CipherVerse

On June 10, The Institute of World Politics welcomed Andres Kütt, Head Software Architect, and Liina Areng, Head of International Relations, both of the Estonian Information System Authority to speak on the state of cyber security globally, as well as their country’s pioneering transition to electronic governance. Mr. Kütt and Ms. Areng generously offered their time and expertise to inform the IWP community about the importance of a rapidly changing cyber landscape. 

Mr. Kütt told the audience how there is a constant war being waged between the governments, corporations, and organizations that secure private data and the rogue criminal hackers who seek to steal it from their databases. In reality, he said, there is not a guaranteed method of securing online data in this modern era. Rather, there are differing levels of coding sophistication and mathematical formulas by which cryptographers and cyber attackers engage in their web-based warfare. 

Mr. Kütt explained how, essentially, this worldwide data conflict is driven by secure codes and encryptions that protect data and the efforts by rogue states or actors to disrupt them. Time, he says, is the worst enemy of cryptographers, as their electronic battlements are constantly under siege. The most effective way to mitigate the risk of cyber attack, he noted, is to hire the most talented pool of cyber defenders. 

Mr. Kütt and Ms. Areng informed the audience that governments are at the forefront of the cyber challenges that face the 21st century. The Republic of Estonia in particular has been a global leader in so-called “E-governance,” transforming their Baltic nation of 1.3 million into a cyber powerhouse. Estonia, they report, has been highly successful in its endeavor to render the services and obligations of government into electronic models. For example, Estonia is the only one of its kind in the world to have institutionalized E-voting in national elections. This kind of groundbreaking civic engagement, the speakers emphasized, is dependent on a high degree of trust in its accuracy and incorruptibility. 

Mr. Kütt and Ms. Areng explained how the Estonian government relies on its advanced corps of citizen-cryptographers. The Cyber Defense League was established in 2010 as a response to the unprecedented cyber attacks on the country years earlier. This organization of volunteer cryptographers serves the national cyber defense by donating their talents in service to Estonia. 

Mr. Kütt and Ms. Areng went on to explain the interconnectedness of the digital ecosystems that populate the Internet. What affects one facet of the web is sure to translate into tangible consequences for the other. Further, the immense difficulty in identifying the origins of a cyber attack means that a coherent, reliable encryption is increasingly the only viable avenue of defense. 

Cryptography And Trust- Estonia And The Modern Information Society

Information Security
 1. Introduction
  ○ Security by obscurity
   § Steganography
    □ Hiding data inside another form of data, like using non-used bits in image to hide a message
     § Cool, but not practical.
     § Disadvantages
      ◊ Algorithm secrecy vs. key secrecy
  ○ Cryptography is everywhere and yet if done right, you can barely see it.
  ○ Goals: 
   § Confidentiality
    □ Secrets stay secret.
   § Integrity
    □ Data is not tampered with.
   § Non-Repudiation
    □ No party can deny sending messages.
   § Authentication
    □ Each party can ensure that the sender is what they expect.
  ○ Cryptography
   § Hashing
   § Encryption
   § Signing
   § Protocols
  ○ Random Number Generators
   § Extremely important, almost all encryption/hashing strength is affected by how random the random number generator is.
   § Don't use simple random number, use a cryptographic random number generator with a sophisticated source of entropy.
   § Pseudorandom number generator
   § Dual_EC_DRBG random generator backdoor
 2. Body
  ○ Hashing (one Way)
   § Properties
    □ Fixed length output no matter what size the input was
    □ Very easy to compute the hash of a given message, however very hard to compute from a hash the corresponding input.
    □ Mathematically infeasible to generate a message that has a given hash
    □ Any modification to a message produces a completely different hash that has no relationship to the original message's hash.
    □ It is mathematically infeasible to find two messages with the same hash. Hash Collision
   § Hashing Functions
    □ Provides data integrity, however lacks authentication
    □ Examples
     ® MD5 
      ◊ Considered Insecure
     ® Secure Hash Family SHA-X, Sha-1, Sha-2 [Sha256, Sha512], Sha-3
      ◊ Sha-1 is considered insecure.
      ◊ Sha-1, Sha-2 designed by NSA
      ◊ Sha-3 is not designed by NSA, Competition winner.
    □ Attacks
     ® Brute force
      ◊ CPU's are getting faster and cheaper every day.
      ◊ GPU's are getting faster and cheaper every day.
      ◊ Special Hash calculating hardware is becoming more available especially with the BitCoin push.
     ® Rainbow table attacks
      ◊ Pre-Calculated tables where you can reverse lookup a hash to a value
      ◊ Try www.crackstation.net
   § Hash Message Authentication Codes (HMAC)
    □ Adds authentication to integrity
    □ Can be used with all previous algorithms, HMACMD5, HMACShA1, HMAC256 … etc.
   § Salted Hash
    □ Adds random salt to mitigate rainbow table
    □ Salts are unique per record, and not a secret.
   § Password Based Key Derivation Function (PBKDF2)
    □ RSA Public Key Cryptographic Standard PKCS #5 Version 2.0
    □ Internet Engineering Task Force RFC 2898 Specification
     ® Adds a lot of iterations to slow it just enough to mitigate brute force (default 50,000 iterations)
     ® Adds random salt to mitigate rainbow table
    □ Disadvantage: It can be easily implemented with hardware which makes it vulnerable to bruteforce even with high number of iterations
   § Bcrypt
    □ Password Hashing function
    □ State of the art password hashing
   § Usages
    □ Integrity Check
Password Storage

