Category Archives: Encryption

Revolutionary new cryptography tool could make software unhackable

Posted on by

A team of researchers from IBM and Microsoft may have just made a breakthrough in the quest for unbreakable cryptography. The results produced by the team from UCLA and MIT offer hope that encryption could protect not just an output, but an entire program. Once believed to be too powerful to exist in any real sense, this new method of program obfuscation could lead to ultra-secure software that keeps your personal information safe from nefarious individuals.

The idea of obfuscating a program has been around for decades software companies have tried all sorts of methods to distort their code in order to prevent others from seeing how it worked. However, the security and hacking communities have been able to defeat all these measures. Cryptographic experts have long been tinkering with stronger approaches, but it wasnt until the most recent collaboration that the pieces started falling into place.

Cryptographers have been chasing the idea of a so-called black box obfuscator for years. The idea is that any program passed through the black box would be so fundamentally garbled that no one would be able to figure out how it worked or what secrets it might hold only inputs and outputs would be visible, which is exactly what you want. This method could make communications almost completely secure. All you would need to do is create encryption keys with an obfuscated program, then make that program available to the other party or everyone for that matter, since no one would be able to figure out the decryption key from examining the obfuscated program.

One member of the team, Amit Sahai worked on a principle known as indistinguishability obfuscation a few years back, which at the time was considered a weak type of obfuscation. It involves passing a program through said obfuscator to disguise the origin. Two programs that do the same thing would be indistinguishable from each other at the end of it. Recent work has pointed to this as a surprisingly powerful cryptographic tool, though. The only problem, an indistinguishability obfuscator didnt exist until now.

The obfuscator created by Sahai and his colleagues appears to almost reach the level of broad protection described by the theoretical black box obfuscator. The tool, based on indistinguishability obfuscation, can be used to generate digital signatures, encryption keys, and more without leaking any of the inner workings of applications. It works by splicing random bits of data into the programs code so that it cannot be extracted in a functional state. However, when run as it is supposed to be, the random junk cancels itself out and you get the desired output.

After creating this obfuscation scheme, the team tried to break it by deploying every tool and hack they could come up with. The result? The obfuscator remains undefeated. The team feels this is as close to unbreakable as encryption gets right now, but its possible some future advance in computing or lattice mathematics could result in a breach.

While having access to strong cryptographic tools is certainly desirable, remember that companies and governments use encryption to protect sensitive data and trade secrets too. Breaking the encryption on future electronic devices might not be as easy as it was with DVD or the PS3. The indistinguishability obfuscator is still not ready for real world use, though. Right now it turns efficient little apps into ungainly monstrosities with all that random code inserted. Its still a very big step for cryptography.

View post:
Revolutionary new cryptography tool could make software unhackable

Security First SPxBitFiler-IPA encryption pattern for the IBM PureApplication System – Video

Posted on by


Security First SPxBitFiler-IPA encryption pattern for the IBM PureApplication System
http://www.securityfirstcorp.com According to a recent study, over half of cloud projects stall because of security concerns. Offering businesses the security they ...

By: Security First Corp.

Read the original:
Security First SPxBitFiler-IPA encryption pattern for the IBM PureApplication System - Video

New AlertBoot Encryption Reports Make Dental HIPAA Compliance Easier

Posted on by

Las Vegas, Nevada (PRWEB) January 31, 2014

AlertBoot, a leading provider of mobile device management and managed full disk encryption services, has introduced a new reporting engine that makes it easy to prove compliance with HIPAA Security Rule requirements for computing devices that are used by dentists, including laptop computers, desktop computers, and smart devices like smartphone and tablets.

"Under HIPAA and the patient data Breach Notification Rule, the use of encryption is the only way to gain safe harbor if patient data is lost or stolen," noted Tim Maliyil, founder and CEO of AlertBoot. "HIPAA defers to NIST on the specific requirements for encryption technology. There is also a requirement to keep accurate records. Using encryption is important, but so is the ability to prove that it was used when a device is stolen."

