IMA Public Lectures : Secrecy, privacy, and deception: the mathematics of cryptography; Jill Pipher
Secrecy, privacy, and deception: the mathematics of cryptography 7:00P.M., Wednesday, March 9, 2011, 2011, Willey Hall 175 Jill Pipher (Mathematics Departmen...

By: IMA UMN

Originally posted here:
IMA Public Lectures : Secrecy, privacy, and deception: the mathematics of cryptography; Jill Pipher - Video

Sometimes encrypting messages isnt enough, and the very act of sending them must be hidden as well. Now physicists have discovered how to camouflage messages and guarantee that they remain hidden.

The world of cryptography has undergone a quiet revolution in recent years. Thats largely because of the advent of techniques that exploit the laws of quantum mechanics to send messages with perfect privacy. So-called quantum cryptography ensures that an eavesdropper cannot decode a message under guarantee by the laws of physics.

But sometimes perfect privacy isnt enough. Sometimes the knowledge that a message has been sent is all that an adversary needs. So the question arises of how to hide a message so that an eavesdropper cannot tell whether it has been sent or not.

Read this article:
World's First Covert Communications System with Camouflage Guaranteed

SHANGHAI: Chinas biggest bank ICBC has banned activities related to trading in Bitcoin, joining at least 10 other Chinese banks participating in a government crackdown on virtual currencies.

Bitcoin, invented in the wake of the global financial crisis by a mysterious computer guru, is a form of cryptography-based e-money that can be stored either virtually or on a users hard drive, and offers a largely anonymous payment system.

Speculators drove Chinas Bitcoin prices into the financial stratosphere last year, peaking at 7,588.88 yuan (now US$1,224) in November, before they crashed following moves by exchanges, financial institutions and the government to rein in the virtual currency.

From this date, any institution or individual must not use accounts set up with our bank for the deposit and withdrawal and transfer of funds for Bitcoin and Litecoin trading, the Industrial and Commercial Bank of China (ICBC) said in a statement.

Litecoin is another virtual currency

The move aimed to protect the property rights and interests of the public, prevent money laundering risks as well as to safeguard the status of the renminbi as the legal currency, ICBC said, referring to Chinas yuan currency.

China tightly controls the yuan and enforces capital controls, which e-currencies threaten by their very nature.

ICBC threatened to suspend and close bank accounts if clients failed to comply with the new rules.

In its annual financial stability report released late last month, Chinas central bank labelled Bitcoin a tool for speculation and warned against risks the e-money could pose to capital flows as well as its possible use in illegal activities including drug dealing and money laundering.

Last month, the central Peoples Bank of China instructed banks and third-party payment providers to completely cut off the capital chain for Bitcoin trading, the Southern Metropolis Daily newspaper reported.

See the original post here:
China’s largest bank bars Bitcoin trading

Aurich Lawson / Thinkstock

More than four weeks after the disclosure of the so-called Heartbleed bug found in a widely used cryptography package, slightly more or slightly less than half the systems affected by the catastrophic flaw remain vulnerable, according to two recently released estimates.

A scan performed last month by Errata Security CEO Rob Graham found 615,268 servers that indicated they were vulnerable to attacks that could steal passwords, other types of login credentials, and even the extremely sensitive private encryption keys that allow attackers to impersonate websites or monitor encrypted traffic. On Thursday, the number stood at 318,239. Graham said his scans counted only servers running vulnerable versions of the OpenSSL crypto library that enabled the "Heartbeat" feature where the critical flaw resides.

A separate scan using slightly different metrics arrived at an estimate that slightly less than half of the servers believed to be vulnerable in the days immediately following the Heartbleed disclosure remain susceptible. Using a tool the researcher yngve called TLS Prober, he found that 5.36 percent of all servers were vulnerable to Heartbleed as of April 11, four days after Heartbleed came to light. In a blog post published Wednesday, he said 2.33 percent of servers remained vulnerable. It's important to remember the results don't include the number of Heartbleed-vulnerable servers providing services such a virtual private networks or e-mail.

Even more concerning, he said, was data showing the number of vulnerable Web servers running specialized encryption accelerators manufactured by F5 has held steady. The lack of a decline is most likely the result of new F5 BigIP systems coming online using unpatched versions of OpenSSL.

"As BigIP servers are used by sites serving large number[s] of users, this represents a significant security problem for those users," the researcher wrote. Also troubling, he said, was that of the vulnerable sites that have been patched in the past four weeks, as many as two-thirds of them may not have revoked their old digital certificates and regenerated a new one. As Ars explained previously, installing OpenSSL updates is only one step in the Heartbleed recovery regimen. Since the bug exposed private keys and passwords for more than two years, all vulnerable sites should assume their certificates are compromised and get new ones as soon as possible after upgrading.

An important proviso about the results of both scans: the estimates can be heavily skewed by the difficulty of probing millions of IP addresses or domain names, particularly when scans are carried days or weeks apart from each other. Graham said he suspects some servers have begun blocking his Heartbleed-detecting probes or that congestion inside the network of his ISP could throw off the accuracy of his findings. For the sake of comparison, a separate scan that surveyed 156,022 websites found 1,291 of them vulnerable to Heartbleed. Whatever scan is considered, the estimates are significant given the severity of the Heartbleed bug. The silver lining is that most big sites that were vulnerable have since been patched.

Read the original post:
Four weeks on, huge swaths of the Internet remain vulnerable to Heartbleed