Our facebook Page
http://facebook.com/askdeveloper

On Sound Cloud
http://soundcloud.com/askdeveloper

Please Like & Subscribe

AskDeveloper Podcast

EP46 - AskDeveloper Podcast - Cryptography - Part 1 - Introduction and Hashing

الحلقة السابقة 
https://soundcloud.com/askdeveloper/ep46-askdeveloper-podcast-cryptography-part-1-introduction-and-hashing
○ Encryption (Two Ways)
   § Symmetric Encryption
    □ Same key both encrypts and decrypts the data.
    □ Very fast, yet exchanging key is tricky
    □ Very Algorithmic
    □ Examples
     ® DES Data Encryption Standard (BROKEN)
      ◊ Uses key of 56 bit length
     ® Triple DES (3DES)
      ◊ Uses three keys (or two unique keys) of 56 bit each
     ® AES Advanced Encryption Standard
      ◊ Uses keys of 128, 192 or 256 bits long
    □ Attacks
     ® Brute force
      ◊ Usually mitigated via increasing key length, as difficulty increases exponentially as key size increases, for example time to crack given a modern super computer.
      Key Size Time To Crack
      56 bits 399 seconds
      128 bits 1.02 * 1018 years
      192 bits 1.87 * 1037 years
      256 bits 3.31 * 1056 years
      ◊ Side-Channel Attacks
   § Asymmetric Encryption
    □ Key pairs have mathematical relationship
    □ Each one can decrypt messages encrypted by the other.
    □ Slow, but exchanging key is trivial
    □ Very Mathematical
    □ Anyone can know the Public Key
     ® The Public key can only be used to encrypt data
    □ The Private key is kept secret, and never leaves the recipient's side.
     ® The Private key can only be used to decrypt data
    □ Examples
     ® RSA (Rivest, Shamir and Adelman)
     ® The de-facto standard in the industry
     ® Public and Private keys are based on large Prime Numbers
   § Hybrid Encryption
    □ Uses both Symmetric and Asymmetric encryption at the same time.
    □ Goals:
     ® Use the performance of Symmetric Crypto 
     ® Convenience of sharing keys using Asymmetric Crypto
     ® HMAC for authentication.
    □ Steps: (Order is very important)
     ® Party 1 (Alice)
      1. Generates a random AES Session Key (32 bytes / 256 bits)
      2. Generates a random Initialization Vector (IV) (16 bytes / 128 bits)
      3. Encrypt the message to be sent using the AES Session Key & IV
      4. Calculate an HMAC of the encrypted message using the AES Session key
      5. Encrypt the AES Session Key using the Public Key of Party 2 (Bob) The recipient.
      6. Sends a packet of (Encrypted Message, Encrypted Session Key, Initialization Vector, and HMAC) to Bob
     ® Party 2 (Bob)
      1. Decrypts Session key using his Private Key
      2. Recalculates the HMAC of the encrypted message (Validates message integrity)
       } If HMAC check pass
        – Decrypts the message using the decrypted AES Session Key and Initialization Vector
       } Otherwise, rejects the message because of integrity check failure.


