Backed by an award-winning research team, security technologies from Intel Security use a unique, predictive capability that is powered by McAfee Global Threat Intelligenceenabling home users and businesses to stay one step ahead of online threats.

Intel Security enables users to safely connect to the Internet, and securely surf and shop the web. With McAfee All Access, McAfee Total Protection, McAfee Internet Security, and McAfee AntiVirus Plus, consumers get complete antimalware and antispyware protection, along with an integrated firewall to ensure their computer systems remain virus-free. Additionally, McAfees virus removal service helps you easily clean viruses and spyware from your PCall from the comfort of your home. Try out McAfee software by downloading our free antivirus trials.

McAfee Mobile Security provides comprehensive mobile device protection with antivirus, anti-theft, and web and app protection for smartphones and Android tablets.

Intel Security solutions deliver the highest levels of threat visibility and antimalware protection, including comprehensive system and endpoint protection, network security, cloud security, database security, endpoint detection and response, and data protection. Our complete security solutions extend beyond virus software and antimalware protection to server security, SIEM, and intrusion prevention systems (IPS). Backed by McAfee Global Threat Intelligence, our solutions help companies enhance visibility into their security postures, allowing business to embrace virtualization, cloud services, and mobile devices, while protecting critical assets and sensitive data, and improving incident response.

Our industry-leading security offerings include:

Originally posted here:
Intel Security-McAfeeAntivirus, Encryption, Firewall ...

End-to-end encryption has just gone massively mainstream. In an update on March 31st, the Facebook-owned messaging platform WhatsApp quietly pushed an update adding end-to-end encryption enabled by default to its chat and call functionality. They announced the change publicly on Tuesday, allowing the app's over 1 billion monthly active users to message each other with the guarantee of strong encryptionwhether they're exchanging messages, sending files, participating in group chats, or calling each other directly. Let us be clear: this means that WhatsApp has in one fell swoop moved the user base of end-to-end encryption from those protecting trade secrets, enthused crypto-hobbyists, and whistleblowers to an actually significant portion of the world population. It is difficult to overstate the importance of this move for the security and privacy of ordinary users. As of this week, there are hundreds of millions of users communicating with each other using end-to-end encryption for the very first time.

Not only are the app's users protected by encryption, but it's strong encryption. In a technical white paper released on April 4, WhatsApp describes in detail the underlying cryptographic exchange that occurs when users message each other. It's based on The Signal Protocol (ne Axolotl) developed at Open Whisper Systems, and utilizes double ratcheting to provide forward secrecy even if session keys are compromised. This means that if an adversary is able to uncover the cryptographic keys being used by the app, this will not compromise communications made with contacts in the pastthese will still be protected. The Signal Protocol uses strong and well-vetted cryptographic building blocks (or 'primitives') to construct and transmit messages, including ECDH using Curve25519. In addition to the service's strong end-to-end offerings, all communications between the client app and the WhatsApp server are encrypted using Noise Pipes from the Noise Protocol Framework.

Those familiar with using Signal will find the encryption workflow on WhatsApp similar. Both apps aim for ease of use, hiding the underlying cryptographic functionality away from the end user and integrating it as seamlessly as possible into the normal, intuitive app user interface. There are a few differences, though. The main differences have to do with how authenticity is established.

Traditionally, end-to-end applications have relied on manually verifying fingerprints. If Alice wants to verify Bob's identity, Alice would have Bob read off (or display the QR code for) his 'fingerprint'the digest form of his public encryption key. If Alice has the same fingerprint for Bob, she can be assured that when she retrieved Bob's key from the Internet it wasn't tampered with or replaced by the key of someone else, perhaps someone with malicious intent. Bob would then have Alice read her key as well.

WhatsApp has made the interesting decision not to repeat this workflow in its app. Instead, it presents a distinct QR code per interaction that is shared so that both Alice and Bob will be scanning the same QR code on each other's devices. Presumably, their reasoning is that it is more intuitive for both parties to be verifying the same exact image (which actually just consists of both Alice and Bob's fingerprints concatenated together.) What's interesting about this decision is that it indicates some consideration was given to introducing the concept of key verification to millions of people. In contrast, Apple's iMessage platform, which gained notoriety last year for its own use of end-to-end encryption, does not allow users to verify each others keys at all. WhatsApp is showing the world that you don't need to sacrifice usability in order to provide meaningful features such as ways to verify contact authenticity.

In order to verify the identity of a contact, first you'll want to ensure that your contact is using the latest update of WhatsApp that actually supports the new security features. You can do this on Android by viewing the contact's details:

You'll see a green lock to indicate your communications are encrypted. Then, you can tap the lock to verify a security code as described above:

From this screen, you can have your contact scan your code, and you can scan your contact's code.

One of the settings the security-conscious should be sure to change is enabling security notifications. This ensures that if the encryption key for your contact changes, you will be notified of this change so that you'll know you have to verify security codes again. With Signal these notifications are always shown, but with WhatsApp they are optional and are switched off by default. To change this in Android, go into Settings Account Security, and slide 'Show security notifications' to the right:

We've updated our Secure Messaging Scorecard to give WhatsApp 6 out of 7 stars. Unfortunately, WhatsApp remains closed source, which means that an independent reviewer can not review the code and its security. For this reason, if you're using Signal to communicate with contacts already, keep it. It's better to use a fully free and open source product. But because of the wide adoption of WhatsApp, you may have contacts you would have never expected using end-to-end encryption already. For the sake of their and your privacy and security, install WhatsApp and use it when communicating with them. You'll be glad you did.

Follow this link:
WhatsApp Rolls Out End-To-End Encryption to its Over One ...

Encryption is a method of securing data by scrambling the bits of a computer's files so that they become illegible. The only method of reading the encrypted files is by decrypting them with a key; the key is unlocked with a password.

Available To

Students, Faculty, Staff, Affiliates

Whole disk encryption protects everything on a disk drive including the operating system. Even files you may not know about that keep exact copies of data that you've been working on, such as temporary files are encrypted.

