Open Source News » Tags

Feeds

34757 items (30244 unread) in 5 feeds

OpenSource

Security

Linux

176 items tagged "encryption"

Apple Security Blunder Exposes Lion Login Passwords In Clear Text

Posted: May 6th, 2012, 8:10pm CEST by samzenpus

Tags: encryption

An anonymous reader writes "An Apple programmer, apparently by accident, left a debug flag open in the most recent version of its Mac OS X operating system. In specific configurations, applying the OS X Lion update 10.7.3 turns on a system-wide debug log file that contains the login passwords of every user who has logged in since the update was applied. The passwords are stored in clear text."

Read more of this story at Slashdot.

SSL Pulse Project Finds Just 10% of SSL Sites Actually Secure

Posted: April 28th, 2012, 5:23am CEST by timothy

Tags: encryption

Trailrunner7 writes "A new project that was setup to monitor the quality and strength of the SSL implementations on top sites across the Internet found that 75 percent of them are vulnerable to the BEAST SSL attack and that just 10 percent of the sites surveyed should be considered secure. The SSL Pulse project, set up by the Trustworthy Internet Movement, looks at several components of each site's SSL implementation to determine how secure the site actually is. The project looks at how each site is configured, which versions of the TLS and SSL protocols the site supports, whether the site is vulnerable to the BEAST or insecure renegotiation attacks and other factors. The data that the SSL Pulse project has gathered thus far shows that the vast majority of the 200,000 sites the project is surveying need some serious help in fixing their SSL implementations."

Read more of this story at Slashdot.

Super-Privacy-Protecting ISP In the Planning

Posted: April 12th, 2012, 12:03am CEST by samzenpus

Tags: encryption

h00manist writes "Nicholas Merrill ran a New York based ISP and got tired of federal 'information requests.' He is now planning an ISP which would be built from the ground up for privacy. Everything encrypted, maximum technical and legal resistance to information requests. Merrill has formed an advisory board with members including Sascha Meinrath from the New America Foundation; former NSA technical director Brian Snow; and Jacob Appelbaum from the Tor Project. Kickstarter-like IndieGoGo has a project page."

Read more of this story at Slashdot.

Scientists Release Working Prototype Of CAPTCHA-Based Password Assistant

Posted: April 8th, 2012, 1:48am CEST by timothy

Tags: encryption

An anonymous reader writes "Last year Slashdot ran a story on scientists from the Max-Planck-Institute for Physics of Complex Systems in Dresden, Germany developing a novel method to improve password security. A strong long password is split in two parts; the first part is memorized by a human, and the second part is stored as a CAPTCHA-like image of a chaotic lattice system. Today, after a year of work, the same group at Max Planck Institute released a working prototype online, where everybody can try this technology to encrypt files (Java plugin required)."

Read more of this story at Slashdot.

Getting the Most Out of SSH

Posted: March 26th, 2012, 7:49pm CEST by Soulskill

Tags: encryption

jfruh writes "If you have to administer a *nix computer remotely, you hopefully ditched Telnet for SSH years ago. But you might not know that this tool does a lot more than offer you a secured command line. Here are some tips and tricks that'll help you do everything from detect man-in-the-middle attacks (how are you supposed to know if you should accept a new hosts public key, anyway?) to evading restrictions on Web surfing." What are your own favorite tricks for using SSH?

Read more of this story at Slashdot.

Getting the Most Out of SSH

Posted: March 26th, 2012, 7:49pm CEST by Soulskill

Tags: encryption

Read more of this story at Slashdot.

The Spanish Link In Cracking the Enigma Code

Posted: March 23rd, 2012, 8:05pm CET by Soulskill

Tags: encryption

peetm sends this quote from the BBC: "When the Spanish Civil War began in 1936, both Hitler's Germany and Mussolini's Italy sent troops to help the nationalists under Franco. But with the conflict dispersed across the country, some means of secure communication was needed for the German Condor Legion, the Italians and the Spanish forces under Franco. As a result, a set of modified commercial Enigma machines were delivered by Germany. ... A key figure in trying to understand it was Dilly Knox, a classicist who had been working on breaking ciphers since World War I. He was fascinated by the machine and began studying ways in which an intercepted message might in theory be broken, even writing his own messages, encrypting them and then trying to break them himself. But there was no opportunity to actually intercept a real message since German military signals were inaudible in Britain. However, the signals produced by the machines sent to Spain in 1936 were audible enough to be intercepted and Knox began work. ... Within six or seven months of having his first real code to crack, Knox had succeeded, producing the first decryption of an Enigma message in April 1937."

Read more of this story at Slashdot.

NSA Building US's Biggest Spy Center

Posted: March 16th, 2012, 6:03pm CET by Soulskill

Tags: encryption

New submitter AstroPhilosopher writes "The National Security Agency is building a complex to monitor and store 'all' communications in a million-square-foot facility. One of its secret roles? Code-breaking your private, personal information. Everybody's a target. Quoting Wired: 'Breaking into those complex mathematical shells like the AES is one of the key reasons for the construction going on in Bluffdale. That kind of cryptanalysis requires two major ingredients: super-fast computers to conduct brute-force attacks on encrypted messages and a massive number of those messages for the computers to analyze. The more messages from a given target, the more likely it is for the computers to detect telltale patterns, and Bluffdale will be able to hold a great many messages. "We questioned it one time," says another source, a senior intelligence manager who was also involved with the planning. "Why were we building this NSA facility? And, boy, they rolled out all the old guys—the crypto guys." According to the official, these experts told then-director of national intelligence Dennis Blair, "You’ve got to build this thing because we just don’t have the capability of doing the code-breaking." It was a candid admission.'"

Read more of this story at Slashdot.

Anonymous, Decentralized and Uncensored File-Sharing Is Booming

Posted: March 4th, 2012, 11:18am CET by Soulskill

Tags: encryption

PatPending writes with this excerpt from TorrentFreak: "The RetroShare network allows people to create a private and encrypted file-sharing network. Users add friends by exchanging PGP certificates with people they trust. All the communication is encrypted using OpenSSL and files that are downloaded from strangers always go through a trusted friend. In other words, it's a true Darknet and virtually impossible to monitor by outsiders. RetroShare founder DrBob told us that while the software has been around since 2006, all of a sudden there's been a surge in downloads. 'The interest in RetroShare has massively shot up over the last two months,' he said."

Read more of this story at Slashdot.

John Nash's Declassified 1955 Letter To the NSA

Posted: February 18th, 2012, 6:20pm CET by Soulskill

Tags: encryption

An anonymous reader writes "In 1955, John Nash sent an amazing letter (PDF) to the NSA in order to support an encryption design that he suggested. In it, he anticipates computational complexity theory as well as modern cryptography. He also proposes that the security of encryption can be based on computational hardness and makes the distinction between polynomial time and exponential time: 'So a logical way to classify enciphering processes is by the way in which the computation length for the computation of the key increases with increasing length of the key. This is at best exponential and at worst probably at most a relatively small power of r, ar^2 or ar^3, as in substitution ciphers.'"

Read more of this story at Slashdot.

99.8% Security For Real-World Public Keys

Posted: February 15th, 2012, 1:17am CET by Soulskill

Tags: encryption

An anonymous reader writes "If you grab all the public keys you can find on the net, then you might expect to uncover a few duds — but would you believe that 2 out of every 1000 RSA keys is bad? This is one of the interesting findings in the paper 'Ron was wrong, Whit is right' by Lenstra, Hughes, Augier, Bos, Kleinjung and Wachter. Quoting from the paper's abstract: 'We performed a sanity check of public keys collected on the web. Our main goal was to test the validity of the assumption that different random choices are made each time keys are generated. We found that the vast majority of public keys work as intended. A more disconcerting finding is that two out of every one thousand RSA moduli that we collected offer no security. Our conclusion is that the validity of the assumption is questionable and that generating keys in the real world for "multiple-secrets" cryptosystems such as RSA is significantly riskier than for "single-secret" ones such as ElGamal or (EC)DSA which are based on Diffie-Hellman.'" For a layman's interpretation of the research, the NY Times has an article about the paper. Update: 02/15 01:34 GMT by S : Security researcher Dan Kaminsky has commented on the paper, saying that while the survey work itself is good, it doesn't necessarily support the paper's thesis. He writes, "On the most basic level, risk in cryptography is utterly dominated, not by cipher selection, but by key management. The study found 12,720 public keys. It also found approximately 2.94 million expired certificates. And while the study didn’t discuss the number of certificates that had no reason to be trusted in the first place (being self signed), it did find 5.4M PGP keys. It does not matter the strength of your public key if nobody knows to demand it."

Read more of this story at Slashdot.

Sponsor a Valve On Colossus

Posted: February 9th, 2012, 6:01pm CET by timothy

Tags: encryption

mikejuk writes "The UK's National Museum of Computing has come up with a novel idea to raise funds for its new gallery for its rebuilt Colossus computer — you can sponsor a valve. All you have to do is buy a small area in a picture of Colossus (at £0.1 per pixel — min £10), upload a picture to occupy the space, set a URL and pay using PayPal."

Read more of this story at Slashdot.

Pasadena Police Encrypt, Deny Access To Police Radio

Posted: February 8th, 2012, 6:15am CET by Soulskill

Tags: encryption

An anonymous reader writes "There is media (but not public?) outcry over the Pasadena, CA police switch from analog radio that can be picked up by scanners to encrypted digital radio that cannot. 'On Friday, Pasadena police Lt. Phlunte Riddle said the department was unsure whether it could accommodate the media with digital scanners. Riddle said the greatest concern remains officer safety. "People who do bank robberies use scanners, and Radio Shack sells these things cheap," Riddle said. "We just had a robbery today on Hill Avenue and Washington Boulevard," Riddle said. "The last thing I want to do is to have the helicopter or the officers set up on the street and the criminals have a scanner and know where our officers are." Just prior to the switch over, city staffers said they would look into granting access to police radio chatter, most likely by loaning media outlets a scanner capable of picking up the secure signal.'"

Read more of this story at Slashdot.

Defendant Ordered To Decrypt Laptop Claims She Had Forgotten Password

Posted: February 7th, 2012, 9:08am CET by Unknown Lamer

Tags: encryption

wiedzmin writes "A Colorado woman that was ordered by a federal judge to decrypt her laptop hard-drive for police last month, appears to have forgotten her password. If she does not remember the password by month's end, as ordered, she could be held in contempt and jailed until she complies. It appears that bad memory is now a federal offense." The article clarifies that her lawyer stated she may have forgotten the password; they haven't offered that as a defense in court yet.

Read more of this story at Slashdot.

Defendant Ordered To Decrypt Laptop Claims She Had Forgotten Password

Posted: February 7th, 2012, 9:08am CET by Unknown Lamer

Tags: encryption

Read more of this story at Slashdot.

Satellite Phone Encryption Cracked

Posted: February 4th, 2012, 12:38am CET by Soulskill

Tags: encryption

New submitter The Mister Purple writes "A team of German researchers appears to have cracked the GMR-1 and GMR-2 encryption algorithms used by many (though not all) satellite phones. Anyone fancy putting a cluster together for a listening party? 'Mr. Driessen told The Telegraph that the equipment and software needed to intercept and decrypt satellite phone calls from hundreds of thousands of users would cost as little as $2,000. His demonstration system takes up to half an hour to decipher a call, but a more powerful computer would allow eavesdropping in real time, he said.'"

Read more of this story at Slashdot.

Stealing Smartphone Crypto Keys Using Radio Waves

Posted: January 28th, 2012, 4:28pm CET by timothy

Tags: encryption

coondoggie writes "Encryption keys on smartphones can be stolen via a technique using radio waves, says one of the world's foremost crypto experts, Paul Kocher, whose firm Cryptography Research will demonstrate the hacking stunt with several types of smartphones at the upcoming RSA Conference in San Francisco next month."

Read more of this story at Slashdot.

Do Slashdotters Encrypt Their Email?

Posted: December 20th, 2011, 4:10am CET by Unknown Lamer

Tags: encryption

An anonymous reader writes "Many years ago when I first heard of PGP, I found an add-on that made it fairly simple to use PGP to encrypt my email. Despite the fact that these days most people know that email is a highly insecure means of communication, very few people that I know ever use any form of email encryption despite the fact that it is pretty easy to use. This isn't quite what I would have expected when I first set it up. So, my question to fellow Slashdotters is 'Do you encrypt your email? If not, 'Why not?' and 'Why has email encryption using PGP or something similar not become more commonplace?' The use of cryptography used to be a hot topic once upon a time."

Read more of this story at Slashdot.

Do Slashdotters Encrypt Their Email?

Posted: December 20th, 2011, 4:10am CET by Unknown Lamer

Tags: encryption

Read more of this story at Slashdot.

MIT Software Allows Queries On Encrypted Databases

Posted: December 19th, 2011, 10:59pm CET by Soulskill

Tags: encryption

Sparrowvsrevolution writes "CryptDB, a piece of database software that MIT researchers presented at the Symposium on Operating System Principles in October, allows users to send queries to an encrypted SQL database and get results without decrypting the stored information. CryptDB works by nesting data in several layers of cryptography (PDF), each of which has a different key and allows a different kind of simple operation on encrypted data. It doesn't work with every kind of calculation, and it's not the first system to offer this sort of computation on encrypted data. But it may be the only practical one. A previous crypto scheme that allowed operations on encrypted data multiplied computing time by a factor of a trillion. This one adds only 15-26%."

Read more of this story at Slashdot.

Running Tor On Your TV

Posted: December 16th, 2011, 12:12am CET by timothy

Tags: encryption

jaromil writes "TorTV is an early effort to embed Tor in household computing: run it on your TV at home. So far only WDTV installed with the homebrew WDLXTV firmware is supported. What other platforms do you think are viable for it?"

Read more of this story at Slashdot.

OpenDNS Releases DNS Encryption Tool

Posted: December 8th, 2011, 3:34pm CET by timothy

Tags: encryption

wiredmikey writes "It's not news that some of the underlying foundations of the DNS protocol are inherently weak, especially what they call the "last mile" — or the part of the internet connection between the client and the ISP. To address this, OpenDNS has released a preview of DNSCrypt, a tool that enables encrypted DNS traffic, much in the same way SSL enables encrypted HTTP traffic. DNSCrypt will stop DNS replay, observation, and timing attacks, as well as Man-in-the-Middle attacks and resolver impersonation attacks. The tool, available already compiled for OS X, will also run on OpenBSD, NetBSD, Dragonfly BSD, FreeBSD, and Linux. There is no Windows client, which is odd considering a majority of the 30 million OpenDNS users run Microsoft's operating system."

Read more of this story at Slashdot.

OpenDNS Releases DNS Encryption Tool

Posted: December 8th, 2011, 3:34pm CET by timothy

Tags: encryption

Read more of this story at Slashdot.

GCHQ Challenge Solution Explained

Posted: December 4th, 2011, 6:38pm CET by timothy

Tags: encryption

First time accepted submitter DrDevil writes "The British spy agency GCHQ recently published a puzzle at canyoucrackit.co.uk (as featured on Slashdot), now just a few days later an academic at the University of Greenwich in England has posted a full video explanation of the puzzle. The puzzle has three stages and is not at all simple — likely to challenge even the best computer science graduates."

Read more of this story at Slashdot.

San Francisco Team Wins DARPA's De-Shredding Contest

Posted: December 3rd, 2011, 12:45am CET by timothy

Tags: encryption

New submitter karlnyberg writes with an update to the recently announced de-shredding challenge posted by DARPA: "The team 'All Your Shreds Are Belong To U.S.' has correctly solved all five puzzles, and the Challenge has now ended. You may view the winning team's submissions as well as the complete puzzle solutions by following the links on our homepage. We recognize that many of our participants have devoted countless hours to painstakingly piecing our puzzles back together, and we truly appreciate everyone's efforts. Hopefully you enjoyed the Challenge and learned something new along the way. We certainly did!"