Our facebook Page
http://facebook.com/askdeveloper

On Sound Cloud
http://soundcloud.com/askdeveloper

Please Like & Subscribe

EP47 - AskDeveloper Podcast - Cryptography - Part 2 - Encryption

○ Digital Signatures
   § Goal: verify Authenticity of a message.
   § Based on Asymmetric Cryptography.
   § Basic operations
    1. Public / Private keys generation (using some algorithm like RSA)
    2. Signing algorithm using the private key
    3. Signature verification algorithm using the corresponding public key
   i. Extending previous Example
    • Steps (Order is very important, bold stuff is the difference added to authenticate sender)
     ® Party 1 (Alice)
      1. Generates a random AES Session Key (32 bytes / 256 bits)
      2. Generates a random Initialization Vector (IV) (16 bytes / 128 bits)
      3. Encrypt the message to be sent using the AES Session Key & IV
      4. Calculate an HMAC of the encrypted message using the AES Session key
      5. Encrypt the AES Session Key using the Public Key of Party 2 (Bob) The recipient.
      6. Calculate Signature using the private signing key on the HMAC
      7. Sends a packet of (Encrypted Message, Encrypted Session Key, Initialization Vector, HMAC, and Signature) to Bob
     ® Party 2 (Bob)
      1. Decrypts Session key using his Private Key
      2. Recalculates the HMAC of the encrypted message (Validates message integrity)
       } If HMAC check pass
        – Verify digital signature using Alice Public Key
         w If signature verification pass
          w Decrypts the message using the decrypted AES Session Key and Initialization Vector
         w Otherwise, identity of the sender couldn't not be verified, reject message.
       } Otherwise, rejects the message because of integrity check failure.
    • Why Order matters?
     ® Timing Side-Channel Attacks
     ® Padding-Oracle Attack
     
  ○ Protocols
   § TLS/SSL
    • How TLS/SSL Works?
    • Mitigates against
     ® Man in the Middle Attacks
     ® Authentication, so the client can be sure it is talking to the correct destination.
   § Public Key Infrastructure (PKI)
    • Certificates aka X.509 Certificate (Sha-1 Signature Issues)
     ® A digitally signed file
     ® Identifies (Computer / User / Device)
     ® Has Public & Private Key, only the certificate owner has the Private Key.
     ® Has Expiration date
     ® Information about the CA that issued the cert 
     ® X.509 Extension Attributes (like Usage attribute)
     ® Revocation Information.
    • Certificate Authority (CA) (CNNIC, WoSign)
     ® Issues, signs and manages certificates.
     ® Famous certificate authorities (Verisign, GoDaddy, … etc).
    • Trust Chains
     ® CA's can delegate the signing job to subordinate CA's
      ◊ Root CA's signs an intermediate signing certificate to the subordinate CA
     ® The subordinate CA can then issue certificates
     ® To validate a certificate, the client validates the signatures of all the intermediate stages and make sure all of them are linked to a Trusted CA
    • Certificate Revocation Lists (CRL's)
     ® When a certificate is compromised (Private Key leaked) it will be published on the CRL, so each time the cert is validated, the CRL list is checked in case cert is revoked.
 3. Takeaways
 4. Books
  a. Understanding Cryptography: A Textbook for Students and Practitionershttps://www.amazon.com/Understanding-Cryptography-Textbook-Students-Practitioners/dp/3642041000


Our facebook Page
http://facebook.com/askdeveloper

On Sound Cloud
http://soundcloud.com/askdeveloper

Please Like & Subscribe

AskDeveloper Podcast - 49 - Cryptography - Part 3 - Digital Signaures and Protocols

by Ejhazz Milford

On this week’s episode, we go over the history of the pigpen cipher. Stay strapped to your seat for this one folks because the history of the pigpen cipher is a long and exciting one. It’ll take you from the secretive Freemasons, to the treacherous Confederates, and to so much more. Who knows. By the end, you may be ready to starting encoding messages of your own.