Windows 7, 8 or 10 Mac OS X 10.9 or later

Note: ReadEncryption at MITto learn about the options and recommendations. If you are unsure whether you should be using whole disk encryption for compliance with data security regulations, contact IS&T.

Note: PGP is no longer being offered on the software grid. Support is being phased out and will discontinue at the end of 2016.

Contact the IS&T Service Desk for assistance with any of the above-listed options.

Read the original here:
Encryption | Information Systems & Technology

Slide: 1 / of 7 .

Caption: WhatsApp founders Jan Koum (L) and Brian Acton (R).Michael Friberg for WIRED

Slide: 2 / of 7 .

Caption: Moxie Marlinspike. Michael Friberg for WIRED

Slide: 3 / of 7 .

Caption: Brian Acton. Michael Friberg for WIRED

Slide: 4 / of 7 .

Caption: WIRED

Slide: 5 / of 7 .

Caption: Jan Koum. Michael Friberg for WIRED

Slide: 6 / of 7 .

Caption: Moxie Marlinspike. Michael Friberg for WIRED

Slide: 7 / of 7 .

Caption: WIRED

For most of the past six weeks, the biggest story out of Silicon Valley was Apples battle with the FBI over a federal order to unlock the iPhone of a mass shooter. The companys refusal touched off a searing debate over privacy and security in the digital age. But this morning, at a small office in Mountain View, California, three guys made the scope of that enormous debate look kinda small.

Mountain View is home to WhatsApp, an online messaging service now owned by tech giant Facebook, that has grown into one of the worlds most important applications. More than a billion people trade messages, make phone calls, send photos, and swap videos using the service. This means that only Facebook itself runs a larger self-contained communications network. And today, the enigmatic founders of WhatsApp, Brian Acton and Jan Koum, together with a high-minded coder and cryptographer who goes by the pseudonym Moxie Marlinspike, revealed that the company has added end-to-end encryption to every form of communication on its service.

This means that if any group of people uses the latest version of WhatsAppwhether that group spans two people or tenthe service will encrypt all messages, phone calls, photos, and videos moving among them. And thats true on any phone that runs the app, from iPhones to Android phones to Windows phones to old school Nokia flip phones. With end-to-end encryption in place, not even WhatsApps employees can read the data thats sent across its network. In other words, WhatsApp has no way of complying with a court order demanding access to the content of any message, phone call, photo, or video traveling through its service. Like Apple, WhatsApp is, in practice, stonewalling the federal government, but its doing so on a larger frontone that spans roughly a billion devices.

Building secure products actually makes for a safer world, (though) many people in law enforcement may not agree with that, says Acton, who was employee number forty-four at Internet giant Yahoo before co-founding WhatsApp in 2009 alongside Koum, one of his old Yahoo colleagues. With encryption, Acton explains, anyone can conduct business or talk to a doctor without worrying about eavesdroppers. With encryption, he says, you can even be a whistleblowerand not worry.

The FBI and the Justice Department declined to comment for this story. But many inside the government and out are sure to take issue with the companys move. In late 2014, WhatsApp encrypted a portion of its network. In the months since, its service has apparently been used to facilitate criminal acts, including the terrorist attacks on Paris last year. According to The New York Times, as recently as this month, the Justice Department was considering a court case against the company after a wiretap order (still under seal) ran into WhatsApps end-to-end encryption.

The government doesnt want to stop encryption, says Joseph DeMarco, a former federal prosecutor who specializes in cybercrime and has represented various law enforcement agencies backing the Justice Department and the FBI in their battle with Apple. But the question is: what do you do when a company creates an encryption system that makes it impossible for court-authorized search warrants to be executed? What is the reasonable level of assistance you should ask from that company?

WhatsApp declined to discuss any particular wiretap orders. But the prospect of a court case doesnt move Acton and Koum. Espousing an article of faith thats commonly held among Silicon Valley engineerssometimes devoutly, sometimes casuallythey believe that online privacy must be protected against surveillance of all kinds. Were somewhat lucky here in the United States, where we hope that the checks and balances hold out for many years to come and decades to come. But in a lot of countries you dont have these checks and balances, says Koum, dressed in his usual T-shirt and hoodie. Coming from Koum, this is not an academic point, as most of WhatsApps users are outside the US. The argument can be made: Maybe you want to trust the government, but you shouldnt because you dont know where things are going to go in the future.

Acton and Koum started adding encryption to WhatsApp back in 2013 and then redoubled their efforts in 2014 after they were contacted by Marlinspike. The dreadlocked coder runs an open source software project, Open Whisper Systems, that provides encryption for messaging services. In tech security and privacy circles, Marlinspike is a well-known idealist. But the stance he has taken alongside Acton and Koumnot to mention the other WhatsApp engineers who worked on the project and the braintrust at Facebook thats backing the effortis hardly extreme in the context of Silicon Valleys wider clash with governments and law enforcement over privacy. In Silicon Valley, strong encryption isnt really up for debate. Among techs most powerful leaders, its orthodoxy. And WhatsApp is encryptions latest champion. It sees itself as fighting the same fight as Apple and so many others.

WhatsApp, more than any company before it, has taken encryption to the masses. What makes this move even more striking is that the company did this with such a tiny group of people. The company employs only about 50 engineers. And it took a team of only 15 of them to bring encryption to the companys one billion usersa tiny, technologically empowered group of individuals engaging in a new form of asymmetrical resistance to authority, standing up not only to the US government, but all governments. Technology is an amplifier, Acton says. With the right stewards in place, with the right guidance, we can really effect positive change.

But of course, positive change is in the eye of the beholder. And these are technological stewards in the style of Silicon Valley: billionaires in cargo shorts and T-shirts who did something massive because they wanted to. And because they could.

Like so many tech startups, WhatsApps success seems a bit accidental. Acton and Koum originally conceived of their app as a way for people to broadcast their availability to friends, family, and colleagues: Could they talk or text at that very moment or not? But it soon morphed into a more general messaging app, a way to trade text messages via the Internet without using the SMS networks operated by cellular phone carriers like Verizon and AT&T. But the real genius of the app is that very early on, Acton and Koum targeted the international market.