Read more of this story at Slashdot.

Physicist Uses Laser Light As Fast, True-Random Number Generator

Posted: November 29th, 2011, 11:14pm CET by Soulskill

Tags: encryption

MrKevvy writes "An Ottawa physicist is using laser light to create truly random numbers much faster than other methods do, with obvious potential benefits to cryptography: 'Sussman's Ottawa lab uses a pulse of laser light that lasts a few trillionths of a second. His team shines it at a diamond. The light goes in and comes out again, but along the way, it changes. ... It is changed because it has interacted with quantum vacuum fluctuations, the microscopic flickering of the amount of energy in a point in space. ... What happens to the light is unknown — and unknowable. Sussman's lab can measure the pulses of laser light that emerge from this mysterious transformation, and the measurements are random in a way that nothing in our ordinary surroundings is. Those measurements are his random numbers.'"

Read more of this story at Slashdot.

Twitter Buys Moxie Marlinspike's Crypto Startup

Posted: November 28th, 2011, 9:43pm CET by Soulskill

Tags: encryption

Sparrowvsrevolution writes "Twitter has confirmed that it's acquiring Whisper Systems, the mobile encryption startup founded by hacker and security researcher Moxie Marlinspike. Marlinspike has built some of the most noteworthy tools in applied cryptography over the last few years, including the encrypted calling app Redphone, the hardened Android OS WhisperCore, and Convergence, a system for fixing the broken SSL certificate authority system. Twitter won't yet say how it plans to integrate Marlinspike or his products."

Read more of this story at Slashdot.

$350 Hardware Cracks HDMI Copy Protection

Posted: November 25th, 2011, 8:10pm CET by Soulskill

Tags: encryption

New submitter LBeee writes "German Researchers at the Ruhr University Bochum built an FPGA board-based man-in-the-middle attack against the HDCP copy protection used in HDMI connections. After the leak of an HDCP master key in 2010, Intel proclaimed that the copy protection was still secure, as it would be too expensive to build a system that could conduct a real-time decryption of the data stream. It has now been proven that a system can be built for around $350 (€200) to do the task. However, the solution is of no great practical use for pirates. It can easily be used to burn films from Blu-ray discs, but receivers which can deliver HDTV recordings are already available — and they provide the data in compressed form. In contrast, recording directly from an HDMI port results in a large amount of data."

Read more of this story at Slashdot.

$350 Hardware Cracks HDMI Copy Protection

Posted: November 25th, 2011, 8:10pm CET by Soulskill

Tags: encryption

Read more of this story at Slashdot.

Police Encrypt Radios To Tune Out Public

Posted: November 23rd, 2011, 9:21pm CET by samzenpus

Tags: encryption

Hugh Pickens writes writes "Police departments around the country are moving to shield their radio communications from the public as cheap, user-friendly technology has made it easy for anyone to use handheld devices to keep tabs on officers responding to crimes and although law enforcement officials say they want to keep criminals from using officers' internal chatter to evade them, journalists and neighborhood watchdogs say open communications ensures that the public receives information as quickly as possible that can be vital to their safety. 'Whereas listeners used to be tied to stationary scanners, new technology has allowed people — and especially criminals — to listen to police communications on a smartphone from anywhere,' says DC Police Chief Cathy Lanier who says that a group of burglars who police believe were following radio communications on their smartphones pulled off more than a dozen crimes before ultimately being arrested. But encryption also makes it harder for neighboring jurisdictions to communicate in times of emergency. 'The 9/11 commission concluded America's number one vulnerability during the attacks was the lack of interoperability communications,' writes Vernon Herron, 'I spoke to several first responders who were concerned that their efforts to respond and assist at the Pentagon after the attacks were hampered by the lack of interoperability with neighboring jurisdictions.'"

Read more of this story at Slashdot.

Ask Slashdot: Data Remanence Solutions?

Posted: November 23rd, 2011, 8:38pm CET by samzenpus

Tags: encryption

MightyMartian writes "The company I work for has just had their government contract renewed, which is good news, giving me several more years of near-guaranteed employment! However, in going through all the schedules and supplementary documents related to the old contract, which we will begin winding down next spring, we've discovered some pretty stiff data remanence requirements that, for hard drives at least, boil down to 'they must be sent to an appropriately recognized facility for destruction.' Now keep in mind that we are the same organization that has been delivering this contract all along, so the equipment isn't going anywhere. What's more, destruction of hard drives means we have to buy new ones, which is going to cost us a lot of money, particular with prices being so high. I've looked at using encryption as a means of destroying data, in that if you encrypt a drive or a set of files with an appropriately long and complex key, and then destroy all copies of that key, that data effectively is destroyed. I'd like to write up a report to submit to our government contract managers, and would be interested if any Slashdotters have experience with this, or have any references or citations to academic or industry papers on dealing with data remanence without destroying physical media?"

Read more of this story at Slashdot.

OpenPGP Implemented In JavaScript

Posted: November 22nd, 2011, 11:32am CET by Unknown Lamer

Tags: encryption

angry tapir writes with this excerpt from Tech World: "Researchers from German security firm Recurity Labs have released a JavaScript implementation of the OpenPGP specification that allows users to encrypt and decrypt webmail messages. Called GPG4Browsers, the tool functions as an extension for Google Chrome and now is capable of working with GMail." A quick gander at the source leaves me with the impression that it should be more or less portable to other browsers. It's also built using a lot of off-the-shelf Javascript libraries. (Who knew Javascript had a bignum library and a number of cipher implementations?)

Read more of this story at Slashdot.

Fox-IT Completes the Picture On the Factored RSA-512 Keys

Posted: November 21st, 2011, 11:50pm CET by Soulskill

Tags: encryption

An anonymous reader sends in this excerpt from the Fox-IT blog: "During recent weeks we have observed several interesting publications which have a direct relation to an investigation we worked on recently. On one hand there was a Certificate Authority being revoked by Mozilla, Microsoft and Google (Chrome), on the other hand there was the disclosure of a malware attack by Mikko Hypponen (FSecure) using a government issued certificate signed by the same Certificate Authority. That case, however, is not self-contained, and a whole range of malicious software had been signed with valid certificates. The malicious software involved was used in targeted attacks focused on governments, political organizations and the defense industry. The big question is, of course, what happened, and how did the attackers obtain access to these certificates? We will explain here in detail how the attackers have used known techniques to bypass the Microsoft Windows code signing security model."

Read more of this story at Slashdot.

Full Disk Encryption Hard For Law Enforcement To Crack

Posted: November 19th, 2011, 9:10pm CET by timothy

Tags: encryption

If you'd rather keep your data private, take heart: disk encryption is a lot harder to break than techno-thriller movies and TV shows make it out to be, to the chagrin of some branches of law enforcement. MrSeb writes with word of a paper titled "The growing impact of full disk encryption on digital forensics" [abstract here to paywalled article] that illustrates just how difficult it is. According to the paper, co-authored by a member of US-CERT, "[T]here are three main problems with full disk encryption (FDE): First, evidence-gathering goons can turn off the computer (for transportation) without realizing it's encrypted, and thus can't get back at the data (unless the arrestee gives up his password, which he doesn't have to do); second, if the analysis team doesn't know that the disk is encrypted, it can waste hours trying to read something that's ultimately unreadable; and finally, in the case of hardware-level disk encryption, tampering with the device can trigger self-destruction of the data. The paper does go on to suggest some ways to ameliorate these issues, but ultimately the researchers aren't hopeful: 'Research is needed to develop new techniques and technology for breaking or bypassing full disk encryption.'"

Read more of this story at Slashdot.

Hiding Messages In VoIP Packets

Posted: November 17th, 2011, 1:21am CET by samzenpus

Tags: encryption

Orome1 writes "A group of researchers from the Warsaw University of Technology have devised a relatively simple way of hiding information within VoIP packets exchanged during a phone conversation. The called the method TranSteg, and they have proved its effectiveness by creating a proof-of-concept implementation that allowed them to send 2.2MB (in each direction) during a 9-minute call. IP telephony allows users to make phone calls through data networks that use an IP protocol. The actual conversation consists of two audio streams, and the Real-Time Transport Protocol (RTP) is used to transport the voice data required for the communication to succeed. But, RTP can transport different kinds of data, and the TranSteg method takes advantage of this fact."

Read more of this story at Slashdot.

DARPA: Reconstruct Shredded Docs, Win $50K USD

Posted: October 27th, 2011, 9:26pm CEST by timothy

Tags: encryption

ematic writes with a link to an interesting competition from DARPA: "The ability to reconstruct shredded documents will potentially yield information that may save lives or offer critical information about an adversary's plans. Currently, this process is much too slow and too labor-intensive, particularly if the documents are handwritten. We are looking to the Shredder Challenge to generate some leap-ahead thinking in this area. The Shredder Challenge is composed of five separate problems. The overall prize awarded depends on the number and difficulty of problems solved."

Read more of this story at Slashdot.

New Attack Tool Exploits SSL Renegotiation Bug

Posted: October 26th, 2011, 6:01am CEST by Soulskill

Tags: encryption

Trailrunner7 writes "A group of researchers has released a tool that they say implements a denial-of-service attack against SSL servers by triggering a huge number of SSL renegotiations, eventually consuming all of the server's resources and making it unavailable. The tool exploits a widely known issue with the way that SSL connections work. The attack tool, released by a group called The Hacker's Choice, is meant to exploit the fact that it takes a lot of server resources to handle SSL handshakes at the beginning of a session, and that if a client or series of clients sends enough session requests to a given server, the server will at some point fail. The condition can be worsened when SSL renegotiation is enabled on a server. SSL renegotiation is used in a number of scenarios, but most commonly when there is a need for a client-side certificate. The authors of the tool say that the attack will work on servers without SSL renegotiation enabled, but with some modifications."

Read more of this story at Slashdot.

Hackers Break Browser SSL/TLS Encryption

Posted: September 20th, 2011, 9:17pm CEST by Unknown Lamer

Tags: encryption

First time accepted submitter CaVp writes with an article in The Register about an exploit that appears to affect all browsers and can decrypt an active TLS session. From the article: "Researchers have discovered a serious weakness in virtually all websites protected by the secure sockets layer protocol that allows attackers to silently decrypt data that's passing between a webserver and an end-user browser." A full disclosure is scheduled for Friday September 23rd at the Ekoparty conference. Note that this only affects SSL 2.0 and TLS 1.0; unfortunately, most web servers are misconfigured to still accept SSL 2.0, and TLS 1.1 and 1.2 have seen limited deployment. The practicality of the attack remains to be determined (for one, it isn't very fast — but if the intent is just to decrypt the data for later use, that isn't an impediment).

Read more of this story at Slashdot.

The Guardian and the Wikileaks Encryption Key

Posted: September 3rd, 2011, 12:50am CEST by timothy

Tags: encryption

rtfa-troll writes "Bruce Schneier has a good article explaining how the Guardian released the encryption key for the WikiLeaks cables and destroyed the main protection against the release of informers' personal information. The comments in Schneier's blog fill in details of how exactly WikiLeaks' secondary file security protections were also bypassed. Now the Guardian has an article that Assange risks arrest by Australia over the latest leaks, which include information about an Australian intelligence officer. They even say, 'We deplore the decision of WikiLeaks to publish the unredacted state department cables, which may put sources at risk,' and go on to state that 'The decision to publish by Julian Assange was his, and his alone,' something which seems clearly debunked in the analysis on Schneier's blog."

Read more of this story at Slashdot.

Pakistan Bans Encryption

Posted: August 31st, 2011, 12:44am CEST by Soulskill

Tags: encryption

An anonymous reader writes "After some rumors of this last month, Pakistan has now officially told all of the country's ISPs that they need to block all encrypted VPNs since content running over such services cannot be monitored by the government."

Read more of this story at Slashdot.

Twitter Turns On SSL Encryption For Some Users

Posted: August 25th, 2011, 10:02pm CEST by timothy

Tags: encryption

JohnBert writes with this news from ComputerWorld, which reports that "Twitter is slowly turning on automatic encryption on its website, a move following other major providers of web-based services to thwart account hijacking over wireless networks. Twitter has offered an option for users to turn on SSL (Secure Sockets Layer) encryption, but said on Tuesday that it will turn the feature on by default for some users. It did not indicate when the option would be turned on by default for all users."

Read more of this story at Slashdot.

Feds' Radios Have Significant Security Flaws

Posted: August 11th, 2011, 1:01am CEST by samzenpus

Tags: encryption

OverTheGeicoE writes "The Wall Street Journal has a story describing how the portable radios used by many federal law enforcement agents have major security flaws that allow for easy eavesdropping and jamming. Details are in a new study being released today (PDF). The authors of the study were able to intercept hundreds of hours of sensitive traffic inadvertently sent without encryption over the past two years. They also describe how a texting toy targeted at teenage girls can be modified to jam transmissions from the affected radios, either encrypted or not."

Read more of this story at Slashdot.

Pakistan Tries To Ban Encryption

Posted: July 30th, 2011, 1:34am CEST by timothy

Tags: encryption

An anonymous reader writes "Pakistan has a new Telecoms Law going into effect, which requires widespread monitoring of internet usage. In response, new reports are saying that the country is banning encryption, including VPNs, because it would interfere with the ability of ISPs to monitor internet usage."

Read more of this story at Slashdot.

FPGA Bitstream Security Broken

Posted: July 21st, 2011, 8:18pm CEST by timothy

Tags: encryption

NumberField writes "Researchers in Germany released a pair of papers documenting severe power analysis vulnerabilities in the bitstream encryption of multiple Xilinx FPGAs. The problem exposes products using FPGAs to cloning, hardware Trojan insertion, and reverse engineering. Unfortunately, there is no easy downloadable fix, as hardware changes are required. These papers are also a reminder that differential power analysis (DPA) remains a potent threat to unprotected hardware devices. On the FPGA front, only Actel seems to be tackling the DPA issue so far, although their FPGAs are much smaller than Xilinx's."

Read more of this story at Slashdot.

17% Smaller DES S-box Circuits Found

Posted: July 1st, 2011, 8:35pm CEST by Soulskill

Tags: encryption

solardiz writes "DES is still in use, brute-force key search remains the most effective attack on it, and it is an attractive building block for certain applications (the key size may be increased e.g. with 3DES). Openwall researchers, with funding from Rapid7, came up with 17% shorter Boolean expressions representing the DES S-boxes. Openwall's John the Ripper 1.7.8 tests over 20 million combinations against DES-based crypt(3) per second on a Core i7-2600K 3.4 GHz, which roughly corresponds to a DES encryption speed of 33 Gbps."

Read more of this story at Slashdot.

SSL/TLS Vulnerability Widely Unpatched

Posted: June 20th, 2011, 9:46pm CEST by Soulskill

Tags: encryption

kaiengert writes "In November 2009 a Man-In-the-Middle vulnerability for SSL/TLS/https was made public (CVE-2009-3555), and shortly afterwards demonstrated to be exploitable. In February 2010 researchers published RFC 5746, which described how servers and clients can be made immune. Software that implements the TLS protocol enhancements became available shortly afterwards. Most modern web browsers are patched, but the solution requires that both browser developers and website operators take action. Unfortunately, 16 months later, many major websites, including several ones that deal with real world transactions of goods and money, still haven't upgraded their systems. Even worse, for a big portion of those sites it can be shown that their operators failed to apply the essential configuration hotfix. Here is an exemplary list of patched and unpatched sites, along with more background information. The patched sites demonstrate that patching is indeed possible."

Read more of this story at Slashdot.

Brute-Force Password Cracking With GPUs

Posted: June 20th, 2011, 8:25pm CEST by Soulskill

Tags: encryption

An anonymous reader writes "We all know that brute-force attacks with a CPU are slow, but GPUs are another story. Tom's Hardware has an interesting article up on WinZip and WinRAR encryption strength, where they attempt to crack passwords with Nvidia and AMD graphic cards. Some of their results are really fast — in the billions of passwords per second — and that's only with two GTX 570s!"

