud because data may be spread over different geographic locations, and data is not on storage devices dedicated solely to an individual enterprise. One option is to require the cloud service provider to offer data encryption as part of a service level agreement.

Also, enterprises are increasingly using IoT devices, but few of them have security built in. One option to improve security is to encrypt the data that is transferred by IoT devices, particularly those that connect wirelessly to the network.

In sum, data encryption can be used to secure data at rest and in motion in the traditional enterprise environment, as well as the emerging environments of cloud computing and IoT deployments.

See the original post here:
Encryption: Securing Sensitive Data in Changing Corporate ...

ConCourt rules against e.tv in digital encryption case – Eyewitness News

e.tv had challenged the government, saying an unencrypted system would hurt its ability to compete as encryption would allow government to offer better services to the public.

The Constitutional Court. Picture: Gia Nicolaides/EWN.

JOHANNESBURG The Constitutional Court has ruled that government did not behave unconstitutionally when it decided that it would implement a policy of unencrypted digital terrestrial television.

e.tv had challenged the decision, saying that an unencrypted system would hurt its ability to compete and that encryption would allow government to offer better services to the public.government to offer better services to the public.

The court ruled by five judges to four that government can continue to use an unencrypted system for digital terrestrial television and that e.tv's legal bid to stop the system must fail.

But judges have also criticised former communications minister Faith Muthambi for her conduct in refusing to name who she spoke to when she changed her mind from using an encrypted system to using an unencrypted system.

e.tv had said that using the unencrypted system would make it impossible for it to compete against other players over the longer term.

Writing for the majority, Chief Justice Mogoeng Mogoeng opened his ruling with the statement: Ours is a constitutional democracy - not a judiciocracy.

He then said this means that government - as the executive - must have the power to make policy, before saying that government did, in fact, conduct a proper process of consultation before deciding to use the unencrypted system.

But Mogoeng says this is not because of then Communications Minister Faith Muthambi, but because of the actions of the previous Minister Yunus Carrim.

He said that while Muthambi did not properly consult with e.tv when making her decision to use the unencrypted system, previous communications minister Carrim had fulfilled the legal obligations of the department when he had consulted with e.tv in a previous process.

Both Mogoeng's judgment and the dissenting judgement agreed that Muthambi was wrong to not explain who she spoke to when she changed her mind on this issue.

Mogoeng also castigated e.tv, saying it first argued strongly for an unencrypted system and then argued against it.

Mogoeng also said the effect of Muthambi's decision was to virtually maintain the status quo in terms of the relationships and obligations the various broadcasters have.

In their judgment, four other judges said they would have come to a different decision and that Muthambi had not explained why her conduct did not open the door to secret lobbying and influenced peddling.

(Edited by Zinhle Nkosi)

View original post here:
ConCourt rules against e.tv in digital encryption case - Eyewitness News