In the startups first year, they offered the service in German, Spanish, French, and Italian, among other languages, and it rapidly took off overseas, where SMS text fees are much higher in than US. Today, the company offers the app in more than 50 languages, and it has grown into the primary social network in so many of the worlds countries, including Brazil, India, and large parts of Europe. In many places, local wireless carriers have signed deals with WhatsApp to offer the service directly to their customers, undermining their own texting services but driving more people to use the wider Internet through their wireless networksand thus driving more revenue.

By February of 2014, WhatsApp had reached about 450 million users, and Facebook shelled out $19 billion to acquire the startup, with its staff of only 50 people. Since then, with only a slight expansion of staff, WhatsApp has come to serve more than a billion people across the globe.

But the apps two founders, for all their success, have remained in the shadows. They almost never speak with the media. Koum, in particular, is largely uninterested in press or publicity or, for that matter, any human interaction he deems extraneous. Clearly, you cant believe everything you read in the press, he tells me, a reporter. Although the company runs one of the worlds largest online servicesand is owned by the worlds biggest social networkit continues to operate almost entirely on its own in an unmarked building in Mountain View thats fronted by unusually diligent security. And because the app is far more popular overseas than in the US, the typically fervent Silicon Valley tech press has largely left them alone. As a result, the American public hasnt quite grasped the enormous scope of the companys encryption project or the motivations behind it.

Koum and Acton share a long history in computer security. They first met at Yahoo while doing a security audit for the company. During this time, Koum was also part of a seminal security collective and think tank called w00w00 (pronounced whoo whoo), a tight online community that used the old IRC chat service to trade ideas related to virtually any aspect of the field. Koum grew up in the Ukraine under Soviet rule before immigrating to the US as a teenager, so he has some intimate familiarity with the challenges of maintaining privacy in the face of an intrusive government. But Koum says that the bigger force behind encrypting WhatsApp was Acton, a comparatively outgoing individual who grew up in Florida. Brian gets a lot of credit for wanting to do it earlier, Koum says of WhatsApp encryption.

Indeed, it was Acton who first launched an effort to add encryption to WhatsApp back in 2013. I dont really want to be in the business of observing conversations, he says, adding that people were constantly asking the company for full encryption. This is something our users wanted. Maybe not your average mom in middle America, but people on a worldwide basis. At the start, however, the effort was little more than a prototype driven by a single WhatsApp intern. The project didnt really take off until Moxie Marlinspike remembered a WhatsApp guyan engineer who worked on the version of WhatsApp for Windows phoneshe had met at his girlfriends family reunion.

Moxie Marlinspikes girlfriend comes from a family of Russian physicists, and in 2013, she held a family reunion at the apartment she shared with Marlinspike. The guest list included about 23 Russian physicists and one American guy who worked as an engineer at WhatsApp. (He had married into the family.) Marlinspike chatted briefly with the engineer at the reunion. Then, about a year later, Marlinspike decided it was time to add encryption to WhatsApp, one of the worlds largest messaging services. He sent the guy an email, asking for an introduction to the companys founders.

The debate over encryption has only grown more intense.

When I meet Marlinspike at WhatsApp headquarters, he is somewhat reticent to explain his motivations, which seems typical of the manat least in interviews with the press. Online, however, hes not shy about his views. In the past, he has written that encryption is important because it gives anyone the ability to break the law. But in Mountain View, he is more laconic. WhatsApp is the most popular messaging app in the world, says Marlinspike, who is not just a coder and cryptographer but a sailor and a shipwright. I wanted to get in touch.

Given the reclusive proclivities of WhatsApp, knowing someone who knows someone is particularly important when it comes to making connections there. After the engineer helped make an introduction, Acton met Marlinspike at the Dana Street Roasting Companya popular meeting place for Silicon Valley types. Then, a few weeks later, Marlinspike met with Koum. The two men, it turned out, had plenty in common. Marlinspike had come up in the same world of underground security gurus before joining Twitter in 2011and promptly leaving the company to form Open Whisper Systems. We talked about the IRC days, Koum says of their meeting. How things used to be.

The bond seemed to stick. Soon, Marlinspike was helping to build end-to-end encryption across all of WhatsApp, alongside Acton and Koum and a small team of WhatsApp engineers. Acton says that they got lucky in meeting Marlinspike and that they probably wouldnt have rolled out full encryption if they hadnt. Its part of an intriguing casualness to the way Acton and Koum discuss their seemingly earthshaking undertakingnot to mention the way Marlinspike stays largely silent. They met. They had the means. And they built it. It would take about two years.

The encrypting of WhatsApp was supposed to be finished by the middle of January 2016. Koum and company wanted to unveil a completely encrypted service at the DLD tech media conference in Munich, where he was set to give a proverbial fireside chat. Germany is a country that puts an unusually high value on privacy, both digital and otherwise, and Koum felt the time was ripe to make WhatsApps plans known to the world. Just recently, a Brazilian court had ordered a temporary shutdown of WhatsApp in the country after the company failed to turn over messages to the government that had been sent across a part of the service that was already encrypted. In Germany, Koum could make his counterpoint.

But by the middle of December, it was clear the project wouldnt be finished. The team was intent on encrypting everything on every kind of phone. The last piece was video, Koum says. You need to build for a situation where somebody on Android can send a video to an S40 user. Or somebody on a Blackberry can send to a Windows phone. So the company postponed the announcement. In Germany, Koum talked about WhatsApps new business model instead.

As Koum sees it, slipping a backdoor into an encrypted service would defeat the purpose.

In the meantime, the debate over encryption has only grown more intense. On February 16, Apple CEO Tim Cook released an open letter refusing the court order to unlock a phone that belonged to one of the two shooters who killed 14 people and seriously injured another 22 during a December attack in San Bernardino, California. That day, Acton turned to Koum and said: Tim Cook is my hero. About two weeks later in Brazil, authorities arrested a Facebook vice president because WhatsApp wouldnt turn over messages after a court order. Apparently, the authorities didnt realize that the Facebook employee had nothing to do with WhatsAppor that WhatsApp, thanks to end-to-end encryption, had no way of reading the messages. Two days later, WhatsApp joined Facebook and several other companies in filing an amicus brief in support of Apple in its fight against the FBI.