Read more of this story at Slashdot.

First Exploit On Quantum Cryptography Confirmed

Posted: June 18th, 2011, 6:05pm CEST by Soulskill

Tags: encryption

Vadim Makarov writes "Physics World reports on researchers demonstrating a full eavesdropper on a quantum key distribution link. Unlike conventional exploits for security vulnerabilities that are often just a piece of software, spying on quantum cryptography required a box full of optics and mixed-signal electronics. Details are published in Nature Communications, and as a free preprint. The vulnerability was known before, but this is the first actual working exploit with secret-key recording confirmed. Patching this loophole is in progress. Disclosure: I am one of the researchers who worked on this."

Read more of this story at Slashdot.

Ask Slashdot: Tools For Linux Disk Encryption and Integrity?

Posted: June 16th, 2011, 10:50pm CEST by timothy

Tags: encryption

An anonymous reader writes "I have been using Gentoo Linux for a long time now and have always been satisfied with one of its many disk encryption tools: cryptsetup (dm-crypt and LUKS). However, I recently gave FreeBSD a try and, although I concluded BSD is not for me, I was amazed at geli(8), FreeBSD's disk encryption tool. It happens this tool also provides what it calls an 'authentication mode.' Besides encrypting the disk sector-by-sector, it also stores checksums (sha256 in my case) in it on every write. On reads, if the checksum mismatchs, it propagates the error up, resulting in, say, a read() error. Thus I do not have to trust my disk (except of course for the boot partition) any longer: any data inconsistency will be detected before the data is used. Having searched for a long time without answers, I want to ask: is there something similar to this in Linux? Note: Using Btrfs is a valid solution, but is far from stable (got a few oopses during my tests)."

Read more of this story at Slashdot.

Ask Slashdot: Tools For Linux Disk Encryption and Integrity?

Posted: June 16th, 2011, 10:50pm CEST by timothy

Tags: encryption

Read more of this story at Slashdot.

Ask Slashdot: Is SHA-512 the Way To Go?

Posted: June 5th, 2011, 5:29am CEST by Soulskill

Tags: encryption

crutchy writes "When I was setting up my secure website I got really paranoid about SSL encryption, so I created a certificate using OpenSSL for SHA-512 encryption. I don't know much about SHA (except bits that I can remember from Wikipedia), but I figure that if you're going to go to the trouble (or expense) of setting up SSL, you may as well go for the best you can get, right? Also, what would be the minimum level of encryption required for, say, online banking? I've read about how SHA-1 was 'broken', but from what I can tell it still takes many hours. What is the practical risk to the real internet from this capability? Would a sort of rolling key be a possible next step, where each SSL-encrypted stream has its own private/public key pair generated on the fly, and things like passwords and bank account numbers were broken up and sent in multiple streams with different private/public key pairs? This would of course require more server grunt to generate these keys (or we could take a leaf from Google's book and just have separate server clusters designed solely for that job), but then if computing performance was a limiting factor, the threat to security of these hashes wouldn't be a problem in the first place." (Continued below.)

Read more of this story at Slashdot.

The Machines That Sparked the Beginning of the Computer Age

Posted: May 31st, 2011, 3:44am CEST by samzenpus

Tags: encryption

jjp9999 writes "A war of spies and electromechanical machines that took place beneath the wires during World War II not only played a crucial role in the Allies' victory, but also helped spark the beginning of the computer age. Among the devices was the Enigma, a cipher capable of producing 150,000,000,000,000,000,000 possible code combinations, and a hulking machine, the Colossus, the first programmable electronic computer, capable of decoding the Enigma."

Read more of this story at Slashdot.

OpenSSL Timing Attack Can Intercept Private Keys

Posted: May 28th, 2011, 12:20am CEST by Unknown Lamer

Tags: encryption

Trailrunner7 writes "Remote timing attacks have been a problem for cryptosystems for more than 20 years. A new paper shows that such attacks are still practical ... The researchers, Billy Bob Brumley and Nicola Tuveri of Aalto University School of Science, focused their efforts on OpenSSL's implementation of the elliptic curve digital signature algorithm, and they were able to develop an attack that allowed them to steal the private key of an OpenSSL server."

Read more of this story at Slashdot.

Tunny Code-Breaker Rebuilt At Bletchley Park

Posted: May 26th, 2011, 7:41pm CEST by timothy

Tags: encryption

Jack Spine writes "Engineers at the National Museum of Computing at Bletchley Park have rebuilt the Tunny machine, a key device used in decoding German High Command messages during the Second World War. The Tunny machine took a team of three people three years to rebuild. At the end of the war, Tunny machines were broken up and the components recycled, while the original circuit diagrams were destroyed or hidden. The team had to piece together plans for the machine from odd pieces of circuit diagram that had been squirreled away by engineers, as well as from the recollections of some of the original builders."

Read more of this story at Slashdot.

Nikon's Image Authentication Insecure

Posted: April 28th, 2011, 11:30pm CEST by timothy

Tags: encryption

silanea writes "Elcomsoft claims to have broken Nikon's Image Authentication system which — apparently only in theory — ensures that a photograph is authentic and not tampered with through a digital signature. They were able to extract the signing key from a camera and use it to have a modified image pass the software verification, rendering the rather expensive feature mostly marketed to law enforcement all but useless. So far Nikon has not given a statement. Canon's competing system was cracked by the same company last December."

Read more of this story at Slashdot.

Apple AirPlay Private Key Exposed

Posted: April 11th, 2011, 3:38pm CEST by CmdrTaco

Tags: encryption

An anonymous reader writes "James Laird has reverse engineered the Airport Express private key and published an open source AirPort Express emulator. 'My girlfriend moved house, and her Airport Express no longer made it with her wireless access point. I figured it'd be easy to find an ApEx emulator — there are several open source apps out there to play to them. However, I was disappointed to find that Apple used a public-key crypto scheme, and there's a private key hiding inside the ApEx. So I took it apart (I still have scars from opening the glued case!), dumped the ROM, and reverse engineered the keys out of it.'"

Read more of this story at Slashdot.

KGB Wants Control of Email and VOIP

Posted: April 8th, 2011, 10:29pm CEST by Soulskill

Tags: encryption

blair1q writes "The FSB (really just a rebadged KGB) is worried about the abilities that internet communications services such as Hotmail, Gmail, and Skype give to people they consider black-hats. In particular, they don't like the fact that these services allow encryption. They say they aren't going to seize or block them, yet, but are just 'studying' the situation, with an eye possibly toward implementing controls like those in China. Their increased interest in the tools may be related to a DDoS attack on Russian President Dmitri Medvedev's own LiveJournal account, which he termed 'revolting and illegal.'"

Read more of this story at Slashdot.

Comodo Says Two More RAs Compromised

Posted: March 30th, 2011, 3:35pm CEST by CmdrTaco

Tags: encryption

Trailrunner7 writes "Officials at Comodo have acknowledged that an additional two registration authorities affiliated with the company have been compromised in the wake of the high-profile attack on the company that was disclosed last week. Addressing a list of concerns about Comodo's practices raised by customers and browser vendors in the wake of the attack, Alden said that the company is now in the process of rolling out a new two-factor authentication system for its RAs. Comodo also is installing other security measures as a result of the attack."

Read more of this story at Slashdot.

Physicists Develop Quantum Public Key Encryption

Posted: March 16th, 2011, 3:22pm CET by CmdrTaco

Tags: encryption

KentuckyFC writes "Public key cryptography allows anybody to encrypt a message using a public key but only those with another private key can decrypt the message. That's possible because of certain mathematical functions that are easy to perform in one direction but hard to do in reverse. The most famous example is multiplication. It's easy to multiply two numbers together to get a third but hard to start with the third number and work out its factors. Now Japanese researchers have discovered a quantum problem that is hard to solve in one direction but easy to do in reverse. This asymmetry, they say, could form the basis of a new kind of quantum public key cryptography. Their system is based on the problem of distinguishing between two ensembles of quantum states. This is similar to the problem of determining whether two graphs are identical, ie whether they correspond vertex-for-vertex and edge-for-edge. Increasing the complexity of the graph can always make this problem practically impossible for a quantum computer to solve in a reasonable time. But knowing the structure of a subset of the graph makes this problem easy, so this acts as a kind of private key for decrypting messages."

Read more of this story at Slashdot.

New SHA Functions Boost Crypto On 64-bit Chips

Posted: February 18th, 2011, 11:24pm CET by Soulskill

Tags: encryption

An anonymous reader writes "The National Institute of Standards and Technology, guardian of America's cryptography standards, has announced a new extension to the SHA-2 hashing algorithm family that promises to boost performance on modern chips. Announced this week, two new standards — SHA-512/224 and SHA-512/256 — have been created to directly replace the SHA-224 and SHA-256 standards. They take advantage of the speed improvements inherent in SHA-512 on 64-bit processors to produce checksums more rapidly than their predecessors — but truncate them at a shorter length, reducing the overall timespan and complexity of the digest." Further details are available from NIST (PDF).

Read more of this story at Slashdot.

Encrypting Phone Storage and Transmission? (2011 Version)

Posted: February 17th, 2011, 10:46pm CET by timothy

Tags: encryption

An anonymous reader writes "Soon I'll be moving to one of the hot, culturally restrictive countries which has recently been in the news ... and which monitors and filters web traffic. ISPs and cellular providers are both owned by the government. Needless to say, I'm concerned about privacy and am even posting to my fellow Slashdotters as an anonymous coward. Which smart phones are the best for a) encrypted storage, and b) encrypted transmission? I'm not worried about encrypting SMSs or traditional voice traffic, but I would like all IP traffic as secure as possible. Setting up a server in my less restrictive home country is an option. What storage encryption and transmission encryption would you recommend for that situation? I'm willing to buy yet another device, if necessary. (No, I won't get a SatPhone.) I currently have a Nokia N900 running Maemo5 and another device running Symbian S60v3. I was hoping to have a secure OS like BackTrack running on the N900, but it looks like the software was never totally ported for the device."

Read more of this story at Slashdot.

Sony Marketing Man Tweets PS3 Master Key

Posted: February 9th, 2011, 4:10pm CET by CmdrTaco

Tags: encryption

An anonymous reader writes "Sony Marketing Man, Kevin Butler's official Twitter feed retweets a post by @exiva that posts the PS3 Master key. Kevin Butler who has over 69,000 followers tweet read (The tweet now deleted): '@TheKevinButler Lemme guess... you sank my Battleship? RT @exiva: 46 DC EA D3 17 FE 45 D8 09 23 EB 97 E4 95 64 10 D4 CD B2 C2 Come at me, @TheKevinButler'" Here is a screenshot of the tweet.

Read more of this story at Slashdot.

Sony Wins Restraining Order Against Geohot

Posted: January 27th, 2011, 11:13pm CET by timothy

Tags: encryption

tekgoblin writes "The courts have just issued a temporary restraining order against George Hotz (Geohot). Sony filed this lawsuit because they were unhappy that Geohot had released the Playstation 3 decryption keys so other people could play unsigned games on it. [Geohot is prohibited from] 'offering to the public, creating, posting online, marketing, advertising, promoting, installing, distributing, providing, or otherwise trafficking' in any software or methods for circumventing the PS3's protection methods. No longer can he 'provide links from any website to any other website' relating to such matters, or publish any information obtained by hacking the PS3. And more to the point, he can no longer 'engage in acts of circumvention of TPMS in the PS3 System to access, obtain, remove, or traffic in copyrighted works.' Pretty much he can't talk or think about the PS3 for some time."

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2011/01/19/Encrypt_Your_Smartphone__mdash__Or_Else'

Encrypt Your Smartphone — Or Else

Posted: January 19th, 2011, 2:20am CET by timothy

Tags: encryption

pin0chet writes "Modern smartphones contain ever-increasing volumes of our private personal data — from text messages to images to emails — yet many smartphone security features can easily be circumvented by thieves or police officers equipped with off-the-shelf forensics equipment. Worse, thanks to a recent California Supreme Court ruling, police officers may be able to search your smartphone for hours without a warrant if you're arrested for any reason. Ars Technica has an article exploring the legal issues surrounding cell phone searches and explaining how you can safeguard your smartphone from the prying eyes of law enforcement officers."

Read more of this story at Slashdot.

Why Sony Cannot Stop PS3 Pirates

Posted: January 14th, 2011, 12:29pm CET by Soulskill

Tags: encryption

Sam writes "A former Ubisoft exec believes that Sony will not be able to combat piracy on the PlayStation 3, which was recently hacked. Martin Walfisz, former CEO of Ubisoft subsidiary Ubisoft Massive, was a key player in developing Ubisoft's new DRM technologies. Since playing pirated games doesn't require a modchip, his argument is that Sony won't be able to easily detect hacked consoles. Sony's only possible solution is to revise the PS3 hardware itself, which would be a very costly process. Changing the hardware could possibly work for new console sales, though there would be the problem of backwards compatibility with the already-released games. Furthermore, current users would still be able to run pirated copies on current hardware." An anonymous reader adds commentary from PS3 hacker Mathieu Hervais about Sony's legal posturing.

Read more of this story at Slashdot.

PS3 Root Key Found

Posted: January 3rd, 2011, 8:40pm CET by Soulskill

Tags: encryption

An anonymous reader writes "The PlayStation 3 'root key' used for code signing has been found by GeoHot. This enables running homebrew without the need for psjailbreak-style USB-devices, and also provides hope for those at firmware version 3.55 that currently cannot be downgraded. The key also cannot be changed without hardware modifications. Oops."

Read more of this story at Slashdot.

Database of Private SSL Keys Published

Posted: December 20th, 2010, 3:53pm CET by CmdrTaco

Tags: encryption

Trailrunner7 writes "A new project has produced a large and growing list of the private SSL keys that are hard-coded into many embedded devices, such as consumer home routers. The LittleBlackBox Project comprises a list of more than 2,000 private keys right now, each of which can be associated with the public key of a given router, making it a simple matter for an attacker to decrypt the traffic passing through the device. Published by a group called /dev/ttyS0, the LittleBlackBox database of private keys gives users the ability to find the key for a specific router in several different ways, including by searching for a known public key, looking up a device's model name, manufacturer or firmware version or even giving it a network capture, from which the program will extract the device's public certificate and then find the associated private SSL key."

Read more of this story at Slashdot.

The Clock Is Ticking On Encryption

Posted: December 18th, 2010, 2:14pm CET by timothy

Tags: encryption

CWmike writes "In the indictment that led to the expulsion of ten Russian spies from the US in the summer of 2010, the FBI said that it gained access to their communications after surreptitiously entering one of the spies' homes, during which agents found a piece of paper with a 27-character password. The FBI had found it more productive to burglarize a house than to crack a 216-bit code, despite having the computational resources of the US government behind it, writes Lamont Wood. That's because modern cryptography, when used correctly, is rock solid. Cracking an encrypted message can require time frames that dwarf the age of the universe. That's the case today. 'The entire commercial world runs off the assumption that encryption is rock solid and is not breakable,' says Joe Moorcones, vice president of information security firm SafeNet. But within the foreseeable future, cracking those same codes could become trivial, thanks to quantum computing."

Read more of this story at Slashdot.

FBI Alleged To Have Backdoored OpenBSD's IPSEC Stack

Posted: December 15th, 2010, 1:36am CET by kdawson

Tags: encryption

Aggrajag and Mortimer.CA, among others, wrote to inform us that Theo de Raadt has made public an email sent to him by Gregory Perry, who worked on the OpenBSD crypto framework a decade ago. The claim is that the FBI paid contractors to insert backdoors into OpenBSD's IPSEC stack. Mr. Perry is coming forward now that his NDA with the FBI has expired. The code was originally added ten years ago, and over that time has changed quite a bit, "so it is unclear what the true impact of these allegations are" says Mr. de Raadt. He added: "Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products." (Freeswan and Openswan are not based on this code.)

