912 research outputs found
The New South Wales iVote System: Security Failures and Verification Flaws in a Live Online Election
In the world's largest-ever deployment of online voting, the iVote Internet
voting system was trusted for the return of 280,000 ballots in the 2015 state
election in New South Wales, Australia. During the election, we performed an
independent security analysis of parts of the live iVote system and uncovered
severe vulnerabilities that could be leveraged to manipulate votes, violate
ballot privacy, and subvert the verification mechanism. These vulnerabilities
do not seem to have been detected by the election authorities before we
disclosed them, despite a pre-election security review and despite the system
having run in a live state election for five days. One vulnerability, the
result of including analytics software from an insecure external server,
exposed some votes to complete compromise of privacy and integrity. At least
one parliamentary seat was decided by a margin much smaller than the number of
votes taken while the system was vulnerable. We also found protocol flaws,
including vote verification that was itself susceptible to manipulation. This
incident underscores the difficulty of conducting secure elections online and
carries lessons for voters, election officials, and the e-voting research
community
The Myth of Superiority of American Encryption Products
Encryption software and hardware use sophisticated mathematical algorithms to encipher a message so that only the intended recipient may read it. Fearing that criminals and terrorists will use encryption to evade authorities, the United States now restricts the export of encryption products with key lengths of more than 56 bits. The controls are futile, because strong encryption products are readily available overseas. Foreign-made encryption products are as good as, or better than, U.S.-made products. U.S. cryptographers have no monopoly on the mathematical knowledge and methods used to create strong encryption. Powerful encryption symmetric-key technologies developed in other countries include IDEA and GOST. Researchers in New Zealand have developed very strong public-key encryption systems. As patents on strong algorithms of U.S. origin expire, researchers in other countries will gain additional opportunities to develop strong encryption technology based on those algorithms
An Overview of Cryptography (Updated Version, 3 March 2016)
There are many aspects to security and many applications, ranging from secure commerce and payments to private communications and protecting passwords. One essential aspect for secure communications is that of cryptography...While cryptography is necessary for secure communications, it is not by itself sufficient. This paper describes the first of many steps necessary for better security in any number of situations.
A much shorter, edited version of this paper appears in the 1999 edition of Handbook on Local Area Networks published by Auerbach in September 1998
SoK: Why Johnny Can't Fix PGP Standardization
Pretty Good Privacy (PGP) has long been the primary IETF standard for
encrypting email, but suffers from widespread usability and security problems
that have limited its adoption. As time has marched on, the underlying
cryptographic protocol has fallen out of date insofar as PGP is unauthenticated
on a per message basis and compresses before encryption. There have been an
increasing number of attacks on the increasingly outdated primitives and
complex clients used by the PGP eco-system. However, attempts to update the
OpenPGP standard have failed at the IETF except for adding modern cryptographic
primitives. Outside of official standardization, Autocrypt is a "bottom-up"
community attempt to fix PGP, but still falls victim to attacks on PGP
involving authentication. The core reason for the inability to "fix" PGP is the
lack of a simple AEAD interface which in turn requires a decentralized public
key infrastructure to work with email. Yet even if standards like MLS replace
PGP, the deployment of a decentralized PKI remains an open issue
Cryptanalytic Attacks on IDEA Block Cipher
International data encryption algorithm (IDEA) is a secret key or symmetric key block cipher. The purpose of IDEA was to replace data encryption standard (DES) cipher, which became practically insecure due to its small key size of 56 bits and increase in computational power of systems. IDEA cipher mainly to provide data confidentiality in variety of applications such as commercial and financial application e.g. pretty good privacy (PGP) protocol. Till 2015, no successful linear or algebraic weaknesses IDEA of have been reported. In this paper, author explained IDEA cipher, its application in PGP and did a systematic survey of various attacks attempted on IDEA cipher. The best cryptanalysis result which applied to all keys could break IDEA up to 6 rounds out of 8.5 rounds of the full IDEA cipher1. But the attack requires 264 known plaintexts and 2126.8 operations for reduced round version. This attack is practically not feasible due to above mention mammoth data and time requirements. So IDEA cipher is still completely secure for practical usage. PGP v2.0 uses IDEA cipher in place of BassOmatic which was found to be insecure for providing data confidentiality