Clearly, WhatsApp has the support of its much larger parent company. Facebook declined to speak specifically for this story. But Koum, after the WhatsApp acquisition, became a member of the Facebook board. If they were not supportive of us, we wouldnt be here today, he says. But this also wasnt something Facebook imposed on WhatsApp. This is a decision WhatsApp made on its own, before it was acquired. By the time Facebook paid billions of dollars for the company, the transformation was already under way.

Many lawmakers have called for companies like WhatsApp to equip their encryption schemes with a backdoor available only to law enforcement. Theres even been talk of a law that requires these backdoors. But as Koum sees it, slipping a backdoor into an encrypted service would defeat the purpose: you might as well not encrypt it at all. A backdoor would just open the service to abuse by both government and hackers. Besides, if you did add a backdoor, or remove encryption from WhatsApp entirely, that wouldnt stop bad actors. Theyd just go elsewhere. In the age of open source software, encryption tools are freely available to everyone. The encryption genie is out of the bottle, Koum says.

Indeed, even some of those exploring legislation to require backdoors to encrypted digital services acknowledge that the issues in play arent that simple. If we require our companies to build in a door, do we need to let China through the door? Or do we have to build doors for them when these services are used in their countries? asks Adam Schiff, the ranking Democrat on the House Intelligence Committee. And what does that mean in terms of stifling dissent in authoritarian countries that may use it for non-law enforcement purposes?

When asked about reports that terrorists used WhatsApp to plan the attacks on Parisreports that politicians have used to back calls for a backdoorKoum doesnt budge. I think this is politicians, in some ways, using these terrible acts to advance their agendas, he says. If the White House thinks that Twitter can solve their ISIS problem, theyve got (a lot of problems).

Koum is right that encryption is widely available to anyone motivated to use it, but WhatsApp is pushing it much farther into the mainstream than anyone else. Apple, for instance, encrypts the data sitting on an iPhone, and it uses end-to-end encryption to hide the messages that travel over its own iMessage texting service. But iMessage is only available on iPhones. Over the years, Apple has sold about 800 million iPhones. But its hard to know how many are still in use, or how many people who have them are communicating via iMessage anyway. WhatsApp runs on just about every kind of phone. Plus, Apples techniques have some gaping holes. Most notably, many users back up their iMessages to Apples iCloud service, which negates the end-to-end encryption. WhatsApp, meanwhile, has a billion users on its service right now.

Pundits have also made much of the encryption offered by Telegram, a messaging service built by a Russian entrepreneur who travels the world in self-imposed exile. But Telegram doesnt turn on end-to-end encryption by default. And it doesnt do end-to-end encryption for group messaging. And it has only a fraction of the audience of WhatsApp.

In pushing back against end-to-end encryption, the US government argues that its merely trying to maintain the status quothat it has long had the power to issue a warrant for communications data. This is the same principle applied to a different set of facts, says DeMarco, the former federal prospector that has helped law enforcement agencies back the Justice Department against Apple. This is about what companies should do when the government had gone to court and gotten a court order, either a search warrant or a wiretap or a data tap.

When I float this argument to Koum and Acton, they defer to Marlinspikeat first. Though the cryptographer is somewhat reticent to speak, when he does, he speaks with an idealists conviction. In some ways, you can think of end-to-end encryption as honoring what the past looked like, he says. Now, more and more of our communication is done over communication networks rather than face-to-face or other traditionally private means of communicating. Even written correspondence wasnt subject to mass surveillance the way that electronic communication is today.

Dressed in his standard uniform of T-shirt and cargo shorts, Acton agrees. The phone is one hundred, one hundred and ten years old, he says. There was a middle period where the government had a broad ability to surveil, but if you look at human history in total, people evolved and civilizations evolved with private conversations and private speech. If anything, were bringing that back to individuals.

Acton and Koum and Marlinspike believe all this no matter what the government might do or say. Theyre just doing what they want to do, and theyre doing it because they can. Though The New York Times indicates that WhatsApp has received a wiretap order over encrypted data, Acton and Koum say they have had no real interaction with the government. But they probably will soon enough. Acton and Koum have almost complete control of one of the largest communication networks on Earth. Theyve met Moxie Marlinspike. The three of them share Silicon Valleys standard belief in online privacy. And now the government has to contend with something much bigger than a locked iPhone: secrecy for a billion people.

Update: This story has been updated to clarify that Telegram does not do end-to-end encryption by default. It does use other encryption by default, but this does not provide the same level of security as end-to-end.

See original here:
Forget Apple vs. the FBI: WhatsApp Just Switched on ...

Slide: 1 / of 1 .

Caption: Getty Images

Its not surprising that in the wake of the Paris terrorist attacks last Friday, US government officials would renew their assault on encryption and revive their efforts to force companies to install backdoors in secure products and encryption software.

Just last month, the government seemed to concede that forced decryption wasnt the way to go for now, primarily because the public wasnt convinced yet that encryption is a problem. But US officials had also noted that something could happen to suddenly sway the public in their favor.

Robert S. Litt, general counsel in the Office of the Director of National Intelligence, predicted as much in an email sent to colleagues three months ago. In that missive obtained by the Washington Post, Litt argued that although the legislative environment [for passing a law that forces decryption and backdoors] is very hostile today, it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.

With more than 120 people killed in Paris, government officials are already touting the City of Light as the case against encryption.

In the story about that email, another US official explained to the Post that the government had not yet succeeded in persuading the public that encryption is a problem because [w]e do not have the perfect example where you have the dead child or a terrorist act to point to, and thats what people seem to claim you have to have.

With more than 120 people killed last week in Paris and dozens more seriously wounded, government officials are already touting the City of Light as that case. Former CIA deputy director Michael Morell said as much on CBS This Morning, suggesting that recalcitrant US companies and NSA whistleblower Edward Snowden are to blame for the attacks.