Read more of this story at Slashdot.

SHA-3 Finalist Candidates Known

Posted: December 11th, 2010, 1:58am CET by timothy

Tags: encryption

Skuto writes "NIST just announced the final selection of algorithms in the SHA-3 hash competition. The algorithms that are candidates to replace SHA-2 are BLAKE, Grøstl, JH, Keccak and Skein. The selection criteria included performance in software and hardware, hardware implementation size, best known attacks and being different enough from the other candidates. Curiously, some of the faster algorithms were eliminated as they were felt to be 'too fast to be true.' A full report with the (non-)selection rationale for each candidate is forthcoming."

Read more of this story at Slashdot.

SSL Certificates For Intranet Sites?

Posted: November 23rd, 2010, 4:31pm CET by kdawson

Tags: encryption

wiedzmin writes "Anybody who has worked around anything dubbed an 'appliance' in the past few years knows that they come with a management Web interface, which is usually 'secure.' However, no company in their right (accounting) mind will spend $400/year per appliance to buy Verisign SSL certificates to secure Web interfaces on networks that may not even be open to the public Internet. So network administrators, and sometimes end users, are stuck clicking away at an annoying 'Continue to this website (not recommended)' message every time they connect, setting an unhealthy precedent when it comes to the actual security of SSL and the much-hyped MITM attacks. So the question I have for the Slashdot crowd is: do you have valid SSL certificates on your intranet sites, and if so what do you use? Any cost-neutral, or at least cost-conscious solutions out there that don't involve manually distributing your certificates and CRL to every workstation in the company? Thanks."

Read more of this story at Slashdot.

Sculptor Gives a Hint For CIA's Kryptos

Posted: November 21st, 2010, 1:59am CET by timothy

Tags: encryption

omega_cubed writes "The New York Times reports that Jim Sanborn, the sculptor who created the wavy metal pane called Kryptos that sits in front of the CIA in Langley, VA, has gotten tired of waiting for code-breakers to decode the last of the four messages. 'I assumed the code would be cracked in a fairly short time,' [Sanborn] said, adding that the intrusions on his life from people who think they have solved his fourth puzzle are more than he expected. So now, after 20 years, Mr. Sanborn is nudging the process along. He has provided The New York Times with the answers to six letters in the sculpture's final passage. The characters that are the 64th through 69th in the final series on the sculpture read NYPVTT. When deciphered, they read BERLIN."

Read more of this story at Slashdot.

For 18 Minutes, 15% of the Internet Routed Through China

Posted: November 16th, 2010, 8:24pm CET by CmdrTaco

Tags: encryption

olsmeister writes "For 18 minutes this past April, 15% of the world's internet traffic was routed through servers in China. This includes traffic from both .gov and .mil US TLDs." The crazy thing is that this happened months ago, and nobody noticed. Hope you're encrypting your super-secret stuff.

Read more of this story at Slashdot.

Sophos Researcher Suggests Password 'Free' to Spur Wi-Fi Encryption

Posted: November 10th, 2010, 6:30am CET by timothy

Tags: encryption

An anonymous reader writes "In the wake of concerns about FireSheep sniffing credentials from people using unencrypted public WiFi hotspots, a security researcher has proposed that the problem does not just lie with big websites like Facebook, but also with those who provide free wireless internet access. Chet Wisniewski, a researcher at security firm Sophos, proposes that all free WiFi hotspots should be encrypted — with the password 'free.' ''I propose standard adoption of WPA2 and a default password of "free." Whenever you wish to connect to complimentary WiFi, you select "Courtyard Marriott" or "Starbucks" like you always have, but you are then prompted for a password. Just type "free". It's not hard. In fact, operating system vendors could even program your PC to automatically try the password "free" before prompting you for a password on the assumption that you might be selecting a free service.'"

Read more of this story at Slashdot.

Firesheep Author Reflects On Wild Week

Posted: November 2nd, 2010, 9:25pm CET by Soulskill

Tags: encryption

alphadogg writes "Firesheep, the Mozilla Firefox add-on released about a week ago that lets you spot users on open networks visiting unsecured websites, has given creator Eric Butler more than his 15 minutes of fame. More than 542,000 downloads later, Firesheep has thrown Butler into the middle of heated discussions regarding everything from the ethics of releasing the code to the legality of using it to the need for website vendors to clean up their security acts. Butler, who describes himself as a freelance Web application and software developer, reflects on the past week's happenings in a new blog post that reads in part: 'I've received hundreds of messages from people who are extremely happy that the issue of website security is receiving attention. Some, however, have questioned if Firesheep is legal to use. I'd like to be clear about this: It is nobody's business telling you what software you can or cannot run on your own computer. Like any tool, Firesheep can be used for many things. In addition to raising awareness, it has already proven very useful for people who want to test their own security as well as the security of their (consenting) friends. A much more appropriate question is: "Is it legal to access someone else's accounts without their permission."'"

Read more of this story at Slashdot.

Separating Cyber-Warfare Fact From Fantasy

Posted: October 29th, 2010, 2:04pm CEST by timothy

Tags: encryption

smellsofbikes writes "This week's New Yorker magazine has an investigative essay by Seymour Hersh about the US and its part in cyber-warfare that makes for interesting reading. Hersh talks about the financial incentives behind many of the people currently pushing for increased US spending on supposed solutions to network vulnerabilities and the fine and largely ignored distinction between espionage and warfare. Two quotes in particular stood out: one interviewee said, 'Current Chinese officials have told me that [they're] not going to attack Wall street, because [they] basically own it,' and Whitfield Diffie, on encryption, 'I'm not convinced that lack of encryption is the primary problem [of vulnerability to network attack]. The problem with the Internet is that it's meant for communication among non-friends.' The article also has some interesting details on the Chinese disassembly and reverse-engineering of a Lockheed P-3 Orion filled with espionage and eavesdropping hardware that was forced to land in China after a midair collision."

Read more of this story at Slashdot.

Bicycle Thief Barred From Using Encryption

Posted: October 21st, 2010, 7:40pm CEST by timothy

Tags: encryption

An anonymous reader writes "A teenager found in possession of a stolen bicycle was given probation, with a whole bunch of computer-related restrictions. He wasn't allowed to use social networks or instant messaging. He wasn't allowed to use a computer that had 'encryption, hacking, cracking, scanning, keystroke monitoring, security testing, steganography, Trojan or virus software.' The kid appealed, noting that the restrictions on social networking seemed overly broad, and restricting him from using a computer with a virus was difficult since viruses and trojans and the like tend to try to stay hidden, so he might not know. While the court overturned the restrictions on social networking, and changed the terms of computer restrictions to include the word 'knowingly,' it did keep the restriction on against using any computer with encryption software. Remember, this isn't someone convicted of malicious computer crimes, but of receiving a stolen bicycle. So why is perfectly reasonable encryption software not allowed? And what computer these days doesn't have encryption software?"

Read more of this story at Slashdot.

The Encryption Pioneer Who Was Written Out of History

Posted: October 7th, 2010, 10:53am CEST by samzenpus

Tags: encryption

nk497 writes "Clifford Cocks is one of three British men who developed an encryption system while working for the UK government in the early 1970s, but was forced to keep the innovation quiet for national security reasons. Just a few years later, their Public Encryption Key was developed separately by US researchers at Stanford and MIT, and eventually evolved into the RSA encryption algorithm, which now secures billions of transactions on the internet every day. 'The first I knew about [the US discovery] was when I read about it in Scientific American. I opened it one lunchtime and saw a description and thought, "Ah, that's what we did,"' he said. 'You don't go into the business to get external credit and recognition — quite the opposite. Quite honestly, the main reaction was one of complete surprise that this had actually been discovered outside.' The UK trio have now won recognition for their accomplishment in the form of the Milestone Award from the Institute of Electrical and Electronics Engineers."

Read more of this story at Slashdot.

British Teen Jailed Over Encryption Password

Posted: October 6th, 2010, 12:27am CEST by CmdrTaco

Tags: encryption

An anonymous reader writes "Oliver Drage, 19, of Liverpool has been convicted of 'failing to disclose an encryption key,' which is an offense under the Regulation of Investigatory Powers Act 2000 and as a result has been jailed for 16 weeks. Police seized his computer but could not get past the 50-character encrypted password that he refused to give up. And just to get it out of the way, obligatory XKCD."

Read more of this story at Slashdot.

BlackBerry's Encryption Hacked; Backups Now a Risk

Posted: October 1st, 2010, 6:51pm CEST by Soulskill

Tags: encryption

GMGruman writes "InfoWorld blogger Martin Heller reveals that a Russian passcode-breaker developer has broken the encryption used in BlackBerry backups. That can help recover data when passwords are lost, but also gives data thieves access to a treasure trove of corporate secrets. And the developer boasts that it was easier to crack the BlackBerry encryption than it was to crack Apple's iOS."

Read more of this story at Slashdot.

US Gov't Assisted Iranian Gov't Mobile Wiretaps

Posted: September 28th, 2010, 10:27pm CEST by CmdrTaco

Tags: encryption

bdsesq sent in a story on Ars Technica highlighting how the US government's drive for security back doors has enabled the Iranian government to spy on its citizens. "For instance, TKTK was lambasted last year for selling telecom equipment to Iran that included the ability to wiretap mobile phones at will. Lost in that uproar was the fact that sophisticated wiretapping capabilities became standard issue for technology thanks to the US government's CALEA rules that require all phone systems, and now broadband systems, to include these capabilities."

Read more of this story at Slashdot.

Intel Threatens DMCA Using HDCP Crack

Posted: September 20th, 2010, 4:17pm CEST by CmdrTaco

Tags: encryption

mikesd81 writes "Intel is apparently threatening to use the DMCA against anyone using the HDCP crack under the DMCA's anti-circumvention clause. 'There are laws to protect both the intellectual property involved as well as the content that is created and owned by the content providers,' said Tom Waldrop, a spokesman for the company, which developed HDCP. 'Should a circumvention device be created using this information, we and others would avail ourselves, as appropriate, of those remedies.'"

Read more of this story at Slashdot.

Intel Threatens DMCA Using HDCP Crack

Posted: September 20th, 2010, 4:17pm CEST by CmdrTaco

Tags: encryption

Read more of this story at Slashdot.

New Crypto Attack Affects Millions of ASP.NET Apps

Posted: September 13th, 2010, 6:47pm CEST by CmdrTaco

Tags: encryption

Trailrunner7 writes "A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users' online banking sessions and cause other severe problems in vulnerable applications. Experts say that the bug, which will be discussed in detail at the Ekoparty conference in Argentina this week, affects millions of Web applications."

Read more of this story at Slashdot.

Hackers Eavesdrop On Quantum Crypto With Lasers

Posted: August 30th, 2010, 10:52am CEST by timothy

Tags: encryption

Martin Hellman writes "According to an article in Nature magazine, quantum hackers have performed the first 'invisible' attack on two commercial quantum cryptographic systems. By using lasers on the systems — which use quantum states of light to encrypt information for transmission —' they have fully cracked their encryption keys, yet left no trace of the hack.'"

Read more of this story at Slashdot.

UVB-76 Explained

Posted: August 26th, 2010, 5:56pm CEST by CmdrTaco

Tags: encryption

Useful Wheat writes "Recently slashdot covered the reappearance of UVB-76. The function of the mysterious transmitter has been revealed: UVB-76 is used to transfer orders to military personnel, along with the time at which they should be executed. 'Words for the radio messages and code tables are selected mainly from the scientific terms of chemistry (Brohman), Geology (ganomatit), philology (Izafat), geography (Bong), Zoology (kariama), history (Scythian), cooking (drying), sports (krolist) and others, as well as rare Russian words (glashatel).' The page continues to list all 23 transmissions that have been made from the station in the past, showing that UVB-76 may be more active than believed."

Read more of this story at Slashdot.

NSA and the National Cryptologic Museum

Posted: August 5th, 2010, 3:35pm CEST by CmdrTaco

Tags: encryption

Schneier writes "Most people might not be aware of it, but there's a National Cryptologic Museum at Ft. Meade, at NSA Headquarters. It's hard to know its exact relationship with the NSA. Is it part of the NSA, or is it a separate organization? Can the NSA reclassify things in its archives?" There's some interesting stuff in the comments about the building's reason for existence (window views a nearby NSA building?) and some stuff they have (an Enigma machine!).

Read more of this story at Slashdot.

Bitcoin Releases Version 0.3

Posted: July 11th, 2010, 11:09pm CEST by kdawson

Tags: encryption

Teppy writes "How's this for a disruptive technology? Bitcoin is a peer-to-peer, network-based digital currency with no central bank, and no transaction fees. Using a proof-of-work concept, nodes burn CPU cycles searching for bundles of coins, broadcasting their findings to the network. Analysis of energy usage indicates that the market value of Bitcoins is already above the value of the energy needed to generate them, indicating healthy demand. The community is hopeful the currency will remain outside the reach of any government." Here are the FAQ, a paper describing Bitcoin in more technical detail (PDF), and the Wikipedia article. Note: a commercial service called BitCoin Ltd., in pre-alpha at bitcoin.com, bears no relation to the open source digital currency.

Read more of this story at Slashdot.

Skype Encryption (Partly) Revealed

Posted: July 8th, 2010, 11:48pm CEST by timothy

Tags: encryption

TSHTF writes "Just weeks after Skype unveiled a public API for the service, a group of cryptographers led by Sean O'Neill have successfully reverse engineered the encryption used by the Skype protocol. Source code is available under a non-commercial license which details Skype's implementation of the RC4 cipher." The linked article cautions, however, that "initial analysis suggests that O'Neill's publication does not mean that Skype's encryption can be considered 'cracked'. Further study will be needed to determine whether key expansion and initialisation vector generation are secure."

Read more of this story at Slashdot.

Crack the Code In US Cyber Command's Logo

Posted: July 8th, 2010, 3:33pm CEST by samzenpus

Tags: encryption

Dan writes "According to Wired: 'The US military's new Cyber Command is headquartered at Ft. Meade, Maryland, one of the military's most secretive and secure facilities. Its mission is largely opaque, even inside the armed forces. But the there's another mystery surrounding the emerging unit. It's embedded in the Cyber Command logo. On the logo's inner gold ring is a code: 9ec4c12949a4f31474f299058ce2b22a.'"

Read more of this story at Slashdot.

The Secrets of the Chaocipher Finally Revealed

Posted: July 4th, 2010, 12:01am CEST by timothy

Tags: encryption

nickpelling2 writes "In 1918, John F. Byrne invented a truly amazing cipher system, called 'The Chaocipher,' that fit inside a small cigar box, could be operated by a ten-year-old, yet produced practically unbreakable ciphertext (arguably even stronger than the Nazi Enigma machine). But now, thanks to the efforts of Chaocipher fan Moshe Rubin and the generous gift of Byrne's cryptographic effects by his daughter-in-law Pat Byrne to the National Cryptologic Museum, the secrets of the Chaocipher are finally starting to be revealed — it's a great story. To accompany Moshe Rubin's excellent textual description of the Chaocipher, I've posted a 30-second animation of the Chaocipher in action to YouTube, just in case anyone wants to see the most devious cipher of the 20th century in action (sort of)."

Read more of this story at Slashdot.

The Beginnings of Encrypted Computing In the Cloud

Posted: June 11th, 2010, 11:17pm CEST by Soulskill

Tags: encryption

eldavojohn writes "A method of computing from a 2009 paper allows the computing of data without ever decrypting it. With cloud computing on the rise, this may be the holy grail of keeping private data private in the cloud. It's called Fully Homomorphic Encryption, and if you've got the computer science/mathematics chops you can read the thesis (PDF). After reworking it and simplifying it, researchers have moved it away from being true, fully homomorphic encryption, but it is now a little closer to being ready for cloud usage. The problem is that the more operations performed on your encrypted data, the more likely it has become 'dirty' or corrupted. To combat this, Gentry developed a way to periodically clean the data by making it self-correcting. The article notes that although this isn't prepared for use in reliable systems, it is a quick jump to implementation just one year after the paper was published — earlier encryption papers would take as much as half a decade until they were implemented at all."