RSA Keys Quality in a Real-world Organizational Certificate Dataset: a Practical Outlook
This research investigates the intricacies of X.509 certificates within a comprehensive corporate infrastructure. Spanning over two decades, the examined enterprise has heavily depended on its internal certificate authority and Public Key Infrastructure (PKI) to uphold its data and systems security. With the broad application of these certificates, from personal identification on smart cards to device and workstation authentication via Trusted Platform Modules (TPM), our study seeks to address a pertinent question on how prevalent are weak RSA keys within such a vast internal certificate repository. Previous research focused primarily on key sets publicly accessible from TLS and SSH servers or PGP key repositories. On the contrary, our investigation provides insights into the private domain of an enterprise, introducing new dimensions to this problem. Among our considerations are the trustworthiness of hardware and software solutions in generating keys and the consequential implications of identified vulnerabilities on organizational risk management. The obtained results can contribute to enhancing security strategies in enterprises
Encryption Backdoors: A Discussion of Feasibility, Ethics, and the Future of Cryptography
In the age of technological advancement and the digitization of information, privacy seems to be all but an illusion. Encryption is supposed to be the white knight that keeps our information and communications safe from unwanted eyes, but how secure are the encryption algorithms that we use? Do we put too much trust in those that are charged with implementing our everyday encryption systems? This paper addresses the concept of backdoors in encryption: ways that encryption systems can be implemented so that the security can be bypassed by those that know about its existence. Many governments around the world are pushing for these kinds of bypassing mechanisms to exist so that they may utilize them. The paper discusses the ethical implications of these policies as well as how our current encryption algorithms will hold up to future technology such as quantum computers
Elliptic Curve Cryptography Services for Mobile Operating Systems
Mobile devices as smartphones, tablets and laptops, are nowadays considered indispensable objects
by most people in developed countries. A s personal and work assistant s , some of th e s e
devices store , process and transmit sensitive and private data. Naturally , the number of mobile
applications with integrated cryptographic mechanisms or offering security services has been
significantly increasing in the last few years. Unfortunately, not all of those applications are secure
by design, while other may not implement the cryptographic primitives correctly. Even the
ones that implement them correctly may suffer from longevity problems, since cryptographic
primitives that are considered secure nowadays may become obsolete in the next few years.
Rivest, Shamir and Adleman (RSA) is an example of an widely used cryptosystem that may become
depleted shorty . While the security issues in the mobile computing environment may be of
median severity for casual users, they may be critical for several professional classes, namely
lawyers, journalists and law enforcement agents. As such, it is important to approach these
problems in a structured manner.
This master’s program is focused on the engineering and implementation of a mobile application
offering a series of security services. The application was engineered to be secure by design
for the Windows Phone 8.1 Operating System (OS) which, at the time of writing this dissertation,
was the platform with the most discreet offer in terms of applications of this type. The
application provides services such as secure exchange of a cryptographic secret, encryption and
digital signature of messages and files, management of contacts and encryption keys and secure
password generation and storage. Part of the cryptographic primitives used in this work
are from the Elliptic Curve Cryptography (ECC) theory, for which the discrete logarithm problem
is believed to be harder and key handling is easier. The library defining a series of curves
and containing the procedures and operations supporting the ECC primitives was implemented
from scratch, since there was none available, comprising one of the contributions of this work.
The work evolved from the analysis of the state-of-the-art to the requirements analysis and
software engineering phase, thoroughly described herein, ending up with the development of a
prototype. The engineering of the application included the definition of a trust model for the
exchange of public keys and the modeling of the supporting database.
