Crypto

di  Dan Brown – Ediz. Mondadori – Pagg. 427  – € 18,60

Trama: Washington. La trentottenne Susan Fletcher, brillantissima mente matematica e responsabile della divisione di crittologia della National Security Agency, viene convocata d’urgenza nell’ufficio del comandante Strathmore. Qualcuno ha realizzato un programma capace di “ingannare” il più sofisticato strumento informatico di spionaggio al mondo, un supercomputer che può decodificare qualunque testo cifrato a una velocità strabiliante. Pochissimi conoscono l’esistenza di questa macchina, ideata per contrastare le nuove minacce alla sicurezza nell’era di Internet e in grado di controllare la posta elettronica di chiunque. La stessa NSA, nata per proteggere le comunicazione del governo americano e intercettare quelle delle potenze straniere, opera in semiclandestinità, al di fuori del controllo pubblico. Susan non si stupisce quando viene a sapere che “Fortezza Digitale”, così è stato battezzato il programma, è frutto delle ricerche di un genio dell’informatica: il giapponese Ensei Tankado, handicappato dalla nascita per gli effetti del disastro atomico di Hiroshima, che dopo essere stato chiamato negli Stati Uniti a lavorare per l’NSA ha sbattuto la porta in faccia ai suoi capi quando si è accorto che il supercomputer rischiava di trasformarsi in un nuovo Grande Fratello. I suoi intenti sono nobili, ma la sua decisione di boicottare l’operato dell’NSA, mettendo il programma in rete e permettendo a chiunque di scaricarlo, rischia di creare l’anarchia e di assicurare libertà d’azione a spie e criminali.

Letto da: Ro

Opinione: Complicato per chi non mastica di informatica e deludente.

Next will be A.2.5 Finding Square Roots Modulo a Prime

The HMAC construction turns a cryptographic hash algorithm into a keyed hash. It is commonly used for integrity protection when the sender and recipient share a secret key. It was developed to address various problems with arbitrary keyed hash constructions. So why are developers still rolling their own?

One of the original papers on keyed hash constructions describes the motivations for developing a standard for HMAC. In 1995, there was no standardization and cryptographers only worked from hunches as to what constituted a secure keyed hash. This paper summarized two known attacks on some common schemes that had evolved in the absence of a standard.

The first construction the paper attacks is H(k || m), aka “secret prefix”. The key and the message to be authenticated were concatenated and hashed. The authenticator was the resulting hash. This was fatally flawed, as I mentioned in my previous talks on web crypto. Standard hash algorithms that use the Merkle-Damgard construction (like SHA-1) are subject to a length-extension attack. An attacker can trivially create an authenticator for m’ where m’ = m1 || pad || m2 if they have seen the authenticator for m1. (The “pad” value makes the input a multiple of the compression function block size and includes the total length hashed). This flaw was most recently found in the Flickr API.

The second construction was H(m || k), aka “secret suffix”. While the length-extension attack no longer applies because k is unknown to the attacker, this still maximally exposes you to weaknesses in the hash algorithm. Preneel et al described two attacks on this approach.

The first attack is that secret suffix is weaker against offline second-preimage attacks. That is, an attacker can take an authenticator for a known plaintext m and calculate their own plaintext m’ that hashes to the same value as the block just before k. If the input to the hash function just before k is identical, then the output is also the same. This means the attacker can just send m’ and the previously seen authenticator for m and the two will match.

For a secure cryptographic hash function, a second-preimage attack takes 2ⁿ tries where n is the hash size in bits[1]. However, the secret suffix approach is marginally weaker to this kind of attack. If an attacker has seen t text and authenticator pairs, then the effort is only 2ⁿ / t since they can attempt a second-preimage match against any of the authenticators they have seen. This is usually not a problem since second-preimage attacks are usually much harder than finding collisions. As they have aged, all widely-used hash algorithms have fallen to collisions before second-preimage attacks.