While much has been publicized about the importance of encryption under HIPAA such as the use of laptop full disk encryption on portable computers or desktop computers equally important is demonstrating that a device was encrypted if it ends up missing. In addition, dentists that are covered under HIPAA must take into account NIST (National Institute of Standards and Technology) requirements involving encryption key length and data accessibility.

Small and medium-sized dental practices, which usually do not maintain an in-house IT staff, may find computer encryption to be complex and inapproachable. Outside IT services can relieve some of the burden, but only if the contracted firm is familiar with HIPAA-related issues. If relying on outside consultants, there are a number of aspects that dental practices should inquire about when selecting data security services.

First, ascertain if the use of encryption is documented in a failsafe manner. Encryption protects patients by ensuring that PHI doesn't fall in the wrong hands. Proof of encryption protects you from HIPAA. The integrated reporting found in AlertBoot easily provides documented proof of encryption.

Second, HIPAA has requirements regarding data integrity. Information on computers can become corrupted, requiring data recovery operations. In such instances, a copy of the encryption key must be produced. AlertBoot automatically backs up encryption keys so that information is not inadvertently lost.

Last but not least, there are the basic technical requirements, such as using an encryption algorithm that equals or exceeds AES-128 and is without known weaknesses (prevented by using solutions validated by NIST. Ask if a NIST certificate is available). The AlertBoot solution uses NIST-validated full disk encryption.

In addition, there are a number of advantages to using AlertBoot:

To learn more about the advantages and convenience that comes with AlertBoot, please contact us at sales(at)alertboot(dot)com.

Read the rest here:
New AlertBoot Encryption Reports Make Dental HIPAA Compliance Easier

Baffle thy enemy: The case for Honey Encryption

Posted on by

12 hours ago by Nancy Owano Credit: Symantec

(Phys.org) Database breaches are making today's headlines, revealing events where thieves scoff up millions of passwords. Security experts meanwhile think about, talk about and work towards fighting against such crimes. A fresh twist in the security arsenal might be to simply baffle criminals by unleashing a flood of data that appears real but is fake. "Honey Encryption" is an approach being proposed to protect sensitive data. You beat attackers by making it difficult to figure out if the password or encryption key they are trying to steal is correct or incorrect.

A discussion about the approach on Wednesday in Threatpost said the tool results in the attacker seeing a plausible-looking password or encryption key which is actually incorrect, and the attacker cannot tell the information is incorrect. The two people behind this Honey Encryption approach is Ari Juels, former chief scientist at computer security company RSA, and Thomas Ristenpart, an assistant professor at the University of Wisconsin.

As it is now, a criminal intruder, with each try of an incorrect key, sees gibberish. The unsuccessful try clearly indicates it is not what he or she wants. With honey encryption, however, trying to guess the password or encryption key becomes mystifying; the attacker is dealing with thousands of, say, fake credit card numbers, and each one looks plausible. A report about their work in MIT Technology Review said Juels was convinced that "by now enough password dumps have leaked online to make it possible to create fakes that accurately mimic collections of real passwords."

In October, Juels had said that "Honeywords and honey-encryption represent some of the first steps toward the principled use of decoys, a time-honored and increasingly important defense in a world of frequent, sophisticated, and damaging security breaches." He said that the honeywords and honey encryption are joint work, respectively, with Ron Rivest and Tom Ristenpart. He said honey-encryption creates "ciphertexts that decrypt under incorrect keys to seemingly valid (decoy) messages."

The Honey Encryption system, meanwhile, will be the subject of a paper later this year when Juels and Ristenpart present their "Honey Encryption: Security Beyond the Brute-Force Bound" at the Eurocrypt conference in May, an event that is focused on cryptographic techniques, in Copenhagen.

Explore further: Research trio crack RSA encryption keys by listening to computer noise

2014 Phys.org

(Phys.org) A trio of researchers in Israel has discovered that it is possible to crack 4096-bit RSA encryption keys using a microphone to listen to high-pitch noises generated by internal computer components. ...

IBM inventors have received a patent for a breakthrough data encryption technique that is expected to further data privacy and strengthen cloud computing security.

Link:
Baffle thy enemy: The case for Honey Encryption