Category: cryptography

Auto Added by WPeMatico

Encryption Policy and Freedom of the Press

Posted on By infossl
academicpapers, backdoors, cryptography, cryptowars, encryption, nationalsecuritypolicy, Security technology

Interesting law journal article: “Encryption and the Press Clause,” by D. Victoria Barantetsky. Abstract: Almost twenty years ago, a hostile debate over whether government could regulate encryption — later named the Crypto Wars — seized the country. At the center of this debate stirred one simple question: is encryption protected speech? This issue touched all … Read More “Encryption Policy and Freedom of the Press” »

Using Intel's SGX to Attack Itself

Posted on By infossl
academicpapers, cryptography, intel, keys, malware, Security technology

Researchers have demonstrated using Intel’s Software Guard Extensions to hide malware and steal cryptographic keys from inside SGX’s protected enclave: Malware Guard Extension: Using SGX to Conceal Cache Attacks Abstract:In modern computer systems, user processes are isolated from each other by the operating system and the hardware. Additionally, in a cloud scenario it is crucial … Read More “Using Intel's SGX to Attack Itself” »

The CIA's “Development Tradecraft DOs and DON'Ts”

Posted on By infossl
cia, cryptography, encryption, hacking, malware, Security technology, tradecraft

Useful best practices for malware writers, courtesy of the CIA. Seems like a lot of good advice. General: DO obfuscate or encrypt all strings and configuration data that directly relate to tool functionality. Consideration should be made to also only de-obfuscating strings in-memory at the moment the data is needed. When a previously de-obfuscated value … Read More “The CIA's “Development Tradecraft DOs and DON'Ts”” »

More on the CIA Document Leak

Posted on By infossl
cia, cryptography, leaks, malware, russia, Security technology, wikileaks

If I had to guess right now, I’d say the documents came from an outsider and not an insider. My reasoning: One, there is absolutely nothing illegal in the contents of any of this stuff. It’s exactly what you’d expect the CIA to be doing in cyberspace. That makes the whistleblower motive less likely. And … Read More “More on the CIA Document Leak” »

Twofish Power Analysis Attack

Posted on By infossl
academicpapers, cryptanalysis, cryptography, encryption, Security technology, sidechannelattacks, twofish

New paper: “A Simple Power Analysis Attack on the Twofish Key Schedule.” This shouldn’t be a surprise; these attacks are devastating if you don’t take steps to mitigate them. The general issue is if an attacker has physical control of the computer performing the encryption, it is very hard to secure the encryption inside the … Read More “Twofish Power Analysis Attack” »

Let's Encrypt Is Making Web Encryption Easier

Posted on By infossl
academicpapers, certificates, cryptography, encryption, Security technology

That’s the conclusion of a research paper: Once [costs and complexity] are eliminated, it enables big hosting providers to issue and deploy certificates for their customers in bulk, thus quickly and automatically enable encryption across a large number of domains. For example, we have shown that currently, 47% of LE certified domains are hosted at … Read More “Let's Encrypt Is Making Web Encryption Easier” »