We dont know yet, but I think what were going to learn is that [the attackers] used these encrypted apps, right?, he said on the show Monday morning. Commercial encryption, which is very difficult, if not impossible, for governments to break. The producers of this encryption do not produce the key, right, for either them to open this stuff up or for them to give to governments to open this stuff up. This is the result of Edward Snowden and the public debate. I now think were going to have another public debate about encryption, and whether government should have the keys, and I think the result may be different this time as a result of whats happened in Paris.

CIA Director John Brennan said something similar at a security forum this morning (.pdf).

There are a lot of technological capabilities that are available right now that make it exceptionally difficult, both technically as well as legally, for intelligence and security services to have the insight they need to uncover it, he said. And I do think this is a time for particularly Europe, as well as here in the United States, for us to take a look and see whether or not there have been some inadvertent or intentional gaps that have been created in the ability of intelligence and security services to protect the people that they are asked to serve. And I do hope that this is going to be a wake-up call.

'Intel agencies are drowning in data... It's not about having enough data; it's a matter of not knowing what to do with the data they already have.' EFF Attorney Nate Cardozo

No solid information has come out publicly yet about what communication methods the attackers used to plot their assault, let alone whether they used encryption.

On Sunday, the New York Times published a story stating that the Paris attackers are believed to have communicated [with ISIS] using encryption technology. The papers sources were unnamed European officials briefed on the investigation. It was not clear, the paper noted, whether the encryption was part of widely used communications tools, like WhatsApp, which the authorities have a hard time monitoring, or something more elaborate.

Twitter users harshly criticized the Times story, and it has since disappeared from the site (though it is archived) and the URL now points to a different story, with no mention of encryption.

A Yahoo news story on Saturday added to the theme, declaring that the Paris attacks show that US surveillance of ISIS is going dark. Over the past year, current and former intelligence officials tell Yahoo News, IS terror suspects have moved to increasingly sophisticated methods of encrypted communications, using new software such as Tor, that intelligence agencies are having difficulty penetratinga switch that some officials say was accelerated by the disclosures of former NSA contractor Edward Snowden.

Numerous other news stories have suggested that attackers like the ones who struck Paris may be using a video game network. According to the Daily Mail and others, authorities in Belgium, where some of the attackers were based, have found evidence that jihadis there have been using the PlayStation 4 network to recruit and plan attacks. A source told the paper that they are using it because Playstation 4 is even more difficult to monitor than WhatsApp. The sources didnt indicate if they were speaking specifically about the Paris attackers or about other jihadis in that country. But the fallacy of these statements has already been pointed out in other stories, which note that communication passing through the PlayStation network is not encrypted end-to-end, and Sony can certainly monitor communications passing through its network, making it even less secure than WhatsApp.

US law enforcement and intelligence agencies have been warning for years that their inability to decrypt communication passing between phones and computerseven when they have a warrant or other legal authority to access the communicationhas left them in the dark about what terrorists are planning.

But there are several holes in the argument that forcing backdoors on companies will make us all more secure. While doing this would no doubt make things easier for the intelligence and law enforcement communities, it would come at a grave societal costand a different security costand still fail to solve some of the problems intelligence agencies say they have with surveillance.

1. Backdoors Wont Combat Home-Brewed Encryption. Forcing US companies and makers of encryption software to install backdoors and hand over encryption keys to the government would not solve the problem of terrorist suspects using products that are made in countries not controlled by US laws.

Theres no way of preventing a terrorist from installing a Russian [encryption] app or a Brasilian app, notes Nate Cardozo, staff attorney for the Electronic Frontier Foundation. The US or UK government could mandate [backdoors], but Open Whisper Systems is not going to put in a backdoor in their product period and neither is PGP. So as soon as a terrorist is sophisticated enough to know how to install that, any backdoor is going to be defeated.

Such backdoors also will be useless if terrorist suspects create their own encryption apps. According to the security firm Recorded Future, after the Snowden leaks, its analysts observed an increased pace of innovation, specifically new competing jihadist platforms and three major new encryption tools from three different organizationsGIMF, Al-Fajr Technical Committee, and ISIS. Encryption backdoors and keys also dont help when terrorists stop using digital communications entirely. A 2011 AP story indicated that al-Qaida had long ago ditched cell phones and internet-connected computers in favor of walkie talkies and couriers.

News reports about the Paris attacks have indicated that some of the perpetrators lived in the same town in Belgiumwhich would have made it very easy to coordinate their attack in person, without the need for digital communication.

2. Other Ways to Get Information. The arguments for backdoors and forced decryption often fail to note the many other methods law enforcement and intelligence agencies can use to get the information they need. To bypass and undermine encryption, intelligence agencies can hack the computers and mobile phones of known targets to either obtain their private encryption keys or obtain email and text communications before theyre encrypted and after theyre decrypted on the targets computer.

In the case of seized devices that are locked with a password or encryption key, these devices have a number of security holes that give authorities different options for gaining access, as WIRED previously reported. A story this week pointed to vulnerabilities in BitLocker that would make it fairly easy to bypass the Windows encryption tool. And the leaks of Edward Snowden show that the NSA and British intelligence agencies have a constantly evolving set of tools and methods for obtaining information from hard-to-reach systems.

Were still living in an absolute Golden Age of surveillance, says Cardozo. And there is always a way of getting the data that is needed for intelligence purposes.

3. Encryption Doesnt Obscure Metadata. Encryption doesnt prevent surveillance agencies from intercepting metadata and knowing who is communicating with whom. Metadata can reveal phone numbers and IP addresses that are communicating with one another, the date and time of communication and even in some cases the location of the people communicating. Such data can be scooped up in mass quantities through signals intelligence or by tapping undersea cables. Metadata can be extremely powerful in establishing connections, identities and locating people.

[CIA] Director Brennan gleefully told us earlier this year that they kill people based on metadata, Cardozo says. Metadata is enough for them to target drone strikes. And thats pretty much the most serious thing we could possibly do with surveillance.

Some metadata is encryptedfor example, the IP addresses of people who use Tor. But recent stories have shown that this protection is not foolproof. Authorities have exploited vulnerabilities in Tor to identify and locate suspects.

Tor can make the where a little more difficult, but doesnt make it impossible [to locate someone], Cardozo says. And Tor is a lot harder [for suspects]to use than your average encrypted messaging tool.