Works Cited

Butler, W. S., & Keeney, L. D. (2001).Secret messages: concealment, codes, and other types of
ingenious communication. New York: Simon & Schuster.

Khan, David. The Codebreakers . The Macmillan Company, 1967.

MacNulty, W. K. (2006). Freemasonry: symbols, secrets, significance. London: Thames &
Hudson.

Tiburcio, Marco. “Prying Open the Pigpen Cipher.” Wonders & Marvels , Vanderbilt University.

Websites

https://archives.fbi.gov/archives/about-us/lab/forensic-science-communications/fsc/jan2000/olso
n.htm
http://crypto.interactive-maths.com/pigpen-cipher.html
http://www.civilwarsignals.org/cipher/pigpencipher.html

Music

Solo Cello Passion by Doug Maxwell/Media Right Production

YouTube Audio Library

The Pigpen Cipher: Secrets Across Generations

Dr. Tal Rabin is the head of the Cryptography Research Group at the IBM T.J. Watson Research Center. She's an expert on secure cryptographic algorithms. In this episode, she teaches comedians John Hodgman, Josh Sharp, and Shalewa Sharpe about how cryptography works, what a bitcoin really is, and the best recipe for tiramisu. Hosted and created by Chris Duffy. Produced by Pretty Good Friends.

You're the Expert

Bitcoins and Cryptography

#3 John Pacific of NuCypher | Applied Cryptography, Adversarial Thinking & Arbitrary Computation on Encrypted Data

#3 John Pacific of NuCypher | Applied Cryptography, Adversarial Thinking & Arbitrary Computation

Interview location: Palo Alto
Interview date: Thursday 31st Jan, 2018
Company: Cryptomathic
Role: Cryptographer and Security Expert

A number of pioneers developed the cryptographic and technical foundations for which Bitcoin is built upon. Nick Szabo highlighted a number of these people in his Tweet:

“Inventors of the most important technologies in Bitcoin: digital signatures and Merkle trees (Merkle), elliptic curve crypto (Koblitz), malicious-fault-tolerant consensus (Lamport), elliptic curve crypto (independent inventor: Miller).”

Many others along the way have contributed to the success of Bitcoin, either through early work or attempts at created a digital currency, names such as Adam Back, David Chaum and Szabo himself.

Whitfield Diffie sits alongside all of these people. His work on cryptography should not be forgotten in the history of Bitcoin and I had the pleasure of sitting down with him to discuss this, how he was introduced to Bitcoin and other such topics as privacy and security.

The What Bitcoin Did Podcast

Whitfield Diffie on the History of Cryptography

The pending cryptographic Quantum Apocalypse requires that we replace the hashing and encryption algorithms used through the internet, enterprise networks, mobile service, and popular devices. Join our experts to learn more about the requirements for quantum-resistant algorithms to survive the Quantum Apocalypse.

Root Causes 06: Quantum-Resistant Cryptography

Prof Gary McGuire (UCD) - “Post Quantum Cryptography”, a podcast from the UCD/IBM Quantum Technologies Colloquium 2019.

The colloquium focused on emerging research opportunities in Quantum Technologies and was organised in partnership with IBM Research - Ireland, UCD Research, and the UCD Institute for Discovery. It took place in the Moore Auditorium in the O'Brien Centre for Science at UCD on 28th of March 2019.

Quantum technology is an emerging and highly interdisciplinary field of study that draws on expertise in Science and Engineering but is expected to be highly disruptive to a range of other disciplines. Though early in its development, quantum computing is now available on real hardware via the cloud through IBM Q. This radically new kind of computing holds open the possibility of solving some problems that are now and perhaps always will be intractable for “classical” computers.

