Category Archives: Encryption

Protect your personal messages with CTI Text Encryption

Posted on by

CTI Text Encryption is a lightweight, portable text encryption tool. Its ideal for sending sensitive information via insecure channels (email, online chat, web forums), perhaps from someone elses computer, although you can also use it to save confidential data in files or elsewhere.

The open source program is a tiny download (827KB), a single executable with nothing else attached. Copy the file to a USB stick and its ready to use almost anywhere.

CTI Text Encryptions interface appears a little confusing initially, as it has almost no text labels or prompts. Fortunately its buttons do have tooltips, so hovering the mouse over each one reveals some helpful clues.

The process starts by entering the encryption passwords youd like to use. CTI Text Encryption supports up to four, which means you dont necessarily have to remember garbage like "lF@,%*jwX" to maintain your security. Entering something like the names of three or four childhood pets will be far easier for you to remember, but almost as difficult for anyone else to guess.

After this, CTI Text Encryption works more or less as youd expect. You type or paste text into the source box and click "Encrypt". The program uses SHA512 to hash the passwords, 256-bit AES (Rijndael) to process the text, and displays the results in the "Encrypted" box. ("Hello world" became "ZNz02G1/x+susprkZONobg==", for example.)

One click then copies the encrypted text to the clipboard, where you can paste it into an email, a forum message, wherever you like. A friend who also has a copy of CTI Text Encryption -- and knows your passwords -- should be able to read what youve said, while everyone else will be locked out.

What you dont get is any option to load, encrypt/ decrypt or save text files directly. You can work around this by, say, opening a text file in Notepad, copying and pasting this into CTI Text Encryption, but thats not as convenient.

There is also one slightly bizarre extra, in the ability to set a font. This is preserved within the message, so whoever is decrypting it will not only see your words, but also their chosen font. Its difficult to see why you would care about this -- and presumably it could introduce problems, if the recipient doesnt have the same font -- but the feature is here if you need it.

CTI Text Encryptionhas a few small issues, then, but in general works very well: its simple, straightforward, and provides an easy way to encrypt small text messages from almost any PC.

View original post here:
Protect your personal messages with CTI Text Encryption

Congress divorces NIST and NSA

Posted on by

Survival guide for data in the wild

The US Congress has passed a bill that removes the NSA's direct input into encryption standards.

According to a report at ProPublica, an amendment to the National Institute of Standards and Technology act removes the requirement that NIST consult with the NSA in setting new encryption standards.

Following the Snowden revelations, NIST had denied that it deliberately weakened encryption standards at the behest of the NSA.

However, that didn't put to rest suspicions that weaknesses such as existed in Dual_EC_DRBG were deliberate NSA contrivances, with RSA singled out for criticism over the random number generator.

Earlier this year, NIST formalised its advice that nobody should be using Dual_EC_DRBG.

Concern over the NSA's involvement also led to an unsuccessful campaign to exclude the agency from IETF crypto research, and a successful one to block RSA key swaps from the TLS standards.

According to Slate, Congress has now passed the amendment that was recommended by the House Science and Technology Committee (Slate also complains that the rest of the bill is mostly toothless).

As Bruce Schneir pointed out last week, users' one source of post-Snowden optimism is that vast dollars haven't yet delivered a special sauce that lets the NSA or its five-eyes partners crack well-implemented encryption.

Hence their continuing reliance either on social engineering, or on various forms of keylogging, to get user data.

Continue reading here:
Congress divorces NIST and NSA

Citrix Sharefile to offer meta-data encryption

Posted on by

Margi Murphy | May 26, 2014

Citrix Sharefile will offer metadata encryption to minimise the risk of data leaks in the enterprise.

Citrix Sharefile will offer metadata encryption to minimise the risk of data leaks in the enterprise.

Against the backdrop of the battle of the consumer file sharing systems offering cheap solutions for enterprise, Citrix Sharefile has had to develop a clear roadmap that offers CIOs piece of mind while keeping up with the upgrades and usability employees demand.