4. Backdoors Make Everyone Vulnerable. As security experts have long pointed out, backdoors and encryption keys held by a service provider or law enforcement agencies dont just make terrorists and criminals open to surveillance from Western authorities with authorizationthey make everyone vulnerable to the same type of surveillance from unauthorized entities, such as everyday hackers and spy agencies from Russia, China, and other countries. This means federal lawmakers on Capitol Hill and other government workers who use commercial encryption would be vulnerable as well.

The National Security Council, in a draft paper about encryption backdoors obtained by the Post earlier this year, noted the societal tradeoffs in forcing companies to install backdoors in their products. Overall, the benefits to privacy, civil liberties and cybersecurity gained from encryption outweigh the broader risks that would have been created by weakening encryption, the paper stated.

If all of these arent reason enough to question the attacks on encryption, there is another reason. Over and over again, analysis of terrorist attacks after the fact has shown that the problem in tracking the perpetrators in advance was usually not that authorities didnt have the technical means to identify suspects and monitor their communications. Often the problem was that they had failed to focus on the right individuals or share information in a timely manner with the proper intelligence partners. Turkish authorities have already revealed that they had contacted French authorities twice to warn them about one of the attackers, but that French authorities never got back to them until after the massacre in Paris on Friday.

Officials in France indicated that they had thwarted at least six other attack plots in recent months, but that the sheer number of suspects makes it difficult to track everyone. French intelligence maintains a database of suspected individuals that currently has more than 11,000 names on it, but tracking individuals and analyzing data in a timely manner to uncover who poses the greatest threat is more than the security services can manage, experts there have said. Its a familiar refrain that seems to come up after every terrorist attack.

If Snowden has taught us anything, its that the intel agencies are drowning in data, Cardozo says. They have this collect it all mentality and that has led to a ridiculous amount of data in their possession. Its not about having enough data; its a matter of not knowing what to do with the data they already have. Thats been true since before 9/11, and its even more true now.

Read this article:
After Paris Attacks, Heres What the CIA Director Gets ...

Encryption is a method of hiding data so that it cannot be read by anyone who does not know the key. The key is used to lock and unlock data. To encrypt a data one would perform some mathematical functions on the data and the result of these functions would produce some output that makes the data look like garbage to anyone who doesn't know how to reverse the operations. Encryption can be used to encrypt files that the owner feels are too sensitive for anyone else to read. And now, with the rise of the Internet, encryption is used to encrypt data, like a credit card number, and then send it across the net. This way no one can read intercept and read the data while it is traveling through the web. The recipient of the data does have to know how to decrypt the information or else the data will look like garbage to the recipient too.

There are two categories of encryption, private key and public key. The major difference is who knows the key. Encryption is an entirely mathematical process applied to the world of computers. The only thing an encryption program will do is take in data, perform some predefined mathematical operations on the data, and then output the result. Decryption is the process of taking the encrypted data, that now looks like garbage, and reverse the mathematical functions so that the result is the same data that originally existed before the encryption process. The "key" is the set of mathematical operations and values that are used to encrypt and decrypt the data. Encryption and decryption algorithms describe the mathematical operations while key describes the exact process which includes the algorithms and any other random initial values that are used in the algorithms. Lets first look at private key encryption and how it works.

PRIVATE KEY ENCRYPTION

What private key means is that the same method is used to encrypt and decrypt. If someone knows what method was used to encrypt the message then that person can decrypt the message. Thus, the key must be kept private. Only the person sending the data and the person receiving the data should know the key. Private key cryptography, also known as symmetric cryptography since the encryption and decryption processes are just opposites, is an encryption method where the encryption algorithm is known before hand by the sender and the recipient. Accordingly, the two users must communicate beforehand and agree on the algorithm and the key so that the recipient can decode the message. A very simple example of private key cryptology is to take the text that is to be sent across the Internet and use the next letter in the alphabet in place of the original letter. Then send the scrambled text across the Internet. The person receiving the text would have to know how the message he receives is scrambled so that he can unscramble it. Thus, the "key" being used in this example is, 'use the next letter in the alphabet.'

With this key the text, "hi rob" would become, "ij spc". Since the recipient of the message knows the key, that person will take the message he received and take the previous letter in the alphabet. The person would receive the message, "ij spc," and using the previous letter that person would recover, "hi rob." This example is much simpler than the private key encryption algorithms used today, but it illustrates the fact that in private key encryption the encryption and decryption processes are just the reverse of each other

Private key encryption has the benefits of being very fast in that the computer programs that will perform the encryption and decryption will finish executing in a very short amount of time. The more complex the key the longer the process takes. However, even the most complex private keys algorithms can encrypt and decrypt data faster than that of public key cryptology. A disadvantage to private key cryptography is that the key must be communicated before hand. You would have to tell me exactly how you were going to encrypt the messages that you will send to me so that I could recover the original message later.. You could not encrypt this information as I wouldn't know the key yet. In a large organization or over the Internet it is easy for these keys to become compromised because they have communicated, without using encryption, before the actual encryption takes place.

PUBLIC KEY ENCRYPTION

Public key cryptography (asymmetric) was created to eliminate the shortcomings of private key cryptography. The biggest advantage of public key cryptography is that no prior communication needs to take place between the recipient and the sender.

Public key cryptography works like this, everyone has two keys, a public key, which the entire world has access to, and a private key, which only the owner knows. Note that the private key referred to here is completely different than the private key used in private key cryptography. For lack of a better name the secret key in public key cryptography is called a private key. These two "keys" are much different form the "keys" used in private key cryptography. In fact both keys used in public key cryptography are just very large integers, on the order of 300 digits long. With public key cryptography there is only one algorithm that is in use, that algorithm is know as the RSA algorithm. The RSA algorithm is the only algorithm that will be used to encrypt and decrypt data.