Read more of this story at Slashdot.

Commercial Quantum Cryptography System Hacked

Posted: May 18th, 2010, 12:14am CEST by Soulskill

Tags: encryption

KentuckyFC writes "Any proof that quantum cryptography is perfect relies on idealized assumptions that don't always hold true in the real world. One such assumption is related to the types of errors that creep into quantum messages. Alice and Bob always keep a careful eye on the level of errors in their messages because they know that Eve will introduce errors if she intercepts and reads any of the quantum bits in a message. So a high error rate is a sign that the message is being overheard. But it is impossible to get rid of errors entirely, so Alice and Bob have to tolerate a small level of error. This level is well known. Various proofs show that if the quantum bit error rate is less than 20 percent, then the message is secure. However, these proofs assume that the errors are the result of noise from the environment. Now, physicists have come up with an attack based on the realization that Alice also introduces errors when she prepares the required quantum states to send to Bob. This extra noise allows Eve to intercept some of the quantum bits, read them and then send them on, in a way that raises the error rate to only 19.7 percent. In this kind of 'intercept and resend attack,' the error rate stays below the 20 percent threshold and Alice and Bob are none the wiser, happily exchanging keys while Eve listens in unchallenged. The physicists say they have successfully used their hack on a commercial quantum cryptography system from the Geneva-based startup ID Quantique."

Read more of this story at Slashdot.

Position-Based Quantum Cryptography Proved Secure

Posted: May 13th, 2010, 8:22pm CEST by timothy

Tags: encryption

KentuckyFC writes "Physicists have developed a new kind of quantum cryptography that uses position measurements to guarantee the security of a message. The technique is based on triangulation. Alice uses several transmitters to send messages to Bob who returns them immediately at the speed of light. If the return arrives within a certain time period, Alice can be certain that Bob is where he says he is. Physicists proved a few years ago that when the messages are purely classical this method is not secure because Eve can use any number of receivers to work out where Bob is and then use this information to trick Alice. However, the same physicists have now proved that the quantum version of the same position-based scheme is perfectly secure, essentially because Eve cannot easily measure the value of any qubits in the message. Alice and Bob go on to use the qubits to exchange a cryptographic key, a one-time pad, that they use to encrypt a message. The beauty of the technique is that a message encrypted in this way can be read only by somebody at a specific location, something that governments, banks, and the military, not to mention everybody else, may find useful."

Read more of this story at Slashdot.

Recourse For Draconian Encryption Requirements?

Posted: April 30th, 2010, 5:03pm CEST by kdawson

Tags: encryption

CryoStasis writes in with this question, which likely resulted from the new Massachusetts data security law. "I work for a major hospital in the Northeast. Recently the hospital has taken it upon itself to increase its general level of computer security. As a result they now require full-disk encryption on any computer connected to their network on site. Although I think this stance is perhaps a little over-exuberant, most of these computers are machines that have been purchased with hospital funding. In the department that I work in, however, many of the employees (myself included) bring their own personal machines to work every day. For obvious reasons we're rather reluctant to allow the hospital's IT staff to attempt installation of the encryption software. Those who have allowed the installation have had major problems afterwards, on both Macs and Windows machines — ranging from severe/total data loss to frequent crashes to general slowness — which the hospital does very little to remedy. To make matters worse, the hospital is now demanding that any machine that is used to check email (via email clients or webmail directly) be encrypted, including desktop-style machines at home, which must be brought in to the IT department, as they refuse to distribute the encryption software to the employees for install. By monitoring email access they have begun harassing employees who check email from off campus, stating that their email/login access will be disabled unless they bring in their computers. I have no intention of letting these people install anything on my machine, particularly software of which their IT staff clearly doesn't have a solid grasp. Have other Slashdot readers come across this kind of a problem? Do I have any recourse, legal or otherwise, to stop them from requiring me to install software on my personal machines?"

Read more of this story at Slashdot.

Quantum Cryptography Now Fast Enough For Video

Posted: April 20th, 2010, 10:42am CEST by kdawson

Tags: encryption

cremeglace sends in news of a major advance in the speed of quantum key distribution. "Researchers at the Cambridge Lab of Toshiba Research Europe have solved the problem of transferring highly sensitive data at high speed across a long distance network. The team were able to demonstrate the continuous operation of quantum key distribution (QKD) — a system that allows the communicating users to detect if a third party is trying to eavesdrop on the data communication — at a speed greater than one megabit/sec over a 50 km fibre optic network, thanks to the use of a light detector for high bit rates and a feedback system which maintains the high bit rates during data transfer. ... The faster one megabit/sec data handling will allow the one-time pad to be used for the encryption of video — a vast step forward over the current ability to only encrypt voice data."

Read more of this story at Slashdot.

How Did Wikileaks Do It?

Posted: April 7th, 2010, 8:58pm CEST by timothy

Tags: encryption

grassy_knoll writes "Related to the Wikileaks video recently released and discussed here, the NY Times reports: 'Somehow — it will not say how — WikiLeaks found the necessary computer time to decrypt a graphic video, released Monday, of a United States Army assault in Baghdad in 2007 that left 12 people dead, including two employees of the news agency Reuters. The video has been viewed more than two million times on YouTube, and has been replayed hundreds of times in television news reports.' The article is light on details; what encryption algorithm was used? Was this a brute force attack? Did someone pass the decryption keys to Wikileaks along with the video? Something else?"

Read more of this story at Slashdot.

Government Could Forge SSL Certificates

Posted: March 26th, 2010, 3:14pm CET by Soulskill

Tags: encryption

FutureDomain writes "Is SSL becoming pointless? Researchers are poking holes in the chain of trust for SSL certificates which protect sensitive data. According to these hypothesized attacks, governments could compel certificate authorities to give them phony certificates that are signed by the CA, which are then used to perform man in the middle attacks. They point out that Verisign already makes large sums of money by facilitating the disclosure of US consumers' private data to US government law enforcement. The researchers are developing a Firefox plugin (PDF) that checks past certificates and warns of anomalies in the issuing country, but not much can help if government starts spying on the secure connections of its own citizens."

Read more of this story at Slashdot.

OpenSSH 5.4 Released

Posted: March 10th, 2010, 9:40pm CET by timothy

Tags: encryption

HipToday writes "As posted on the OpenBSD Journal, OpenSSH 5.4 has been released: 'Some highlights of this release are the disabling of protocol 1 by default, certificate authentication, a new "netcat mode," many changes on the sftp front (both client and server) and a collection of assorted bugfixes. The new release can already be found on a large number of mirrors and of course on www.openssh.com.'"

Read more of this story at Slashdot.

NSA Still Ahead In Crypto, But Not By Much

Posted: March 9th, 2010, 8:22am CET by kdawson

Tags: encryption

Hugh Pickens writes "Network World summarizes an RSA Conference panel discussion in which former NSA technical director Brian Snow said that cryptographers for the NSA have been losing ground to their counterparts in universities and commercial security vendors for 20 years, but still maintain the upper hand in the sophistication of their crypto schemes and in their ability to decrypt. 'I do believe NSA is still ahead, but not by much — a handful of years,' says Snow. 'I think we've got the edge still.' Snow added that that in the 1980s there was a huge gap between what the NSA could do and what commercial encryption technology was capable of. 'Now we are very close together and moving very slowly forward in a mature field.' The NSA has one key advantage (besides their deep staff of Ph.D. mathematicians and other cryptographic experts who work on securing traffic and breaking codes): 'We cheat. We get to read what [academics] publish. We do not publish what we research,' he said. Snow's claim of NSA superiority seemed to rankle some members on the panel. Adi Shamir, the "S" in the RSA encryption algorithm, said that when the titles of papers in NSA technical journals were declassified up to 1983, none of them included public key encryption; 'That demonstrates that NSA was behind,' said Shamir. Snow replied that when technologies are developed separately in parallel, the developers don't necessarily use the same terms for them."

Read more of this story at Slashdot.

Theoretical Breakthrough For Quantum Cryptography

Posted: March 8th, 2010, 4:23pm CET by Soulskill

Tags: encryption

KentuckyFC writes "Quantum cryptography uses the quantum properties of photons to guarantee perfect secrecy. But one of its lesser known limitations is that it only works if Alice and Bob are perfectly aligned so that they can carry out well-defined polarization measurements on the photons as they arrive. Physicists say that Alice and Bob must share the same reference frame. That's OK if Alice and Bob are in their own ground-based labs, but it's a problem in many other applications, such as ground-to-satellite communications or even in chip-to-chip communications, because it's hard to keep chips still over distances of the order of the wavelength of light. Now a group of UK physicists have developed a way of doing quantum cryptography without sharing a reference frame. The trick is to use entangled triplets of photons, so-called qutrits, rather than entangled pairs. This solves the problem by embedding it in an extra abstract dimension, which is independent of space. So, as long as both Alice and Bob know the way in which all these abstract dimensions are related, the third provides a reference against which measurements of the other two can be made. That allows Alice and Bob to make any measurements they need without having to agree ahead of time on a frame of reference. That could be an important advance enabling the widespread use of quantum cryptography."

Read more of this story at Slashdot.

Ubisoft's New DRM Cracked In One Day

Posted: March 5th, 2010, 3:58am CET by timothy

Tags: encryption

Colonel Korn writes "Ubisoft's recent announcement that upcoming games would require a constant internet connection in order to play has been discussed at length on Slashdot ('The Awful Anti-Pirate System That Will Probably Work'). Many were of the opinion that this new, more demanding DRM would have effectiveness to match its inconvenience, at least financially justifying its use. Others assumed that it would be immediately cracked, as is usually the case, leaving the inconvenience for paying customers and resulting in a superior product for pirates. As usual, the latter group was right. Though Ubisoft won't yet admit it, Skid-Row managed to crack the new DRM less than a day after it was first released."

Read more of this story at Slashdot.

Researchers Find Way To Zap RSA Algorithm

Posted: March 4th, 2010, 9:02pm CET by timothy

Tags: encryption

alphadogg writes "Three University of Michigan computer scientists say they have found a way to exploit a weakness in RSA security technology used to protect everything from media players to smartphones and e-commerce servers. RSA authentication is susceptible, they say, to changes in the voltage supply to a private key holder. While guessing the 1,000-plus digits of binary code in a private key would take unfathomable hours, the researchers say that by varying electric current to a secured computer using an inexpensive purpose-built device they were able to stress out the computer and figure out the 1,024-bit private key in about 100 hours – all without leaving a trace. The researchers in their paper outline how they made the attack (PDF) on a SPARC system running Linux."

Read more of this story at Slashdot.

Researchers Find Way To Zap RSA Algorithm

Posted: March 4th, 2010, 9:02pm CET by timothy

Tags: encryption

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2010/03/04/Privacy_With_a_4096_Bit_RSA_Key__mdash__Offline__On_Paper'

Privacy With a 4096 Bit RSA Key — Offline, On Paper

Posted: March 4th, 2010, 12:03am CET by timothy

Tags: encryption

HavanaF writes "Online backup is practical, but can it offer any privacy? The Dutch security company Safeberg developed an Offline Private Key Protocol, with an asymmetric key scheme. The protocol demands that the private (decryption) key be stored away from the 'source' computer, which presumably is 'too vulnerable.' The catch is that the private key needs to be fairly large to be secure: a 4,096-bit RSA key should suffice for some years. But how to store an 800-character key offline? Safeberg introduces a machine readable paper key, with the 4k-bit key crammed in a giant 2D Datamatrix barcode. This video on key strength tells the story."

Read more of this story at Slashdot.

How To Replace FileVault With EncFS

Posted: February 14th, 2010, 9:14pm CET by timothy

Tags: encryption

agoston.horvath writes "I've written a HOWTO on replacing Mac OS X's built-in encryption (FileVault) with the well-known FUSE-based EncFS. It worked well for me, and most importantly: it is a lot handier than what Apple has put together. This is especially useful if you are using a backup solution like Time Machine. Includes Whys, Why Nots, and step-by-step instructions."

Read more of this story at Slashdot.

Verizon MiFi Owned By Simple Attack

Posted: February 3rd, 2010, 7:12pm CET by timothy

Tags: encryption

Trailrunner7 writes "Security researcher Joshua Wright has developed a simple attack that allows him to recover the passwords for any Verizon MiFi device. The MiFi is essentially a tiny, portable wireless AP, and Wright's attack uses a simple and effective technique to get default passwords by using the device's SSID and some existing password attacks on the encryption protocols the MiFi employs. Result: complete 0wnage of any MiFi."

Read more of this story at Slashdot.

Parallel Algorithm Leads To Crypto Breakthrough

Posted: January 29th, 2010, 2:18pm CET by timothy

Tags: encryption

Hugh Pickens writes "Dr. Dobbs reports that a cracking algorithm using brute force methods can analyze the entire DES 56-bit keyspace with a throughput of over 280 billion keys per second, the highest-known benchmark speeds for 56-bit DES decryption and can accomplish a key recovery that would take years to perform on a PC, even with GPU acceleration, in less than three days using a single, hardware-accelerated server with a cluster of 176 FPGAs. The massively parallel algorithm iteratively decrypts fixed-size blocks of data to find keys that decrypt into ASCII numbers. Candidate keys that are found in this way can then be more thoroughly tested to determine which candidate key is correct." Update by timothy, 2010-01-29 19:05 GMT: Reader Stefan Baumgart writes to point out prior brute-force methods using reprogrammable chips, including Copacobana (PDF), have achieved even shorter cracking times for DES-56. See also this 2005 book review of Brute Force, about the EFF's distributed DES-breaking effort that succeeded in 1997 in cracking a DES-encrypted message.

Read more of this story at Slashdot.

80% of Cell Phone Encryption Solutions Insecure

Posted: January 29th, 2010, 12:21am CET by timothy

Tags: encryption

An anonymous reader writes "Mobile Magazine writes about a blogger named Notrax who has tested 15 methods of secure encryption for mobile phones; out of those he found only 3 could not be cracked at some level. '12 of them were "worthless." It's easy to take the software at face value when it "tells you" that the call is secured. But how does someone actually go about being sure that it is secured? Notrax did some digging and discovered he could break in to almost all of them in under 30 minutes.'" (Above link is to a slightly older description of Notrax's approach; then, it was 9 out of 10 products that were worthless, instead of 12 out of 15.)

Read more of this story at Slashdot.

What's Holding Back Encryption?

Posted: January 18th, 2010, 5:14pm CET by CmdrTaco

Tags: encryption

nine-times writes "After many years in IT, I've been surprised to notice how much of my traffic is still unencrypted. A lot of businesses that I interact with (both business and personal) are still using unencrypted FTP, and very few people use any kind of encryption for email. Most websites are still using unencrypted HTTP. DNSSEC seems to be picking up some steam, but still doesn't seem to be widely used. I would have thought there would be a concerted effort to move toward encryption for the sake of security, but it doesn't seem to be happening. I wanted to ask the Slashdot community, what do you think the hold up is? Are the existing protocols somehow not good enough? Are the protocols fine, but not supported well enough in software? Is it too complicated to manage the various encryption protocols and keys? Is it ignorance or apathy on the part of the IT community, and that we've failed to demand it from our vendors?"

Read more of this story at Slashdot.

Only 27% of Organizations Use Encryption

Posted: January 14th, 2010, 9:31am CET by samzenpus

Tags: encryption

An anonymous reader writes "According to a Check Point survey of 224 IT and security administrators, over 40% of businesses in the last year have more remote users connecting to the corporate network from home or when traveling, compared to 2008. The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users. Yet, regardless of the growth in remote users, just 27% of respondents say their companies currently use hard disk encryption to protect sensitive data on corporate endpoints. In addition, only 9% of businesses surveyed use encryption for removable storage devices, such as USB flash drives. A more mobile workforce carrying large amounts of data on portable devices leaves confidential corporate data vulnerable to loss, theft and interception."

