Theres no better place than Singapore to do a deep tech startup, particularly anything involving cryptography. So says Brijesh Pande, founder and managing partner of the Tembusu ICT Fund, a Singapore-based software-focused venture capital fund. Admittedly, he has a vested interest in enticing entrepreneurs to come to the island nation, but heand two founders of companies in his portfolio, Lawrence Hughes from Sixscape and Ramond Looi from Vi Dimensionsmake a solid argument.

Here in Singapore, Pande says, We have no requirement for a security back door. The fact that the NSA [National Security Agency] requires U.S. companies to provide a back door makes technology developed in the U.S. less trusted around the world.

Hughes, who before decamping to Singapore founded several companies, including U.S.-based Ciphertrust and Philippine-based Infoweapons, says its just too difficult to do cyber security products in the U.S. these days. The NSA requires weakened algorithms and back doors, so you have to assume all IT products in the U.S. are compromised. That, he says, makes it hard to market them around the world.

Sixscape, Hughes latest startup, has developed a certificate management protocol based on a distributed public key infrastructure that can manage, he says, billions of unique certificates. Web sites use server certificates to identify themselves as legitimate. In his scheme, individual users will also use client certificates, created on their own computers, as identification, instead of less secure usernames and passwords. For additional security, banks and other particularly sensitive businesses can give their clients hardware keys containing certificates to even more reliably confirm identity. Hughes says Sixscape will soon be piloting the technology, issuing some 2 million hardware tokens for a government agency in a nearby country that wishes to allow secureaccess its website, without usernames or passwords.

Meanwhile, two-year-old Vi Dimensions, Looi explained, is developing AI to mine surveillance videos for anomalies. With hundreds of millions of cameras out there, he says, the cost of human monitoring is just too high. The software, he says, can spot a big truck driving an unusual route, or a child lost in a subway station. The company, he says, has deployed the technology on 200 cameras in Sentosa, a resort island with 20 million visitors annually, has signed an agreement with one of Europes largest national railways to use the technology on its surveillance cameras, and has completed trials in an Abu Dhabi skyscraper. On Sentosa, he said, the technology was able to improve operationsby spotting too-long lines at taxi stands and identifying points where parents were having trouble navigating strollers.

Its not just escaping the NSA that makes Singapore more and more attractive to startups, these entrepreneurs say.

The potential tightening of H1B visas in the United States will push more companies to start elsewhere, says Pande. If the U.S. develops an H1B issue, he says, that will be good for Singapore.

Here, there is no limit to H1Bs, you just have to demonstrate a need, Pande says.We have Singaporeans, Americans, Iranians, Indians, Russiansa veritable United Nations working at all our companies.

And, pointed out Hughes, Singapore has zero capital gains tax, relying instead on income and value added taxes.

Starting a company in Singapore, Pande points out, is not without challenges. We dont have a deep bench, he says. So the second level of tech talent, just below the entrepreneur, can be hard to come by.

And though the local universities are solid, he says, there just arent the big tech companies doing core R&D that spit out spinoffs.And there isnt a big domestic market, says Pande,though government support helps.

Valuations for startups also tend to be low compared to those in the U.S., Hughes says, but its early days here.

IEEE Spectrums blog featuring the people, places, and passions of the world of technologists in Silicon Valley and its environs. Contact us:t.perry@ieee.org

Germany takes the lead in making the Internet local 23Jan2014

Scott Borg, director of the U.S. Cyber Consequences Unit, says hardware design engineers hold the future of cybersecurity in their hands 15May

Secretive big data company Palantir has gobbled up downtown Palo Alto 14Jan2015

HAXs Ben Joffe takes a look at whats going on in Chinas startup sector 27Jun

Derive is taking technology that lets hot rodders soup up their vehicles and using it to make drivers behave themselves 27Jun

HAX executives preview trends in hardware startups 26Jun

The Canadian company wants to use AI to rate your car insurance risk in real time 22Jun

Affectivas Rana El-Kaliouby says our devices need to get a lot more emotionally intelligent 13Jun

The Pied Piper of the TV show's fictional quest to reinvent the Internet trails the progress of MaidSafe and the University of Michigan 9Jun

Nannycams? So yesterday. Startup Lighthouse's computer vision and AI will tell you everything you miss when youre not home 6Jun

Silicon Valley startup Verdigris cloud-based analysis can tell whether youre using a Chromebook or a Mac, or whether a motor is running fine or starting to fail 3May

Enviro Powers small steam turbine could cut homeowners electricity bills by 30 percent 18Apr

Avegant is confident enough about its light-field-based mixed-reality technology that it's willing to show and tell 18Apr