The algorithm works by taking in some data, and then using one of the keys which is a large number, and using the key to perform modulo and exponential functions on the data. The result is a message so scrambled that no amount of statistical analysis could break the code. The beauty of RSA is that a message encrypted with a public key can be decrypted with the corresponding private key and a message encrypted with a private key can be decrypted with the corresponding public key. For this reason RSA is know as asymmetric cryptography, different algorithms are used to decrypt and encrypt data. The algorithm is actually just a very complex mathematical identity. Thus, person X can encrypt a message with person Ys public key and only person Y can decrypt the message using his private key, this is the process used to encrypt e-mail. More importantly, if I had a public and private key, and only I know my public key, I could encrypt a message using my private key and everyone could decrypt the message using my public key. If my public key successfully decrypts the message you can be sure that I sent it because the message could have only been created with my private key. The reason it could have only been created with my private key is that my public key was used to decrypt the message. By decrypting the message with my public key you know only my private key created it. This works as long as only I have access to my private key. The process described here is known as a digital signature because by creating a message that only I could have created I am effectively signing the message.

Like private key cryptography the encryption and decryption process must reverse each others actions, but the difference lies in that there are two different numbers and two different algorithms used. One number is the public key and the other number is the private key. These numbers are used in the two different algorithms one to encrypt a message and one to decrypt a message. The important aspect of RSA and public key cryptography is that no prior communication has to take place before a message is sent. If you receive a message encrypted with RSA and your public key you have all the information you need to decrypt the message. RSA does have some disadvantages however, since the numbers used are so large the amount of time it takes to encrypt or decrypt is a lot longer than private key cryptography.

What you should understand now is that there are two methods of encryption, private key and public key, each with its own advantages and disadvantages. You should also understand the concept of a digital signature as this will be used later to prove identity.

To go back to main page click here or to proceed to the page describing digital certificates, click here

Read the original here:
Encryption - UCSD Mathematics

This tool is simple to use: enter a public PGP key and the message you wish to encrypt, and click on the Encrypt Message button. If you do not have a public PGP key, simply use our PGP Key Generator to generate your own public/private key pair. You are also welcome to use the iGolder public PGP key to contact us or just to test our PGP- encryption tool.

iGolder respects your privacy and does not log nor monitors any activity (encryption) done on this web page.

PGP Public Key (paste the public key of the recipient you are about to send a message)

Message to Encrypt (enter the message text you wish encrypt)

Encrypted Message

Copy & paste this encrypted message and sent it by email to owner of the public PGP key you encrypted the message. Your friend is welcome to use the PGP Decrypt Tool to decrypt the message you sent him.

Here is the original post:
PGP Encryption Tool - iGolder

Action Summary

Financial institutions should employ encryption to mitigate the risk of disclosure or alteration of sensitive information in storage and transit.Encryption implementations should include

Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information. It can be used throughout a technological environment, including the operating systems, middleware, applications, file systems, and communications protocols.

Encryption can be used as a preventive control, a detective control, or both. As a prevention control, encryption acts to protect data from disclosure to unauthorized parties. As a detective control, encryption is used to allow discovery of unauthorized changes to data and to assign responsibility for data among authorized parties. When prevention and detection are joined, encryption is a key control in ensuring confidentiality, data integrity, and accountability.

Properly used, encryption can strengthen the security of an institution's systems. Encryption also has the potential, however, to weaken other security aspects. For instance, encrypted data drastically lessens the effectiveness of any security mechanism that relies on inspections of the data, such as anti-virus scanning and intrusion detection systems. When encrypted communications are used, networks may have to be reconfigured to allow for adequate detection of malicious code and system intrusions.

Although necessary, encryption carries the risk of making data unavailable should anything go wrong with data handling, key management, or the actual encryption. For example, a loss of encryption keys or other failures in the encryption process can deny the institution access to the encrypted data. The products used and administrative controls should contain robust and effective controls to ensure reliability.

Financial institutions should employ an encryption strength sufficient to protect information from disclosure until such time as the information's disclosure poses no material threat. For instance, authenticators should be encrypted at a strength sufficient to allow the institution time to detect and react to an authenticator theft before the attacker can decrypt the stolen authenticators.

Decisions regarding what data to encrypt and at what points to encrypt the data are typically based on the risk of disclosure and the costs and risks of encryption. The costs include potentially significant overhead costs on hosts and networks. Generally speaking, authenticators are encrypted whether on public networks or on the financial institution's network. Sensitive information is also encrypted when passing over a public network and also may be encrypted within the institution.

Encryption cannot guarantee data security. Even if encryption is properly implemented, for example, a security breach at one of the endpoints of the communication can be used to steal the data or allow an intruder to masquerade as a legitimate system user.

More:
FFIEC IT Examination Handbook InfoBase - Encryption

Why use Encryption software?

The data you store on your personal computer could be an open source of knowledge about your identity. If skillfully processed and analyzed, your files can tell a whole lot more about you than you might have ever thought: financial and banking information, your contacts, SSN, social circle, habits the almost intimate things that people normally do not disclose to strangers. Now, imagine someone breaking into your PC be it a hack or physical burglary and getting hold of it all. You wouldnt be flattered, would you?

As far as privacy and personal information confidentiality are concerned, encryption software can become your solution to safeguard these data from unwanted disclosure, even if your machine gets compromised or you happen to lose it due to unpredictable circumstances. As the concept prompts, the software employs cutting-edge techniques to encode your files so that nobody else can retrieve anything out of them in readable format. With encryption softwares features on your side, you are the only one who knows the secret key for undoing the lock and getting the information back to its original state.

Encryption software is particularly helpful to those dealing with large bulks of high-value sensitive information whose loss may lead to serious consequences for their well-being or reputation.

Read the original here:
Encryption | Privacy PC

Turn your sensitive information into unintelligible data with east-tec InvisibleSecrets and east-tec SafeBit so that unauthorized parties cant exploit it.

In its original form encryption was first used by the ancient Egyptians, Mayans, then the Greeks and Romans in wartime and politics. They used it as a security practice to encode messages that can deceive the enemy. In its modern day application it is basically the method of turning plaintext information into unintelligible format (cipher), using different algorithms. This way, even if unauthorized parties manage to access the encrypted data, all they find is nothing but streams of unintelligent, alphanumerical characters.