Read more of this story at Slashdot.

Second 3G GSM Cipher Cracked

Posted: January 12th, 2010, 2:48pm CET by Soulskill

Tags: encryption

Trailrunner7 writes "A group of cryptographers has developed a new attack that has broken Kasumi, the encryption algorithm used to secure traffic on 3G GSM wireless networks. The technique enables them to recover a full key by using a tactic known as a related-key attack, but experts say it is not the end of the world for Kasumi. Kasumi, also known as A5/3, is the standard cipher used to encrypt communications on 3G GSM networks, and it's a modified version of an older algorithm called Misty. In the abstract of their paper, the cryptographers say the attack can be implemented easily on one standard PC. 'In this paper we describe a new type of attack called a sandwich attack, and use it to construct a simple distinguisher for 7 of the 8 rounds of KASUMI with an amazingly high probability of 214. By using this distinguisher and analyzing the single remaining round, we can derive the complete 128 bit key of the full KASUMI by using only 4 related keys, 226 data, 230 bytes of memory, and 232 time. These complexities are so small that we have actually simulated the attack in less than two hours on a single PC, and experimentally verified its correctness and complexity.'"

Read more of this story at Slashdot.

NIST Investigating Mass Flash Drive Vulnerability

Posted: January 9th, 2010, 11:05am CET by Soulskill

Tags: encryption

Lucas123 writes with a followup to news we discussed earlier this week that the encryption on NIST-certified flash drives was cracked. "A number of leading manufacturers of encrypted flash drives have warned their customers of a security flaw uncovered by a German company. The devices in question use the AES 256-bit encryption algorithm and have been certified using the FIPS 140-2, but the flaw appears to circumvent the certification process by uncovering the password authentication code on host systems. The National Institute of Standards and Technology said it's investigating whether it needs to modify its standards to include password authentication software on host systems. Security specialist Bruce Schneier was blunt in his characterization of the flaw: 'It's a stupid crypto mistake and they screwed up and they should be rightfully embarrassed for making it.'"

Read more of this story at Slashdot.

DVD-CSS's Encryption Not Enough? Here Comes DECE

Posted: January 5th, 2010, 2:49pm CET by timothy

Tags: encryption

An anonymous reader writes "Studios digitally restricting (drm) or locking down content with DVD-CSS not enough for you? Well, get ready, here comes the entertainment cartel's Holy Grail, all-hardware encryption, via 'DECE.' And let's not forget this little issue."

Read more of this story at Slashdot.

Quantum Encryption Implementation Broken

Posted: December 30th, 2009, 10:37pm CET by timothy

Tags: encryption

I Don't Believe in Imaginary Property writes "Professor Johannes Skaar's Quantum Hacking group at NTNU have found a new way to break quantum encryption. Even though quantum encryption is theoretically perfect, real hardware isn't, and they exploit these flaws. Their technique relies on a particular way of blinding the single photon detectors so that they're able to perform an intercept-resend attack and get a copy of the secret key without giving away the fact that someone is listening. This attack is not merely theoretical, either. They have built an eavesdropping device and successfully attacked their own quantum encryption hardware. More details can be found in their conference presentation."

Read more of this story at Slashdot.

Amazon Kindle Proprietary Format Broken

Posted: December 23rd, 2009, 11:24am CET by kdawson

Tags: encryption

An anonymous reader writes "The Register reports that the proprietary document format used by the Amazon online store and Amazon's Kindle has been successfully reverse engineered, allowing these DRM-protected documents to be converted into the open MOBI format. Users of alternative e-book readers rejoice." Here are the hacker's notes on the program he is calling "Unswindle," and here is the (translated) forum where the Kindle challenge was posed and answered.

Read more of this story at Slashdot.

WPA-PSK Cracking As a Service

Posted: December 8th, 2009, 1:31am CET by kdawson

Tags: encryption

An anonymous reader writes "Moxie Marlinspike, a security researcher well known for his SSL/TLS attacks, today launched a cloud-based WPA cracking service, where for $34 you can test the security of your WPA password. The WPA Cracker Web site states: 'WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes.'"

Read more of this story at Slashdot.

Open Source Attempt To Crack GSM Encryption

Posted: December 5th, 2009, 9:24pm CET by timothy

Tags: encryption

Lexta writes with an interesting tidbit from IEEE Spectrum: "'Karsten Nohl, chief research scientist with H4RDW4RE, a Sunnyvale, Calif.-based security research firm, is mounting what could be the most ambitious attempt yet to compromise the GSM phone system.' The intended approach is to create an open source project to spread the computation of a giant look-up table across more than 80 machines. Interestingly, they've openly stated that nVidia's CUDA technology will be used to execute parallel elements of the problem on GPUs as well."

Read more of this story at Slashdot.

The Voynich Manuscript May Have Been Decoded

Posted: December 2nd, 2009, 2:17pm CET by kdawson

Tags: encryption

MBCook sends word on a possible solution to the mystery of the Voynich Manuscript, which we last visited nearly 6 years ago. "The Voynich Manuscript has confounded attempts to decode it for nearly 100 years. A person named Edith Sherwood, who has previously suggested a possible link to DaVinci, has a new idea: perhaps the text is simply anagrams of Italian words. There are three pages of examples from the herb section of the book, showing the original text, the plaintext Italian words, and the English equivalents. Has someone cracked the code?"

Read more of this story at Slashdot.

US Government Using PS3s To Break Encryption

Posted: November 18th, 2009, 11:16pm CET by timothy

Tags: encryption

Entropy98 writes "It seems that the US Immigration and Customs Enforcement Cyber Crimes Center, known as C3, has replaced its '$8,000 Tableau/Dell server combination' with more efficient and much cheaper $300 PS3s. Each PS3 is capable of 4 million passwords per second, and C3 currently has 20 PS3s with plans to buy 40 more. Naturally this is only being used to break encryption on computers seized with a warrant and suspected of harboring child pornography."

Read more of this story at Slashdot.

US Government Using PS3s To Break Encryption

Posted: November 18th, 2009, 11:16pm CET by timothy

Tags: encryption

Read more of this story at Slashdot.

Cracking PGP In the Cloud

Posted: November 3rd, 2009, 11:17am CET by kdawson

Tags: encryption

pariax writes "So you wanna build your own massively distributed password cracking infrastructure? Electric Alchemy has published a writeup detailing their experiences cracking PGP ZIP archives using brute force computing power provided by Amazon EC2 and a distributed password cracker from Elcomsoft."

Read more of this story at Slashdot.

UK Law Enforcement Is Against "3-Strikes"

Posted: October 27th, 2009, 8:32pm CET by kdawson

Tags: encryption

Now that the UK is discussing plans for some form of 3-strikes regime to discourage file-sharing, TechDirt reports that the fans of due process have picked up unlikely allies: the law enforcement and spying establishments fear that a 3-strikes policy would result in far more encryption on the Net, greatly complicating their jobs. "Of course, they're not as concerned about due process and civil rights, as they are about making it more difficult to track down criminals online: 'Law enforcement groups, which include the Serious and Organized Crime Agency and the Metropolitan Police's e-crime unit, believe that more encryption will increase the costs and workload for those attempting to monitor internet traffic. ... A source involved in drafting the Bill said that the intelligence agencies, MI5 and MI6, had also voiced concerns about disconnection. "The spooks hate it," the source said.'" The Times (UK) Online has more details.

Read more of this story at Slashdot.

Of Encrypted Hard Drives and "Evil Maids"

Posted: October 23rd, 2009, 3:37pm CEST by kdawson

Tags: encryption

Schneier has a blog piece about Joanna Rutkowska's "evil maid" attack, demonstrated earlier this month against TrueCrypt. "The same kind of attack should work against any whole-disk encryption, including PGP Disk and BitLocker. ... [A] likely scenario is that you leave your encrypted computer in your hotel room when you go out to dinner, and the maid sneaks in and installs the hacked bootloader. ... [P]eople who encrypt their hard drives, or partitions on their hard drives, have to realize that the encryption gives them less protection than they probably believe. It protects against someone confiscating or stealing their computer and then trying to get at the data. It does not protect against an attacker who has access to your computer over a period of time during which you use it, too."

Read more of this story at Slashdot.

EFF Warns TI Not To Harass Calculator Hobbyists

Posted: October 14th, 2009, 2:24am CEST by kdawson

Tags: encryption

Ponca City, We love you writes "The EFF has warned Texas Instruments not to pursue legal threats against calculator hobbyists who perform modifications to the company's programmable graphing calculators. TI's calculators perform a 'signature check' that allows only approved operating systems to be loaded, but researchers have reverse-engineered signing keys, allowing tinkerers to install custom operating systems and unlock new functionality in the calculators' hardware. In response, TI has unleashed a torrent of demand letters claiming that the anti-circumvention provisions of the Digital Millennium Copyright Act require the hobbyists to take down commentary about and links to the keys. 'This is not about copyright infringement. This is about running your own software on your own device — a calculator you legally bought,' says EFF Civil Liberties Director Jennifer Granick. 'Yet TI still issued empty legal threats in an attempt to shut down discussion of this legitimate tinkering. Hobbyists are taking their own tools and making them better, in the best tradition of American innovation.'"

Read more of this story at Slashdot.

Thawte Will End "Web of Trust" On November 16

Posted: October 6th, 2009, 2:11pm CEST by kdawson

Tags: encryption

An anonymous reader writes "Thawte is ending their Web of Trust, including their free Personal Email Certificates, in less than 2 weeks' time. This hasn't been picked up by the media yet. Seems to me a lot of people, including myself, are hurt by this." Thawte is offering a 1-year free VeriSign cert to those holding valid Personal Email Certificates; after that you pay.

Read more of this story at Slashdot.

OpenSSH Going Strong After 10 Years With Release of v5.3

Posted: October 2nd, 2009, 4:26am CEST by timothy

Tags: encryption

An anonymous reader writes "OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. It encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions. Version 5.3 marks the 10th anniversary of the OpenSSH project."

Read more of this story at Slashdot.

Making Data Unvanish

Posted: September 22nd, 2009, 8:40pm CEST by kdawson

Tags: encryption

sertsa writes "Earlier this year a group of researchers at the University of Washington came up with a scheme to use peer-to-peer networks to store and, ultimately, to forget the keys for encrypted messages, causing them to 'Vanish.' Now a group from researchers from UT Austin, Princeton, and the University of Michigan has come up with a way to break this approach, by making a single computer appear to be many nodes on the p2p network. 'In our experiments with Unvanish, we have shown that it is possible to make Vanish messages reappear long after they should have disappeared nearly 100 percent of the time...'"

Read more of this story at Slashdot.

60 Years of Cryptography, 1949-2009

Posted: September 21st, 2009, 6:59am CEST by kdawson

Tags: encryption

Dan Jones writes "2009 marks 60 years since the advent of modern cryptography. It was back in October 1949 when mathematician Claude Shannon published a paper on Communication Theory of Secrecy Systems. According to his employer at the time, Bell Labs, the work transformed cryptography from an art to a science and is generally considered the foundation of modern cryptography. Since then significant developments in secure communications have continued, particularly with the advent of the Internet and Web. CIO has a pictorial representation of the past six decades of research and development in encryption technology. Highlights include the design of the first quantum cryptography protocol by Charles Bennett and Gilles Brassard in 1984, and the EFF's 'Deep Crack' DES code breaker of 1998."

Read more of this story at Slashdot.

Alan Turing Gets an Apology From Prime Minister Brown

Posted: September 11th, 2009, 1:20am CEST by timothy

Tags: encryption

99luftballon writes "The British government has officially apologized for the treatment of Alan Turing in the post war era. An online petition got more than enough signatures to force an official statement and Prime Minister Gordon Brown has issued a lengthy apology. 'Thousands of people have come together to demand justice for Alan Turing and recognition of the appalling way he was treated. While Turing was dealt with under the law of the time and we can't put the clock back, his treatment was of course utterly unfair and I am pleased to have the chance to say how deeply sorry I and we all are for what happened to him. So on behalf of the British government, and all those who live freely thanks to Alan's work I am very proud to say: we're sorry, you deserved so much better.'"

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2009/09/08/DRM_Take_II__mdash___Digital_Personal_Property'

DRM Take II — Digital Personal Property

Posted: September 8th, 2009, 6:33pm CEST by timothy

Tags: encryption

Diabolus Advocatus writes "Ars Technica has an article on a new form of DRM being considered by the IEEE. It's called Digital Personal Property and although it removes some of the drawbacks of conventional DRM it introduces new drawbacks of its own. From the article: 'Digital personal property (DPP) is an attempt to make consumers treat digital media like physical objects. For instance, you might loan your car to a friend, a family member, or a neighbor. You might do so on many different occasions and for different lengths of time. But you are unlikely to leave the car out front of your house with the keys in it and a sign on it saying, "Take me!" If you did, you might never see the vehicle again. It's that ability to lose control over property that is central to the DPP system. DPP files are encrypted. They can be freely copied and distributed to anyone, but here's the trick: anyone who can view your content can also "steal" it irrevocably. The simple addition of a way to lose content instantly leads consumers to set up a "circle of trust" that can be as wide as they like but will not extend to total strangers on the Internet.'"

Read more of this story at Slashdot.

Sun Plans Security Coprocessor For New Ultrasparc

Posted: August 26th, 2009, 5:06pm CEST by Soulskill

Tags: encryption

angry tapir writes "At the Hot Chips conference at Stanford University, Sun presented plans for a security accelerator chip that it said would reduce encryption costs for applications such as VoIP calls and online banking Web sites. The coprocessor will be included on the same silicon as Rainbow Falls, the code name for the follow-on to Sun's multi-threaded Ultrasparc T2 processor."

Read more of this story at Slashdot.

Encryption? What Encryption?

Posted: August 12th, 2009, 4:22pm CEST by Soulskill

Tags: encryption

Slashdot regular Bennett Haselton writes with his take on the news we discussed early this morning about the UK government's prosecution of two people who refused to disclose their encryption keys: "Is it possible to write a program that enables you to encrypt files without drawing suspicion upon yourself if anyone ever seizes your computer? No; a program by itself, no matter how perfectly written, couldn't do this because you'd still attract suspicion just for possessing the software. You'd need a social element driving the program's popularity until it gets to the point where people no longer look suspicious just for having the program installed. Here are some theories on how that could happen — but it would be a high bar to clear." Hit the link below for the rest of Bennett's thoughts.

Read more of this story at Slashdot.

In UK, Two Convicted of Refusing To Decrypt Data

Posted: August 12th, 2009, 11:31am CEST by kdawson

Tags: encryption

ACKyushu clues us to recent news out of the UK, where two people have been successfully prosecuted for refusing to provide authorities with their encryption keys, resulting in landmark convictions that may have carried jail sentences of up to five years. There is uncertainty in that the names of the people convicted were not released; and without those names, the Crown Prosecution Service said it was unable to track down details of the cases. "Failure to comply with a section 49 notice carries a sentence of up to two years jail plus fines. Failure to comply during a national security investigation carries up to five years jail. ... Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted. Sir Christopher [Rose, the government's Chief Surveillance Commissioner] did not report whether prosecutions failed or are pending against the five charged but not convicted in the period covered by his report."

Read more of this story at Slashdot.

