Cryptosmith

A while back, Popular Science asked me to identify the Best New Security Technology. At the time I simply couldn’t think of anything, and they’ve long since published their issue filled with Best New ____ Technology.

I finally thought of something – self-encrypting mass storage. This can be anything from an encrypting USB drive – the IronKey if you like theatrics – to a self-encrypting hard drive like Seagate’s Momentus line of laptop drives.

While I also rely heavily on software drive encryption (TrueCrypt) I wish that all my hard drives had full disk encryption (FDE). If all drives had FDE, I could recycle drives (i.e. give them to my kids) just by erasing the key. Instead, I have to hook each drive up to an idle machine for a day or so to run a wiping process.

So FDE isn’t just for security paranoids and folks hogtied by compliance regulations. They’re useful for everyone. That is, assuming that the vendors make it easy to use them.

Continue Reading »

Posted under Security | No Comments »

I’ve always been a fan of graphic presentations. More people understand graphs and diagrams than understand equations. While this is a bad thing in some ways, it remains a fact. So it’s always great to see a graphical representation of a really difficult set of concepts.

Jeff Moser Fisher has posted A Stick Figure Guide to the Advanced Encryption Standard (AES). He has wisely structured it in layers. Interested readers can learn about AES to their level of interest or understanding: they can get the history and process, the high-level summary, or go diving into S-boxes.

Great!

Posted under Security & Tech Teaching | No Comments »

Gilbert Vernam was a digital systems designer from the early 20th century. He invented the stream cipher, what browsers often use today to encrypt messages exchanged with protected web sites. In his days, however, the mechanism of choice was the relay: an electromagnetic switch. Vernam also described the one-time pad, and noted the danger in reusing the key stream.

What, then is a Vernam cipher? Is it a stream cipher or a one-time pad? I’ve seen the term used both ways.

Now we can check the source. Steve Bellovin recently blogged on Vernam’s work, and posted a PDF of Vernam’s original  paper. Vernam wrote the paper for an AIEE conference (that’s one of the precursors of today’s IEEE – Bellovin negotiated permission to post the historic paper).

If we look at the historical description, Vernam does not restrict his cipher to the one-time pad case. Thus, a Vernam cipher in practice might – or might not – be a one-time pad. [revised 9/7/09]

Continue Reading »

Posted under History of Technology & Security | No Comments »

Cousin Jon sent me this Wired link: how to bypass iPhone’s 3GS encryption using jailbreaking tools. I haven’t paid serious attention to the iPhone (AT&T hasn’t had a strong signal in my town) but crypto bypass always gets my attention.

In fact, the weakness has nothing to do with protecting personal information on an iPhone. It’s all about third parties: Apple, the cell provider, and possibly an employer who provides/manages the iPhone.

If you’re not troubled by being limited to the iPhone Apps Store, then the threat’s relatively small, especially compared to desktop systems. Moreover, I doubt we’ll see real iPhone viruses as long as most people are happy with Apple’s app restrictions.

Continue Reading »

Posted under Household Tech & Security | No Comments »