The 2017 contest puts a renewed emphasis on projects that could become successful businesses 24Mar

Who needs infrared spectrometers in their phones? People who hate buying tasteless produce or mystery cheese 14Mar

Palo Alto startup twoXAR partners with Santen Pharmaceutical to identify new glaucoma drugs; efforts on rare skin disease, liver cancer, atherosclerosis, and diabetic nephropathy also under way 13Mar

As coal industry jobs are lost, likely not to return, some in coal country have turned to coding 15Feb

The next-generation kitchen ovens promise perfect cooking using solid-state RF transmitters and sensors 6Feb

Take a bit of Maker Faire, a dash of Burning Man, and a scoop of Chuck E. Cheese, add $15 million, and poof, a micro-amusement park 19Jan

$34 million in drone preorders wasn't enough to keep Lily open 12Jan

Originally posted here:
Doing a Startup Involving Cryptography? Get Out of the US - IEEE Spectrum

A brief history of GnuPG: Vital to online security but free and underfunded

This article was first posted on The Conversation.

Most people have never heard of the software that makes up the machinery of the internet. Outside developer circles, its authors receive little reward for their efforts, in terms of either money or public recognition.

One example is the encryption software GNU Privacy Guard (also known as GnuPG and GPG), and its authors are regularly forcedto fundraiseto continue the project.

GnuPG is part of the GNU collection offree and open source software, but its story is an interesting one, and it begins with software engineer Phil Zimmermann.

We do not know exactly what Zimmermann felt onJanuary 11, 1996, but relief is probably a good guess. The United States government had just endedits investigationinto him and his encryption software, PGP or Pretty Good Privacy.

In the 1990s, the U.S. restricted the exportof strong cryptography, viewing it as sensitive technology that had once been the exclusive purview of the intelligence and military establishment. Zimmermann had been facing serious punishment for posting PGP on the internet in 1991, which could have been seen as a violation of theArms Export Control Act.

To circumvent U.S. export regulations and ship the software legally to other countries, hackers even printed the source codeas a book, which would allow anyone to scan it at its destination and rebuild the software from scratch.

Zimmermann later worked with the PGP Corporation, which helped define PGP as an open internet standard,OpenPGP. A number of software packages implement this standard, of which GnuPG is perhaps the best known.

What is PGP?

PGP implements a form of cryptography that is known as asymmetric cryptography or public-key cryptography.

The story of its discovery is itself worth telling. It was invented in the 1970s byresearchersat the British intelligence service GCHQ and then again byStanford University academicsin the U.S., although GCHQs results were only declassified in 1997.

Asymmetric cryptography gives users two keys. The so-called public key is meant to be distributed to everyone and is used to encrypt messages or verify a signature. The private or secret key must be known only to the user. It helps decrypt messages or sign them -- the digital equivalent of a seal to prove origin and authenticity.

Zimmermann published PGP becausehe believedthat everybody has a right to private communication. PGP was meant to be used for email, but could be used for any kind of electronic communication.

The challenge facing security software

Despite Zimmermanns work, the dream of free encryption for everyone never quite came to full bloom.

Neither Zimmermanns original PGP nor the later GnuPG managed to become entirely user friendly. Both use highly technical language, and the latter is still known for being accessible only by typing out commands -- an anachronism even in the late 1990s, when most operating systems already used the mouse.

Many users did not understand why they should encrypt their email at all, and attempts to integrate the tools with email clients were not particularly intuitive.

Big corporations such as Microsoft, Google and Apple shunned it -- to this day, they do not ship PGP with their products, although some are now implementing forms of end-to-end encryption.

Finally, there was the issue of distributing public keys -- they had to be made available to other people to be useful. Private initiatives never gathered much attention. In fact,a number ofacademic studiesin the early and late 2000s showed that these attempts never managed to attract widespread public usage.

The releaseof the Edward Snowden documents in 2013 spurred renewed interest in PGP. Crypto parties became a global phenomenon when people met in person to exchange their public keys, but this was ultimately short-lived.

PGP today

When I met Zimmermann in Silicon Valley in 2015, he admitted that he did not currently use PGP. In a more recent email, he said this is because it does not run on current versions of macOS or iOS. I may soon run GnuPG, he wrote.

By todays standards, GnuPG -- like all implementations of OpenPGP -- lacks additional security features that are provided by chat apps such as WhatsApp or Signal. Both are spiritual descendants of PGP and unthinkable without Zimmermanns invention, but they go beyond what OpenPGP can do by protecting messages even in the case of a private key being lost.

Read more:
A brief history of GnuPG: Vital to online security but free and underfunded - GCN.com