Generating Fast MD5 Collisions With ATI Video Cards

Posted: August 1st, 2009, 9:33pm CEST by timothy

Tags: encryption

An anonymous reader writes "Yesterday at Black Hat USA 2009, a talk entitled MD5 Chosen-Prefix Collisions on GPUs (whitepaper) (Both PDFs) presented an implementation written in assembly language for ATI video cards that achieves 1.6 billion MD5 hash/sec, or 2.2 billion MD5 hash/sec with reversing, on an ATI Radeon HD 4850 X2. This is faster than the much-publicized 1.4-1.9 billion hash/sec figure that was supposedly reached on a PlayStation 3 by Nick Breese at Black Hat Europe 2008 (he later noticed an error in his benchmarking tool). Compared to the cluster of 215 PlayStation 3s that was used to create a rogue CA in December 2008, Marc Bevand claimed a cluster of 12 machines with 24 video cards would be a bit faster, consume 5 times less power, and be 10 times cheaper."

Read more of this story at Slashdot.

Another New AES Attack

Posted: July 31st, 2009, 10:54pm CEST by ScuttleMonkey

Tags: encryption

Jeremy A. Hansen writes "Bruce Schneier gives us an update on some ongoing cryptanalysis of AES. 'Over the past couple of months, there have been two new cryptanalysis papers on AES. The attacks presented in the paper are not practical — they're far too complex, they're related-key attacks, and they're against larger-key versions and not the 128-bit version that most implementations use — but they are impressive pieces of work all the same. This new attack, by Alex Biryukov, Orr Dunkelman, Nathan Keller, Dmitry Khovratovich, and Adi Shamir, is much more devastating. It is a completely practical attack against ten-round AES-256.' While ten-round AES-256 is not actually used anywhere, Schneier goes on to explain why this shakes some of the cryptology community's assumptions about the security margins of AES."

Read more of this story at Slashdot.

SHA-3 Second Round Candidates Released

Posted: July 25th, 2009, 4:03am CEST by Soulskill

Tags: encryption

Jeremy A. Hansen writes "NIST just announced their selections for algorithms going to the second round of the SHA-3 competition. Quoting: 'NIST received 64 SHA-3 candidate hash function submissions and accepted 51 first round candidates as meeting our minimum acceptance criteria. We have now selected 14 second round candidates to continue in the competition. Information about the second round candidate algorithms will be available here. We were pleased by the amount and quality of the cryptanalysis we received on the first round candidates, and more than a little amazed by the ingenuity of some of the attacks. ... In selecting this set of second round candidates we tried to include only algorithms that we thought had a chance of being selected as SHA-3. We were willing to extrapolate higher performance for conservative designs with apparently large safety factors, but comparatively unforgiving of aggressive designs that were broken, or nearly broken during the course of the review. We were more willing to accept disquieting properties of the hash function if the designer had apparently anticipated them, than if they were discovered during the review period, even if there were apparent fixes. We were generally alarmed by attacks on compression functions that seemed unanticipated by the submitters.'"

Read more of this story at Slashdot.

New Elliptic Curve Cryptography Record

Posted: July 12th, 2009, 7:05pm CEST by Soulskill

Tags: encryption

deian writes "Cryptography researchers Joppe W. Bos, Marcelo E. Kaihara, Thorsten Kleinjung, Arjen K. Lenstra and Peter L. Montgomery have just announced that they have set a new record for the elliptic curve discrete logarithm problem (ECDLP) by solving it over a 112-bit finite field. The previous record was for a 109-bit prime field and dates back from October 2002. Their calculation was done on the EPFL cluster of more than 200 PS3s (same one used to create the Rogue CA certificates and demonstrate a reproducible attack on MD5 algorithms). On the PS3, the effort is equivalent to about 14 full 56-bit DES key searches!"

Read more of this story at Slashdot.

Bletchley Park WWII Staff Finally Recognized

Posted: July 11th, 2009, 6:07am CEST by Soulskill

Tags: encryption

99luftballon writes "Nearly 70 years after Station X (aka the Bletchley Park cryptanalysis unit) was set up, the surviving members are to be honored by the British government. Bletchley was one of the most important computing centers of its time and housed giants of the technology industry (as it was) like Tommy Flowers, who built Colossus, and Dr. Alan Turing. I was lucky enough to meet one of the staff at the site 11 years ago, and she was very bitter that their work was never recognized, and that they were bound by the Official Secrets Act and couldn't talk about it. It's just a shame that so few of the staff are still alive to receive the award."

Read more of this story at Slashdot.

Behind the First Secure Quantum Crypto Network

Posted: July 4th, 2009, 11:11am CEST by Soulskill

Tags: encryption

schliz writes "Researchers behind the world's largest quantum encrypted network said the technology could secure business networks inside six years. The prototype Quantum Key Distribution network was built by the Secure Communication Based On Quantum Cryptography (SECOQC) group last year. It is described in a journal paper published by the Institute of Physics this week, which includes details on how it is based on the trusted-repeater paradigm."

Read more of this story at Slashdot.

200-Year-Old Cipher Finally Cracked

Posted: July 2nd, 2009, 9:46pm CEST by timothy

Tags: encryption

Attila Dimedici writes "A code expert just cracked a code used by a friend of Thomas Jefferson in a letter written to Jefferson some 200 years ago. This code is fairly easy to crack using a computer, but extremely difficult without one. I think it would have been much harder if the author had not included an indication as to what code algorithm he used in the letter accompanying the coded message."

Read more of this story at Slashdot.

New AES Attack Documented

Posted: July 1st, 2009, 11:50pm CEST by timothy

Tags: encryption

avxo writes "Bruce Schneier covers a new cryptanalytic related-key attack on AES that is better than brute force with a complexity of 2^119. According to an e-mail by the authors: 'We also expect that a careful analysis may reduce the complexities. As a preliminary result, we think that the complexity of the attack on AES-256 can be lowered from 2^119 to about 2^110.5 data and time. We believe that these results may shed a new light on the design of the key-schedules of block ciphers, but they pose no immediate threat for the real world applications that use AES.'"

Read more of this story at Slashdot.

IBM Claims Breakthrough In Analysis of Encrypted Data

Posted: June 25th, 2009, 8:13pm CEST by timothy

Tags: encryption

An anonymous reader writes "An IBM researcher has solved a thorny mathematical problem that has confounded scientists since the invention of public-key encryption several decades ago. The breakthrough, called 'privacy homomorphism,' or 'fully homomorphic encryption,' makes possible the deep and unlimited analysis of encrypted information — data that has been intentionally scrambled — without sacrificing confidentiality." Reader ElasticVapor writes that the solution IBM claims "might better enable a cloud computing vendor to perform computations on clients' data at their request, such as analyzing sales patterns, without exposing the original data. Other potential applications include enabling filters to identify spam, even in encrypted email, or protecting information contained in electronic medical records."

Read more of this story at Slashdot.

No Museum Status For UK Home of Enigma Machine

Posted: May 22nd, 2009, 9:00am CEST by timothy

Tags: encryption

hardsix writes "Despite the numerous films, books and plays, celebrating the brilliant achievements of the code-breakers at Bletchley Park, the UK government is still dragging its feet over providing proper support for the site. There has just been a debate in the House of Lords over whether the site should be given similar status to the UK's main WWII museum — the Imperial War Museum. But the government has brushed off the request, claiming that the site has received enough funding recently. However, as was shown by a visit to the site by UK actor, and Twitter-lover Stephen Fry, although devices such as Enigma have been restored many of the huts where the code-breaking work went on are in a bad state and more investment is needed."

Read more of this story at Slashdot.

Forensics Tool Finds Headerless Encrypted Files

Posted: April 30th, 2009, 10:17pm CEST by timothy

Tags: encryption

gurps_npc writes "Forensics Innovations claims to have for sale a product that detects headerless encrypted files, such as TrueCrypt Dynamic files. It does not decrypt the file, just tells you that it is in fact an encrypted file. It works by detecting hidden patterns that don't exist in a random file. It does not mention steganography, but if their claim is true, it seems that it should be capable of detecting stenographic information as well."

Read more of this story at Slashdot.

F5 Fires Back On Open Source SSL Accelerator

Posted: April 17th, 2009, 4:09pm CEST by timothy

Tags: encryption

Random Feature writes "In response to Build an Open Source SSL Accelerator, in which o3 magazine detailed how to build a solution comparable to an F5 BIG-IP 6900 on the cheap, F5 Fires Back claiming it's not as cheap as it appears and pointing out the potential performance implications of a 'cobbled together set of components designed to mimic similar functionality.' The discussion on the performance of the Open Source solution based on Opteron RSA operation processing capabilities brings into question the validity of the 'more SSL TPS for cheaper' argument presented by o3."

Read more of this story at Slashdot.

Build an Open Source SSL Accelerator

Posted: April 15th, 2009, 10:24pm CEST by timothy

Tags: encryption

Amin Zelfani writes "SSL accelerators like Big-IP 6900 from F5 Networks typically carry a $50k or more price tag. An article over at o3magazine.com shows you how to build an SSL accelerator that's on par with the commercial solutions, using Open Source projects. SSL Accelerators offload the encryption / decryption process from web servers, reducing load and reducing the number of certificates needed."]

Read more of this story at Slashdot.

The Emerging Science of DNA Cryptography

Posted: March 18th, 2009, 6:41pm CET by timothy

Tags: encryption

KentuckyFC writes "Since the mid 90s, researchers have been using DNA to carry out massively parallel calculations which threaten encryption schemes such as DES. Now one researcher says that if DNA can be used to attack encryption schemes, it can also protect data too. His idea is to exploit the way information is processed inside a cell to encrypt it. The information that DNA holds is processed in two stages in a cell. In the first stage, called transcription, a DNA segment that constitutes a gene is converted into messenger RNA (mRNA) which floats out of the nucleus and into the body of the cell. Crucially, this happens only after the noncoding parts of the gene have been removed and the remaining sequences spliced back together." (More below.)

Read more of this story at Slashdot.

Security Review Summary of NIST SHA-3 Round 1

Posted: February 22nd, 2009, 8:15pm CET by timothy

Tags: encryption

FormOfActionBanana writes "The security firm Fortify Software has undertaken an automated code review of the NIST SHA-3 round 1 contestants (previously Slashdotted) reference implementations. After a followup audit, the team is now reporting summary results. According to the blog entry, 'This just emphasizes what we already knew about C, even the most careful, security conscious developer messes up memory management.' Of particular interest, Professor Ron Rivest's (the "R" in RSA) MD6 team has already corrected a buffer overflow pointed out by the Fortify review. Bruce Schneier's Skein, also previously Slashdotted, came through defect-free."

Read more of this story at Slashdot.

Using Lasers To Generate Random Numbers Faster

Posted: December 28th, 2008, 9:22pm CET by timothy

Tags: encryption

Pranav writes "Using semiconductor lasers, scientists from Takushoku University, Saitama University, and NTT Corporation achieved random number rates of up to 1.7 gigabits per second, which is about 10 times higher than the second-best rate, produced using a physical phenomenon. Future work may center on devising laser schemes that can achieving rates as high as 10 Gbps."

Read more of this story at Slashdot.

NIST Announces Round 1 Candidates For SHA-3 Competition

Posted: December 21st, 2008, 3:27pm CET by Soulskill

Tags: encryption

jd writes "NIST has announced the round 1 candidates for the Cryptographic Hash Algorithm Challenge. Of the 64 who submitted entries, 51 were accepted. Of those, in mere days, one has been definitely broken, and three others are believed to have been. At this rate, it won't take the couple of years NIST was reckoning to whittle down the field to just one or two. (In comparison, the European Union version, NESSIE, received just one cryptographic hash function for its contest. One has to wonder if NIST and the crypto experts are so concerned about being overwhelmed with work for this current contest, why they all but ignored the European effort. A self-inflicted wound might hurt, but it's still self-inflicted.) Popular wisdom has it that no product will have any support for any of these algorithms for years — if ever. Of course, popular wisdom is ignoring all Open Source projects that support cryptography (including the Linux kernel) which could add support for any of these tomorrow. Does it really matter if the algorithm is found to be flawed later on, if most of these packages support algorithms known to be flawed today? Wouldn't it just be geekier to have passwords in Blue Midnight Wish or SANDstorm rather than boring old MD5, even if it makes no practical difference whatsoever?"

Read more of this story at Slashdot.

BD+ Successfully Resealed

Posted: December 13th, 2008, 3:20pm CET by Soulskill

Tags: encryption

IamTheRealMike writes "A month on from the story that BD+ had been completely broken, it appears a new generation of BD+ programs has re-secured the system. A SlySoft developer now estimates February 2009 until support is available. There's a list of unrippable movies on the SlySoft forums; currently there are 16. Meanwhile, one of the open source VM developers seems to have given up on direct emulation attacks, and is now attempting to break the RSA algorithm itself. Back in March SlySoft confidently proclaimed BD+ was finished and said the worst case scenario was 3 months' work: apparently they underestimated the BD+ developers."

Read more of this story at Slashdot.

A 1941 Paper-and-Pencil Cipher

Posted: November 29th, 2008, 11:02pm CET by kdawson

Tags: encryption

Schneier's blog links to a photo of a 68-year-old code being employed in wartime, with a plausible explanation of what is going on in it. (The photo is from the Life Magazine archive we discussed when it went live.) "What you see here is a photo that never should have been allowed to be taken, and one which provides an amazing, one-of-a-kind glimpse into the world of WWII espionage and counter-espionage. As far as I can tell, what is shown in this picture is an FBI agent in New York encrypting a message, passed from 'DUNN'... through Sebold, prior to transmitting that message to Germany via shortwave radio. ... [T]his appears to be real cryptology at work."

Read more of this story at Slashdot.

A 1941 Paper-and-Pencil Cipher

Posted: November 29th, 2008, 11:02pm CET by kdawson

Tags: encryption

Read more of this story at Slashdot.

Doom9 Researchers Break BD+

Posted: November 1st, 2008, 7:27pm CET by kdawson

Tags: encryption

An anonymous reader writes "BD+, the Blu-ray copy protection system that was supposed to last 10 years, has now been solidly broken by a group of doom9 researchers. Earlier, BD+ had been broken by the commercial company SlySoft." Someone from SlySoft posts a hint early in the thread, but then backs off for fear of getting fired. The break is announced on page 15.

Read more of this story at Slashdot.

Soaring, Cryptography, and Nuclear Weapons

Posted: October 21st, 2008, 9:59pm CEST by kdawson

Tags: encryption

Martin Hellman sends in a pointer to his essay that uses analogies from cryptography and the sport of soaring in an attempt to draw people in to thinking about the risks of nuclear weapons. Quoting: "... I did a preliminary risk analysis which indicates that relying on nuclear weapons for our security is thousands of times more dangerous than having a nuclear power plant built next to your home." Hellman is best known as co-inventor (with Diffie and Merkle) of public key cryptography, and has worked for over twenty-five years to reduce the threat posed by nuclear weapons. He is also a glider pilot with over 2,600 logged hours. Hellman adds, "Readers needing a break can go to some photos of the Sierra Nevada mountains taken from my glider."

Read more of this story at Slashdot.

New State Laws Could Make Encryption Widespread

Posted: October 17th, 2008, 5:44pm CEST by kdawson

Tags: encryption

New laws that took effect in Nevada on Oct. 1 and will kick in on Jan. 1 in Massachusetts may effectively mandate encryption for companies' hard drives, portable devices, and data transmissions. The laws will be binding on any organization that maintains personal information about residents of the two states. (Washington and Michigan are considering similar legislation.) Nevada's law deals mostly with transmitted information and Massachusetts's emphasizes stored information. Between them the two laws should put more of a dent into lax security practices than widespread laws requiring customer notification of data breaches have done. (Such laws are on the books in 40 states and by one estimate have reduced identity theft by 2%.) Here are a couple of legal takes on the impact of the new laws.

Read more of this story at Slashdot.

Schneier Calls Quantum Cryptography Impressive But Pointless

Posted: October 16th, 2008, 10:27pm CEST by timothy

Tags: encryption

KindMind writes "Bruce Schneier writes in Wired that quantum cryptography, while an awesome technology, is actually pointless (that is, of no commercial value). His point is that the science of cryptography is not the weak point, but the other links in the chain (like people, etc.) are where it breaks down."