The other attack is much more powerful. If the attacker can submit a chosen message to be authenticated, she can attempt an offline collision search. In this case, an attacker searches for two messages, m and m’, that hash to the same value. Once they are found, she requests an authenticator for the innocuous message m. Since a collision means the intermediate hash state before k is mixed in is identical (an “internal collision”), the final authenticator for both will be identical. The attacker then sends the evil message m’ with the authenticator for m, the two match, and the message is accepted as authentic.

This means the secret suffix construction is insecure if collisions can be found in the underlying hash function. Due to the birthday paradox, this takes 2^n/2 work even for a secure hash function (e.g., 2⁶⁴ operations for a 128-bit hash). But it gets worse if the hash is weaker to collisions.

MD5 has multiple demonstrated collisions. Many systems continue to use HMAC-MD5 because a collision alone is not enough to compromise it. Because of the way the key is applied in HMAC, an attacker would have to generate an internal collision with the secret key, which is much harder than colliding with a chosen message[2]. Although this may provide some immediate comfort, it is still important to move to HMAC-SHA256 soon if you are using HMAC-MD5.

In contrast, MD5 with secret suffix is completely compromised due to collisions, especially with the recent advance in chosen-prefix collisions. Currently, this takes about 30 seconds on a laptop. To repeat, under no circumstances should you use an arbitrary hash construction instead of HMAC, and MD5 with secret suffix is completely broken. If you were putting off moving away from MD5(m || k), now would be an excellent time to move to HMAC-SHA256.

Thanks go to Trevor Perrin and Peter Gutmann for comments on this article.

[1] This is not true for longer messages. Multicollisions can be used against each block of a longer message. See the work by Kelsey and Schneier and Joux for more details.

[2] This is a very broad statement about HMAC. A more detailed analysis of its security will have to wait for another post.

… is not as easy as generating random numbers.

P1363 Section 1.9.5 mention that

The most difficult part of generating EC parameters is finding a base point of prime order

So the next things to do is finding a random point in an elliptic curve (prime case A.11.1/binary case A.11.2), and use A.2.5 to find a square root modulo p and use A.2.1 to calculate modular exponentiation.

In the text book, algorithm for elliptic curve key pair generation is only 5 lines. But implementing one line requires many hours understanding P1363.

Now let’s start with A.2.1.

Another guest post by Yehuda Lindell. My reaction will be in a follow-up post.

Recently I thought about applying game-theoretic principles to our work as academics. What are our utility functions and how are they maximized? I have the following observations (if you don’t detect the cynicism below then this is a problem with written media):

1. The first observation is that the “best strategy” is to write papers that are just good enough to get into the conference that you want, but no better. This way you minimize your work while maximizing your publications. “Best paper prizes” can somewhat improve this situation, but it’s not clear that going for “best paper” is a good strategy (it involves much more work, decisions about best paper are rather arbitrary so the chances of winning aren’t that great, and it doesn’t make much of a difference for promotion).
2. The second observation is that you should spend as little time as possible writing. That is, your presentation should be as bad as is possible to have it accepted. Once again, wasting loads of time writing well just reduces your publication count.
3. If your university doesn’t require that you have journal papers, then not only should you not write such papers, you also shouldn’t bother writing up full versions with full proofs. Specifically, write proof sketches that are “just good enough” to convince the program committee and don’t bother fully verifying. It helps to repeatedly use “the full proof will appear in the full version”, but then make sure that you never actually write such a version.
4. I’m sure that one can argue that it’s best to research “easy questions” than hard ones and so on, but I’m not going to relate to this.
5. Finally, you should definitely not waste time writing a book. It seems that a book is considered a nice addition, but 5 papers would probably do more for your promotion.