Citrix's mobile app, which allows employees to use word documents and sign PDFs while out of the office, entered the Google play store yesterday. It is the result of Citrix's acquisition of Bite Squared last year, and an iPad app will follow. The vendor is now turning its attention to its meta-data encryption service as part of the StorageZone product, which will be deployed in the next few months.

Jess Lipson, founder of ShareFile and Citrix's VP & GM of Data Sharing told ComputerworldUK: "We are going to have a small component that enterprises can install on-premise. It's basically a proxy, all the calls that come from your mobile apps and other maps will flow through that and it will encrypt that data on its way to the Citrix data centre. Citrix is able to run the user interface part of the application in the cloud so are able to do the rapid releases that end users are expecting but we won't have access to that data that's encrypted in our cloud."

Lipson said that some customers have already signed up for the beta rollout in the next few months. He added: "If they are concerned about metadata encryption they aren't going to want me to say who."

Changing markets

Citrix Systems acquired ShareFile in 2011 in an effort to break into the cloud-based data sharing market, but it is still innovating to ensure they have the edge on competition.

Lipson admitted that Citrix's small business space was threatened by consumer clouds like Dropbox, Google Drive and One Drive, and it is turning its attention to specialising in some of the industry verticals.

Original post:
Citrix Sharefile to offer meta-data encryption

What Are the Different Types of Encryption Methods?

Posted on by

There are three basic encryption methods: hashing, symmetric cryptography, and asymmetric cryptography. Each of these encryption methods have their own uses, advantages, and disadvantages. Hashing, for example, is very resistant to tampering, but is not as flexible as the other methods. All three forms of encryption rely on cryptography, or the science of scrambling data.

People use encryption to change readable text, called plaintext, into an unreadable secret format, called ciphertext. Encrypting data provides additional benefits besides protecting the confidentiality of a message. These advantages include ensuring that messages have not been altered during transit and verifying the identity of the sender. All of these benefits can be realized by using any of these encryption methods.

The first encryption method, called hashing, creates a unique, fixed-length signature for a message or data set. Hashes are created with an algorithm, or hash function, and people commonly use them to compare sets of data. Since a hash is unique to a specific message, even minor changes to that message result in a dramatically different hash, thereby alerting a user to potential tampering.

A key difference between hashing and the other two encryption methods is that once the data is encrypted, the process cannot be reversed or deciphered. This means that even if a potential attacker were able to obtain a hash, he or she would not be able to use a decryption method to discover the contents of the original message. Some common hashing algorithms are Message Digest 5 (MD5) and Secure Hashing Algorithm (SHA).

Symmetric cryptography, also called private-key cryptography, is one of the oldest and most secure encryption methods. The term "private key" comes from the fact that the key used to encrypt and decrypt data must remain secure because anyone with access to it can read the coded messages. A sender encodes a message into ciphertext using a key, and the receiver uses the same key to decode it.

People can use this encryption method as either a "stream" cipher or a "block" cipher, depending on the amount of data being encrypted or decrypted at a time. A stream cipher encrypts data one character at a time as it is sent or received, while a block cipher processes fixed chunks of data. Common symmetric encryption algorithms include Data Encryption Standard (DES), Advanced Encryption Standard (AES), and International Data Encryption Algorithm (IDEA).

Asymmetric, or public key, cryptography is, potentially, more secure than symmetric methods of encryption. This type of cryptography uses two keys, a "private" key and a "public key," to perform encryption and decryption. The use of two keys overcomes a major weakness in symmetric key cryptography, since a single key does not need to be securely managed among multiple users.

In asymmetric cryptography, a public key is freely available to everyone and used to encrypt messages before sending them. A different, private key remains with the receiver of ciphertext messages, who uses it to decrypt them. Algorithms that use public key encryption methods include RSA and Diffie-Hellman.

Read more from the original source:
What Are the Different Types of Encryption Methods?