Encryption has widely been used to protect data in numerous areas, such as e-commerce, online banking, cloud storage, online communication and so forth.

A simple example of a cipher can be, for instance, the replacing of the letters in a message with the ones one forward in the alphabet. So if your original message read Meet you at the cafe tonight the encrypted message reads as follows: Nffu zpv bu uif dbgf upojhiu

The encryption algorithm is the chain of calculations that determine what ways the input plain text will be transformed into the output ciphertext. In the simple example above there was only one calculation carried out, which moved each letter of the message one forward in the alphabet. Of course, advanced encryption software programs can generate extremely complicated algorithms to achieve complex ciphers. Encryption algorithms fall into two basic categories: symmetric, or asymmetric key algorithms. You can find their description further below.

To control the algorithm and the process of encryption/decryption, a key (password) is used. It is basically either a random binary key or a passphrase. It determines the exact pattern the algorithm uses to turn plaintext into ciphertext. To guarantee the secrecy of the key plays crucial role in protecting the privacy of the message because the key may initiate the process of encryption, decryption, or both. If a hacker manages to obtain the key, just by itself, even the most complex algorithm will fail to prevent the encrypted data from being decrypted, because algorithms are publicly known. So if the password is cracked by a hacker, he can use it to decrypt the encrypted confidential data with it. In order to reduce chances of the key getting hacked, it is highly recommended to create one which is a combination of letters, numbers and special characters, so is to frequently change the key. The key also has to have a particular size so that it can be considered safe. Using a virtual keyboard when entering the password is a must to protect it against keylogger malware that might be present on the PC. There are two fundamental ways of secure communication based on encryption algorithms and the significance of the key in both are explained right below.

Algorithms in this category use the same key for encrypting plaintext and decrypting ciphertext. The preparation for symmetric key based communication is as follows: The sender and the receiver need to securely exchange a secret key (password) prior to sending messages (for instance, in a private meeting, or via a phone call), and agree that the same key will be used for protecting all messages between them afterwards. Using symmetric key algorithms makes it easy for both parties to maintain secure communication once the secret key got exchanged in the beginning, because, unlike in the case of asymmetric algorithms, parties do not need to verify each time a communication is about to take place that it was indeed them who sent a message using a particular key. Symmetric key algorithms are also faster, consume less computer resources that asymmetric ones do and can handle large amount of data thats why they are used for general encryption. One of the disadvantages of this method is that if unauthorized parties manage to obtain the key from either the sender or the receiver, either during the time when it is being exchanged, or afterwards, they can easily decrypt any message sent between the original parties. Another noteworthy downside is the difficulty of maintaining and managing separate keys for each partner one communicates with. Our encryption suite, east-tec InvisibleSecrets, offers solutions for both problems. Its Secure Password Transfer feature guarantees protected password exchange between two computers and its Password Manager makes it easy to handle multiple passwords safely.

As opposed to symmetric key algorithms, asymmetric key algorithms use a key-pair (two randomly generated numeric strings) to control the encryption of plaintext and the decryption of ciphertext. The key used for encryption is a public-key, that is, the sender can encrypt a message with a key that was not secretly shared with the receiver in advance, but is available in specific directories for anyone to use. The other key of the pair, the private or secret key, is generated by complex mathematical processes and is linked to its public key pair. In other words, if a message, or file was encrypted with a public key, only its private key pair can decrypt it.

One of the inherent advantages of using asymmetric key algorithms for secure communication is that the sender and receiver do not need to exchange a secret key prior to sending secret messages, this way greatly decreasing the risk of the key getting hacked. This type of communication also allows the use of digital signatures which makes it easy to detect if a message got accessed in transit by unauthorized parties, because a digitally signed message can only be modified if the signature was first invalidated. Downside issues include the necessity of public key authentication each time a message is to be sent; then there is the scenario of private-key loss, when decryption of the encrypted message becomes impossible. Asymmetric algorithms are much slower and resource consuming than symmetric ones so they aren`t well suited for general communication purposes that involve computing large amounts of data. However, they offer a great way to protect small amount of data, such as the key (password) which needs to be securely exchanged. Most encryption software programs employ both symmetric and asymmetric algorithms where symmetric ones handle the bulk of the message and asymmetric ones protect the key.

The fast progress computing saw in the last two decades made it necessary for governments to set improved encryption standards that are able to provide secure protection against advanced hacking techniques. The present day top-security standard, set by the U.S. National Institute of Standards And Technology, is the Advanced Encryption Standard (AES) based on the Rijndael algorithm. Both east-tec InvisibleSecrets and east-tec SafeBit employ that method among others. More info on different algorithms further below.

The well-known and most used algorithms we are going to list below (which are also supported by our software products) fall into the category of block cipher algorithms. Block ciphers got a revealing name that describes how they work. They break the input text into blocks and process it block by block. Each block has a fixed size of bits, for instance 128. The full length of the input text gets split into the exact same sized blocks during the process of encryption and decryption.

Security of symmetric key block cipher algorithms depends on the key length. The length is measured in bits and the size defined as secure in AES is 128, but 192 and 256 bits are also used for extra security. If the key is shorter than that, chances are that it can be hacked by brute force and used to decrypt the encrypted confidential data.

east-tec InvisibleSecrets can be used for several encryption scenarios such as: file/folder encryption, password encryption, application encryption, and email encryption. In addition to these features, the software also lets you hide the very existence of any file. This method is called steganography, which is the process of disguising a file by making it look like something else than it really is. You can, for instance, hide a text file into an image file. Read more about this concept here.

east-tec SafeBit was designed to cover for volume encryption needs. It lets you encrypt entire disks by creating virtual drives (safes) where all your data is kept encrypted at all times. The software employs on-the-fly encryption so there is no need to encrypt/decrypt data each time you mount/dismount the safe. For extra safe data handling you can upload your encrypted safe into your cloud storage space, or copy it onto external hard drives. east-tec SafeBit has further security features that include: turn your USB & Flash Cards into safe keys, and key logger protection. The software also provides an extra layer of protection over your antivirus by storing your confidential data in a closed, encrypted safe.

Read more here:
What does "encryption" mean? - East-Tec