Read more of this story at Slashdot.

First Secure Quantum Crypto Network Up and Running

Posted: October 10th, 2008, 1:47pm CEST by timothy

Tags: encryption

John Lam was one of many readers to send in news that on Thursday, "at a conference in Vienna, Austria, as reported by the BBC, a European Community science working group built a quantum backbone using 200-km of standard commercial optical fiber running among seven sites and successfully demonstrated the first secure quantum cryptographic key distribution network. In addition, each of the seven links used a different kind of quantum encryption, demonstrating interoperability between the technologies. To paraphrase, the project focused on the trusted repeater paradigm and developed an architecture allowing seamless integration of heterogeneous quantum-key distribution-link devices in a unified framework. Network node-modules managing all classical communication tasks provide the underlying quantum devices with authentic classical channels. The node-module architecture uses a layered model to provision network-wide, end-to-end, provably secure key distribution."

Read more of this story at Slashdot.

Google's Obfuscated TCP

Posted: October 8th, 2008, 2:53am CEST by kdawson

Tags: encryption

agl42 writes "Obfuscated TCP attempts to provide a cheap opportunistic encryption scheme for HTTP. Though SSL has been around for years, most sites still don't use it by default. By providing a less secure, but computationally and administratively cheaper, method of encryption, we might be able to increase the depressingly small fraction of encrypted traffic on the Internet. There's an introduction video explaining it."

Read more of this story at Slashdot.

Google's Obfuscated TCP

Posted: October 7th, 2008, 2:53am CEST by kdawson

Tags: encryption

agl42 writes "Obfuscated TCP is attempting to provide a cheap opportunistic encryption scheme for HTTP. Though SSL has been around for years, most sites still don't use it by default. By providing a less secure, but computationally and administratively cheaper, method of enctyption, we might be able to increase the depressingly small fraction of encrypted traffic on the Internet. There's an introduction video explaining it."

Read more of this story at Slashdot.

Nevada Businesses Must Start Encrypting E-Mail By Oct. 1st

Posted: September 22nd, 2008, 9:53pm CEST by Soulskill

Tags: encryption

dtothes writes "Baseline is reporting the state of Nevada has a statute about to go in effect on October 1, 2008 that will force businesses to encrypt all personally identifiable information transmitted over the Internet. They speak with a Nevada legal expert who says the problem is that the statute is written so broadly that the law could potentially open up a ton of unintentional liability and allow for the interpretation of things like password-protected documents to be considered sufficiently encrypted. Quoting: 'Beyond the infrastructure impact, the statute itself looks like Swiss cheese. Bryce K. Earl, a Las Vegas-based attorney, ... has been following the issue closely and believes there are some problems with the statute as it is on the books right now, namely the broad definition of encryption, the lack of coordination with industry standards and the unclear nature of penalties both criminal and civil.'"

Read more of this story at Slashdot.

PGP Leads Corporate Efforts To Save Bletchley Park

Posted: September 8th, 2008, 11:14pm CEST by ScuttleMonkey

Tags: encryption

blake182 writes "CNET reports that PGP, together with IBM and other technology firms, is mounting a fundraising effort to benefit the ailing Bletchley Park, home of the Station X codebreaking efforts in World War II. 'We're calling attention (to the fact that) Bletchley is falling into disrepair, and that, probably, the world owes a debt of gratitude to that place,' said Phil Dunkelberger, chief executive of PGP."

Read more of this story at Slashdot.

Easy Encryption In Java and Python With Keyczar

Posted: August 17th, 2008, 2:31am CEST by kdawson

Tags: encryption

rsk writes "Keyczar is an encryption toolkit born out of the Google Security Team and released under the Apache 2 license. Keyczar's purpose is to make managing encryption of secured data much easier than it has been, with the following features: a simple API; key rotation and versioning; safe default algorithms, modes, and key lengths; automated generation of initialization vectors and ciphertext signatures; Java and Python implementations (C++ coming soon); and international support in Java (Python coming soon). The example on the website is only 2 lines long, and a more fully worked out example is also provided for folks wanting to get started 'for reals.'"

Read more of this story at Slashdot.

How Important Is Protecting Streaming Media?

Posted: August 16th, 2008, 11:09am CEST by Soulskill

Tags: encryption

spaj writes "In the ongoing battle with the MPAA and RIAA, there seems to be an ongoing argument about who is to blame. If you leave a $20 bill on the sidewalk, can you report it stolen when someone takes it? Of course you can, but will you be taken seriously by the authorities? When my car was broken into, I was told by the responding police officer that I might have prevented it by keeping my seats and visible areas clear of junk that would entice criminals. So, who is at fault when it comes to users abusing their right to capture streaming media for personal use? According to Applian.com's Legal FAQ, the RIAA will not come after you if you make a recording for your own personal use. I have often been torn on this issue, and I am looking for input. Adobe recently released a new format of their widely used streaming protocol, RTMP, that includes 128-bit encryption (RTMPE). I can only interpret this as an attempt to prevent capturing of the streaming media content for personal use. However, Applian has already circumvented the RTMPE protection, and you can read about it on Adobe's forums, where some users seem quite dissatisfied that their content is not protected enough by Adobe's technology. I think the main question boils down to: Who is to blame? Can you blame Adobe for not making a better encryption? Or do you blame Applian for bypassing such security features? Or do you blame the authors of stolen content for leaving the security of their material in somebody else's hands?"

Read more of this story at Slashdot.

TrueCrypt 6.0 Released

Posted: July 8th, 2008, 11:36am CEST by kdawson

Tags: encryption

ruphus13 writes "While most of the US was celebrating Independence Day, the true fellow geeks over at TrueCrypt released version 6.0 of TrueCrypt over the long weekend. The new version touts two major upgrades. 'First, TrueCrypt now performs parallel encryption and decryption operations on multi-core systems, giving you a phenomenal speedup if you have more than one processor available. Second, it now has the ability to hide an entire operating system, so even if you're forced to reveal your pre-boot password to an adversary, you can give them one that boots into a plausible decoy operating system, with your hidden operating system remaining completely undetectable.' The software has been released under the 'TrueCrypt License,' which is not OSI approved."

Read more of this story at Slashdot.

Discovery of a "Flat" Atom Hailed as Quantum Computing Breakthrough

Posted: July 2nd, 2008, 10:00pm CEST by ScuttleMonkey

Tags: encryption

msw writes to tell us that nanoelectronics researchers have discovered a new molecule that could act as a state-manipulable atom due to its unique shape and properties. "Imagine a tiny arsenic atom embedded in a tiny strip of silicon atoms. An electric current is applied. Something strange arises on the surface -- an exotic molecule. On one end is the spherical submerged arsenic atom; on the other end is an 'artificial' flat atom, seemingly 2D, created as an artifact. The pair form an exotic molecule, which has a shared electron, which can be manipulated to be at either end, or in an intermediate quantum state."

Read more of this story at Slashdot.

When Is a Self-Signed SSL Certificate Acceptable?

Posted: June 25th, 2008, 11:53am CEST by kdawson

Tags: encryption

UltraLoser writes "When is it acceptable to encourage users to accept a self-signed SSL cert? Recently the staff of a certain Web site turned on optional SSL with a self-signed and domain-mismatched certificate for its users and encourages them to add an exception for this certificate. Their defense is that it is just as secure as one signed by a commercial CA; and because their site exists for the distribution of copyrighted material the staff do not want to have their personal information in the hands of a CA. In their situation is it acceptable to encourage users to trust this certificate or is this giving users a false sense of security?"

Read more of this story at Slashdot.

Atari Founder Proclaims the End of Gaming Piracy

Posted: May 26th, 2008, 6:17pm CEST by ScuttleMonkey

Tags: encryption

OMGZombies writes "Speaking on a conference held yesterday in New York, the Atari founder Nolan Bushnell said that a new stealth encryption chip called TPM will 'absolutely stop piracy of gameplay'. The chip is apparently being embedded on most of the new computer motherboards and is said to be 'uncrackable by people on the internet and by giving away passwords' though it won't stop movie or music piracy, since 'if you can watch it and you can hear it, you can copy it.'"

Read more of this story at Slashdot.

Finnish Appeals Court Rules Breaking CSS Illegal

Posted: May 26th, 2008, 5:25pm CEST by CmdrTaco

Tags: encryption

Thomas Nybergh writes "Due to an appeal court decision from a couple of days back, breaking the not-very-effective CSS copy protection used on most commercial DVD-Video discs is now a criminal act in Finland (robo translated). The verdict is contrary to what a district court thought of the same case last year when two local electronic rights activists were declared not guilty after having framed themselves by spreading information on how to break CSS. Back then, it was to the activists' benefit has CSS been badly broken and inneffective ever since DeCSS came out."

Read more of this story at Slashdot.

Breaking the Fermilab Code

Posted: May 20th, 2008, 9:22am CEST by kdawson

Tags: encryption

Saiyine sends word that the mysterious code received at Fermilab, which we discussed last Friday, has been mostly decoded, inside of two days, by two separate people. The poster at the second link seems to have constructed a more complete rationale for the message.

Read more of this story at Slashdot.

Fermilab Calls For Code Crackers

Posted: May 16th, 2008, 5:10pm CEST by kdawson

Tags: encryption

atrocious cowpat passes along a call for help from symmetry magazine, the joint publication of Fermilab and SLAC, noting: "Could be just plain gibberish, it could be something like those wonderfully weird letters to the Mount Wilson observatory, or it could be a message from aliens who just happened to have gotten their hands (tentacles/exoskeleton) on a fax machine." "A little over a year ago, the Fermilab Office of Public Affairs received a curious letter in code (4.4-MB image here). It has been sitting in our files all that time and we haven't had much of a chance to look into breaking the code, nor are we particularly expert at this!"

Read more of this story at Slashdot.

Bletchley Park Facing Financial Ruin

Posted: May 16th, 2008, 3:04pm CEST by kdawson

Tags: encryption

biscuitfever11 writes "Bletchley Park, the home of Station X, Britain's secret code-breaking base during World War II, is barely scraping by financially, as shown in these images compiled by ZDNet this week. The site has undergone major redevelopment as an act of remembrance for the Allied efforts to break the German Enigma code, but now its future is clouded — among others, the Bill and Melinda Gates Foundation turned them down for financial assistance (since it doesn't have to do with the Internet). Its director estimates that Bletchley Park's funds will be exhausted in three years. Hungry land developers are circling. This is an insightful look at what's happened to Bletchley Park these days and the pain it's going through."

Read more of this story at Slashdot.

Former Crypto-Analyst Analyzes the Danger of Nuclear Weapon Stockpiles

Posted: April 6th, 2008, 2:27pm CEST by Zonk

Tags: encryption

An anonymous reader writes "IEEE Spectrum reports that noted encryption pioneer Prof. Martin Hellman has a new passion; estimating the risk of our current nuclear weapons policies. His web site, Defusing the Nuclear Threat, asks the question, 'How risky are nuclear weapons? Amazingly, no one seems to know.' Hellman therefore did a preliminary analysis and found the risk to be 'equivalent to having your home surrounded by thousands of nuclear power plants.' The web site and a related statement therefore urgently call for more detailed studies to either confirm or correct his startling conclusion. The statement has been signed by seven notable individuals including former NSA Director Adm. Bobby R. Inman and two Nobel Laureates."

Read more of this story at Slashdot.

Blocking Steganosonic Data In Phone Calls

Posted: April 2nd, 2008, 9:18am CEST by kdawson

Tags: encryption

psyced writes "Steganography is a technique to encode secret messages in the background noise of an audio recording or photograph. There have been attempts at steganalysis in the past, but scientists at FH St. Pölten are developing strategies to block out secret data in VoIP and even GSM phone calls by preemptively modifying background noise (link is to a Google translation of the German original) on a level that stays inaudible or invisible, yet destroys any message encoded within. I wonder if this method could be applied to hiding messages in executables, too."

Read more of this story at Slashdot.

Quantum Computing Not an Imminent Threat To Public Encryption

Posted: March 23rd, 2008, 3:35pm CET by Soulskill

Tags: encryption

Bruce Schneier's latest blog entry points out an interesting analysis of how quantum computing will affect public encryption. The author takes a look at some of the mathematics involved with using a quantum computer to run a factoring algorithm, and makes some reasonable assumptions about the technological constraints faced by the developers of the technology. He concludes that while quantum computing could be a threat to modern encryption, it is not the dire emergency some researchers suggest.

Read more of this story at Slashdot.

Open Source News » Tags » encryption

Feeds

176 items tagged "encryption"

Posted: May 6th, 2012, 8:10pm CEST by samzenpus

Tags: encryption

Posted: April 28th, 2012, 5:23am CEST by timothy

Tags: encryption

Posted: April 12th, 2012, 12:03am CEST by samzenpus

Tags: encryption

Posted: April 8th, 2012, 1:48am CEST by timothy

Tags: encryption

Posted: March 26th, 2012, 7:49pm CEST by Soulskill

Tags: encryption

Posted: March 26th, 2012, 7:49pm CEST by Soulskill

Tags: encryption

Posted: March 23rd, 2012, 8:05pm CET by Soulskill

Tags: encryption

Posted: March 16th, 2012, 6:03pm CET by Soulskill

Tags: encryption

Posted: March 4th, 2012, 11:18am CET by Soulskill

Tags: encryption

Posted: February 18th, 2012, 6:20pm CET by Soulskill

Tags: encryption

Posted: February 15th, 2012, 1:17am CET by Soulskill

Tags: encryption

Posted: February 9th, 2012, 6:01pm CET by timothy

Tags: encryption

Posted: February 8th, 2012, 6:15am CET by Soulskill

Tags: encryption

Posted: February 7th, 2012, 9:08am CET by Unknown Lamer

Tags: encryption

Posted: February 7th, 2012, 9:08am CET by Unknown Lamer

Tags: encryption

Posted: February 4th, 2012, 12:38am CET by Soulskill

Tags: encryption

Posted: January 28th, 2012, 4:28pm CET by timothy

Tags: encryption

Posted: December 20th, 2011, 4:10am CET by Unknown Lamer

Tags: encryption

Posted: December 20th, 2011, 4:10am CET by Unknown Lamer

Tags: encryption

Posted: December 19th, 2011, 10:59pm CET by Soulskill

Tags: encryption

Posted: December 16th, 2011, 12:12am CET by timothy

Tags: encryption

Posted: December 8th, 2011, 3:34pm CET by timothy

Tags: encryption

Posted: December 8th, 2011, 3:34pm CET by timothy

Tags: encryption

Posted: December 4th, 2011, 6:38pm CET by timothy

Tags: encryption

Posted: December 3rd, 2011, 12:45am CET by timothy

Tags: encryption

Posted: November 29th, 2011, 11:14pm CET by Soulskill

Tags: encryption

Posted: November 28th, 2011, 9:43pm CET by Soulskill

Tags: encryption

Posted: November 25th, 2011, 8:10pm CET by Soulskill

Tags: encryption

Posted: November 25th, 2011, 8:10pm CET by Soulskill

Tags: encryption

Posted: November 23rd, 2011, 9:21pm CET by samzenpus

Tags: encryption

Posted: November 23rd, 2011, 8:38pm CET by samzenpus

Tags: encryption

Posted: November 22nd, 2011, 11:32am CET by Unknown Lamer

Tags: encryption

Posted: November 21st, 2011, 11:50pm CET by Soulskill

Tags: encryption

Posted: November 19th, 2011, 9:10pm CET by timothy

Tags: encryption

Posted: November 17th, 2011, 1:21am CET by samzenpus

Tags: encryption

Posted: October 27th, 2011, 9:26pm CEST by timothy

Tags: encryption

Posted: October 26th, 2011, 6:01am CEST by Soulskill

Tags: encryption

Posted: September 20th, 2011, 9:17pm CEST by Unknown Lamer

Tags: encryption

Posted: September 3rd, 2011, 12:50am CEST by timothy