This event will cover a broad spectrum of cutting-edge technologies ranging from quantum simulation, to quantum computing, to post-quantum cryptography, and will combine academic and industrial sessions, with contributions from leading scientists and practitioners in the field. As part of this event, IBM Research -- Ireland will introduce IBM Q, an industry-first initiative to build universal quantum computers for business and science, and UCD will outline exciting new developments in Quantum Computing hardware.

UCD Institute for Discovery supports emerging interdisciplinary research in University College Dublin and helps to build and strengthen interdiscplinary networks and research themes across all disciplines in the University. For more information go to www.ucd.ie/discovery

The speakers were Dr Martin Mevissen (IBM Research), Prof Monique Laurent (CWI Research Centre), Prof Gary McGuire (UCD), Prof Jiri Vala (NUI Maynooth), Dr Krzysztof Pomorski (UCD), Dr Radu Marinescu (IBM Research-Ireland), Dr Elena Blokhina (UCD), Dr Dirk Leipold (CEO of equal1.labs), Prof Bogdan Staszewski (UCD), Dr Jakub Marecek (IBM).

The colloquium focused on emerging research opportunities in Quantum Technologies and was organised in partnership with IBM Research - Ireland, UCD Research, and the UCD Institute for Discovery.
It took place in the Moore Auditorium in the O'Brien Centre for Science at UCD on 28th of March 2019.

UCD Institute for Discovery supports emerging interdisciplinary research in University College Dublin and helps to build and strengthen interdiscplinary networks and research themes across all disciplines in the University. For more information go to www.ucd.ie/discovery

The speakers were Dr Martin Mevissen (IBM Research), Prof Monique Laurent (CWI Research Centre), Prof Gary McGuire (UCD), Prof Jiri Vala (NUI Maynooth), Dr Krzysztof Pomorski (UCD), Dr Radu Marinescu (IBM Research-Ireland), Dr Elena Blokhina (UCD), Dr Dirk Leipold (CEO of equal1.labs), Prof Bogdan Staszewski (UCD), Dr Jakub Marecek (IBM).

Gary McGuire - Post Quantum Cryptography

In this podcast, we will discuss Blockchain technology and associated definitions to understand its potential use cases. As a new and cutting-edge technology, it brings to the table the idea of decentralization by exploring concepts of cryptography and hashing. The word cryptography has been used a lot lately, and many people think it’s a very new cutting-edge science. In this lesson, we are breaking down the complexity of these high-brow terms to help you understand the nitty-gritties. 

Read more : https://www.ionixxtech.com/resource

Ionixx Blockchain 101 |  Blockchain and Cryptography Definitions

Will quantum cryptography affect the DNS and DNSSEC? If so, how? and when? Today at the "Tech Day" part of the ICANN 66 meeting in Montreal, John Levine spoke about what impact quantum crypto might have on DNS. His slides are available at:

https://static.ptbl.co/static/attachments/232986/1572893313.pdf?1572893313

In this TDYR episode, I talk about what John said in that session and my thoughts around it all.

NIST's "Post-Quantum Cryptography" work mentioned in the episode can be found at: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Post-Quantum-Cryptography-Standardization

TDYR 368 - Will Quantum Cryptography Affect the DNS and DNSSEC?

Founder of EPIC Knowledge Society and SPACE Creative Culture Labs. I am a Futurist and Data Scientist with Professional Mastery and Pragmatic Insights on Digital Transformation and Innovation Management with extensive credentials on Digital Enterprise Architectures, Crypto Economics, Customer Experience Design, Social Entrepreneurship Incubation, Business Model Innovation, Innovation Ecosystems, Innovation Analytics, Innovation Consulting, Social Business Networks, Academic Research Networks, Industrial Research Alliances, New Service Incubation, New Product Incubation, New Platform Innovation, High performing Teams, Cross Competency Innovation etc.

CipherVerse

Gokul B. Alex