CipherVerse

On June 10, The Institute of World Politics welcomed Andres Kütt, Head Software Architect, and Liina Areng, Head of International Relations, both of the Estonian Information System Authority to speak on the state of cyber security globally, as well as their country’s pioneering transition to electronic governance. Mr. Kütt and Ms. Areng generously offered their time and expertise to inform the IWP community about the importance of a rapidly changing cyber landscape. 

Mr. Kütt told the audience how there is a constant war being waged between the governments, corporations, and organizations that secure private data and the rogue criminal hackers who seek to steal it from their databases. In reality, he said, there is not a guaranteed method of securing online data in this modern era. Rather, there are differing levels of coding sophistication and mathematical formulas by which cryptographers and cyber attackers engage in their web-based warfare. 

Mr. Kütt explained how, essentially, this worldwide data conflict is driven by secure codes and encryptions that protect data and the efforts by rogue states or actors to disrupt them. Time, he says, is the worst enemy of cryptographers, as their electronic battlements are constantly under siege. The most effective way to mitigate the risk of cyber attack, he noted, is to hire the most talented pool of cyber defenders. 

Mr. Kütt and Ms. Areng informed the audience that governments are at the forefront of the cyber challenges that face the 21st century. The Republic of Estonia in particular has been a global leader in so-called “E-governance,” transforming their Baltic nation of 1.3 million into a cyber powerhouse. Estonia, they report, has been highly successful in its endeavor to render the services and obligations of government into electronic models. For example, Estonia is the only one of its kind in the world to have institutionalized E-voting in national elections. This kind of groundbreaking civic engagement, the speakers emphasized, is dependent on a high degree of trust in its accuracy and incorruptibility. 

Mr. Kütt and Ms. Areng explained how the Estonian government relies on its advanced corps of citizen-cryptographers. The Cyber Defense League was established in 2010 as a response to the unprecedented cyber attacks on the country years earlier. This organization of volunteer cryptographers serves the national cyber defense by donating their talents in service to Estonia. 

Mr. Kütt and Ms. Areng went on to explain the interconnectedness of the digital ecosystems that populate the Internet. What affects one facet of the web is sure to translate into tangible consequences for the other. Further, the immense difficulty in identifying the origins of a cyber attack means that a coherent, reliable encryption is increasingly the only viable avenue of defense. 

Cryptography And Trust- Estonia And The Modern Information Society

Information Security
 1. Introduction
  ○ Security by obscurity
   § Steganography
    □ Hiding data inside another form of data, like using non-used bits in image to hide a message
     § Cool, but not practical.
     § Disadvantages
      ◊ Algorithm secrecy vs. key secrecy
  ○ Cryptography is everywhere and yet if done right, you can barely see it.
  ○ Goals: 
   § Confidentiality
    □ Secrets stay secret.
   § Integrity
    □ Data is not tampered with.
   § Non-Repudiation
    □ No party can deny sending messages.
   § Authentication
    □ Each party can ensure that the sender is what they expect.
  ○ Cryptography
   § Hashing
   § Encryption
   § Signing
   § Protocols
  ○ Random Number Generators
   § Extremely important, almost all encryption/hashing strength is affected by how random the random number generator is.
   § Don't use simple random number, use a cryptographic random number generator with a sophisticated source of entropy.
   § Pseudorandom number generator
   § Dual_EC_DRBG random generator backdoor
 2. Body
  ○ Hashing (one Way)
   § Properties
    □ Fixed length output no matter what size the input was
    □ Very easy to compute the hash of a given message, however very hard to compute from a hash the corresponding input.
    □ Mathematically infeasible to generate a message that has a given hash
    □ Any modification to a message produces a completely different hash that has no relationship to the original message's hash.
    □ It is mathematically infeasible to find two messages with the same hash. Hash Collision
   § Hashing Functions
    □ Provides data integrity, however lacks authentication
    □ Examples
     ® MD5 
      ◊ Considered Insecure
     ® Secure Hash Family SHA-X, Sha-1, Sha-2 [Sha256, Sha512], Sha-3
      ◊ Sha-1 is considered insecure.
      ◊ Sha-1, Sha-2 designed by NSA
      ◊ Sha-3 is not designed by NSA, Competition winner.
    □ Attacks
     ® Brute force
      ◊ CPU's are getting faster and cheaper every day.
      ◊ GPU's are getting faster and cheaper every day.
      ◊ Special Hash calculating hardware is becoming more available especially with the BitCoin push.
     ® Rainbow table attacks
      ◊ Pre-Calculated tables where you can reverse lookup a hash to a value
      ◊ Try www.crackstation.net
   § Hash Message Authentication Codes (HMAC)
    □ Adds authentication to integrity
    □ Can be used with all previous algorithms, HMACMD5, HMACShA1, HMAC256 … etc.
   § Salted Hash
    □ Adds random salt to mitigate rainbow table
    □ Salts are unique per record, and not a secret.
   § Password Based Key Derivation Function (PBKDF2)
    □ RSA Public Key Cryptographic Standard PKCS #5 Version 2.0
    □ Internet Engineering Task Force RFC 2898 Specification
     ® Adds a lot of iterations to slow it just enough to mitigate brute force (default 50,000 iterations)
     ® Adds random salt to mitigate rainbow table
    □ Disadvantage: It can be easily implemented with hardware which makes it vulnerable to bruteforce even with high number of iterations
   § Bcrypt
    □ Password Hashing function
    □ State of the art password hashing
   § Usages
    □ Integrity Check
Password Storage

Our facebook Page
http://facebook.com/askdeveloper

On Sound Cloud
http://soundcloud.com/askdeveloper

Please Like & Subscribe

AskDeveloper Podcast

EP46 - AskDeveloper Podcast - Cryptography - Part 1 - Introduction and Hashing

#3 John Pacific of NuCypher | Applied Cryptography, Adversarial Thinking & Arbitrary Computation on Encrypted Data

#3 John Pacific of NuCypher | Applied Cryptography, Adversarial Thinking & Arbitrary Computation

Interview location: Palo Alto
Interview date: Thursday 31st Jan, 2018
Company: Cryptomathic
Role: Cryptographer and Security Expert

A number of pioneers developed the cryptographic and technical foundations for which Bitcoin is built upon. Nick Szabo highlighted a number of these people in his Tweet:

“Inventors of the most important technologies in Bitcoin: digital signatures and Merkle trees (Merkle), elliptic curve crypto (Koblitz), malicious-fault-tolerant consensus (Lamport), elliptic curve crypto (independent inventor: Miller).”

Many others along the way have contributed to the success of Bitcoin, either through early work or attempts at created a digital currency, names such as Adam Back, David Chaum and Szabo himself.

Whitfield Diffie sits alongside all of these people. His work on cryptography should not be forgotten in the history of Bitcoin and I had the pleasure of sitting down with him to discuss this, how he was introduced to Bitcoin and other such topics as privacy and security.

The What Bitcoin Did Podcast

Whitfield Diffie on the History of Cryptography

The pending cryptographic Quantum Apocalypse requires that we replace the hashing and encryption algorithms used through the internet, enterprise networks, mobile service, and popular devices. Join our experts to learn more about the requirements for quantum-resistant algorithms to survive the Quantum Apocalypse.

Root Causes 06: Quantum-Resistant Cryptography

The media lies, governments mismanage, and our financial systems are failing us. In Mr Obnoxious, Peter McCormack explores the new frontier of tech, money and governance.