The most visible outcomes of this master’s program are the fully working prototype of a mobile
application offering the aforementioned security services, the implementation of an ECC
library for the .NET framework, and this dissertation. The source code for the ECC library was
made available online on GitHub with the name ECCryptoLib [Ana15]. Its development and
improvement was mostly dominated by unit testing. The library and the mobile application
were developed in C?. The level of security offered by the application is guaranteed via the
orchestration and combination of state-of-the-art symmetric key cryptography algorithms, as the Advanced Encryption Standard (AES) and Secure Hash Algorithm 256 (SHA256) with the ECC
primitives. The generation of passwords is done by using several sensors and inputs as entropy
sources, which are fed to a cryptographically secure hash function. The passwords are stored in
an encrypted database, whose encryption key changes every time it is opened, obtained using
a Password-Based Key Derivation Function 2 (PBKDF2) from a master password. The trust model
for the public keys designed in the scope of this work is inspired in Pretty Good Privacy (PGP),
but granularity of the trust levels is larger.Dispositivos móveis como computadores portáteis, smartphones ou tablets, são, nos dias de
hoje, considerados objectos indispensáveis pela grande maioria das pessoas residentes em países
desenvolvidos. Por serem utilizados como assistentes pessoais ou de trabalho, alguns destes
dispositivos guardam, processam e transmitem dados sensíveis ou privados. Naturalmente,
o número de aplicações móveis com mecanismos criptográficos integrados ou que oferecem
serviços de segurança, tem vindo a aumentar de forma significativa nos últimos anos. Infelizmente,
nem todas as aplicações são seguras por construção, e outras podem não implementar
as primitivas criptográficas corretamente. Mesmo aquelas que as implementam corretamente
podem sofrer de problemas de longevidade, já que primitivas criptográficas que são hoje em dia
consideradas seguras podem tornar-se obsoletas nos próximos anos. O Rivest, Shamir and Adleman
(RSA) constitui um exemplo de um sistema criptográfico muito popular que se pode tornar
obsoleto a curto prazo. Enquanto que os problemas de segurança em ambientes de computação
móvel podem ser de média severidade para utilizadores casuais, estes são normalmente críticos
para várias classes profissionais, nomeadamente advogados, jornalistas e oficiais da justiça. É,
por isso, importante, abordar estes problemas de uma forma estruturada.
Este programa de mestrado foca-se na engenharia e implementação de uma aplicação móvel
que oferece uma série de serviços de segurança. A aplicação foi desenhada para ser segura por
construção para o sistema operativo Windows Phone 8.1 que, altura em que esta dissertação foi
escrita, era a plataforma com a oferta mais discreta em termos de aplicações deste tipo. A aplicação
fornece funcionalidades como trocar um segredo criptográfico entre duas entidades de
forma segura, cifra, decifra e assinatura digital de mensagens e ficheiros, gestão de contactos
e chaves de cifra, e geração e armazenamento seguro de palavras-passe. Parte das primitivas
criptográficas utilizadas neste trabalho fazem parte da teoria da criptografia em curvas elípticas,
para a qual se acredita que o problema do logaritmo discreto é de mais difícil resolução
e para o qual a manipulação de chaves é mais simples. A biblioteca que define uma série de
curvas, e contendo os procedimentos e operações que suportam as primitivas criptográficas, foi
totalmente implementada no âmbito deste trabalho, dado ainda não existir nenhuma disponível
no seu início, compreendendo assim uma das suas contribuições. O trabalho evoluiu da análise
do estado da arte para o levantamento dos requisitos e para a fase de engenharia de software,
aqui descrita detalhadamente, culminando no desenvolvimento de um protótipo. A engenharia
da aplicação incluiu a definição de um sistema de confiança para troca de chaves públicas e
também modelação da base de dados de suporte.
Os resultados mais visíveis deste programa de mestrado são o protótipo da aplicação móvel, completamente
funcional e disponibilizando as funcionalidades de segurança acima mencionadas,
a implementação de uma biblioteca Elliptic Curve Cryptography (ECC) para framework .NET, e esta dissertação. O código fonte com a implementação da biblioteca foi publicada online.
O seu desenvolvimento e melhoramento foi sobretudo dominado por testes unitários. A biblioteca
e a aplicação móvel foram desenvolvidas em C?. O nível de segurança oferecido pela
aplicação é garantido através da orquestração e combinação de algoritmos da criptografia de
chave simétrica atuais, como o Advanced Encryption Standard (AES) e o Secure Hash Algorithm
256 (SHA256), com as primitivas ECC. A geração de palavras-passe é feita recorrendo utilizando
vários sensores e dispoitivos de entrada como fontes de entropia, que posteriormente são alimentadas
a uma função de hash criptográfica. As palavras-passe são guardadas numa base de
dados cifrada, cuja chave de cifra muda sempre que a base de dados é aberta, sendo obtida
através da aplicação de um Password-Based Key Derivation Function 2 (PBKDF2) a uma palavrapasse
mestre. O modelo de confiança para chaves públicas desenhado no âmbito deste trabalho
é inspirado no Pretty Good Privacy (PGP), mas a granularidade dos níveis de confiança é superior
- …