So, what’s the result of all of the above? You’ll have a nice long CV full of papers that no one will want to read, let alone follow up on. Is it really worth it? After 25 years of research, will you be able to look back and say that you had an impact? What about publishing 1-2 really good papers a year? I personally believe that this will yield much more satisfaction and impact. (I actually did this exercise and looked back over the last 5 years and asked myself how many papers that I published I actually really like and think had a real contribution. I reached the conclusion of 1-2 papers a year, so I’m happy with that. One could always ask me why I bothered doing the others. First, you don’t always know how things will turn out, and there are other reasons. But I don’t want to get too personal with myself .)

I also argue that the strategy above of doing as bad a job as possible without being detected (which is really what 1-5 lead to) may “make sense” for researchers who are very borderline and may not get tenure. However, for all the rest of the community, it makes no sense whatsoever. I would rather publish much less, but have people be happy to read my papers because they have full proofs and are easy to read. What I would really like to argue is that researchers who don’t need to follow the above strategies (and let’s hope that this is the vast majority) should make sure not to get pulled into such behavior. I strongly believe that it will raise your long-term utility!

Unfortunately, in my humble opinion there are too many people who do. Just for one example, I know of a number of great researchers with excellent papers and results that are ridiculously hard to read (and of course do not have full versions). I guess that this is my loss, because I usually don’t read such papers, but I assume that I’m not the only one…

Via Luca, a nice video on the IBM crypto group and homomorphic encryption. (Yes, the lunches are really like that!)

by: Daily.Pk

As most of ‘political aware’ persons know – Zionist regime is well-known for its self-denial – even if the truth about its Zionazi policies comes from respected Jewish individulas, such as South African Jewish judge, Goldstone.

In response to Ankara’s non-stop rubbing of Zionist noses (read it as ‘anti-Semitism’) – Israel’s national airline EIAI has decided to stop subsiding its employees visiting Turkey during the Passover holidays – during which over 80,000 Israeli Jews visit Turkey and spread their immoral culture.

Israel’s major coffee shop chain, IIan, too has decided to join the boycott, according to its director of marketing, Michael Steg, saying: “We have for the time being to stop selling ‘Istambul Coffee’ – our Turkish coffee blend, and we shall keep doing it until matters improve – the airing of Turkish TV drama Ayrilik (Farewell) showing Israeli soldiers as child-killers during Israel’s ‘Operation Cast Lead’ against 1.5 million Palestinians trapped inside Gaza Strip.

Ankara’s recent actions against its old ally – which Zionist-controlled media keeps ignoring – has nothing to do with the so-called ‘anti-Semitism’. It’s as Professor Ephraim Inbar (Bar-IIan University) put it: “Someone has decided to teach Israel a lesson”. Recently, Tel Aviv turned down Turkish Foreign Minister Ahmet Davutoglu’s request to visit Gaza strip and meet Hamas government leaders to negotiate a sort of fair deal between Israeli government and Hamas. Earlier, the reason why the Turkish PM Erdogan blasted Israeli president Shimon Peres at Davos conference – was that Israeli PM Ehud Olmert met Erdogan in Istanbul a few days before Israeli attack on Gaza in December 2008 – and “betrayed” Erdogan, who was conveying messages on phone between Olmer and Damascus (Turkey, then, was playing the part of a negotiator on Israeli request). Israel also infuriated Turkish generals by delaying the delivery of the pre-paid Heron unmanned aviation vehicles (UAV) – and 2008 failed coup against Erdogan government.

“Things have changed. In Davutoglu’s idealogical framework, Israel soesn’t play a central role,” – Ofra Bengio, an expert on Turkey at the Moshe Dayan Center for Middle Eastern and African Studies at Tel Aviv University.

According to Israeli daily Ha’aretz, Turkey is the most popular foreign destination for Israel tourists representing 13% of all departures and generating US$300 million in annual revenue. More than 500,000 Israeli Jews visit Turkey each year for beaches and cheap shopping. Yossi Fattal, head of Israel Tourist and Travel Agent Association, said that travellers’ boycott is unprecedented in Israel (since Peres’ outbusrt against Erdogan at Davos). He believes, however, that the impact will not be as severe as it appears now. “Israeli memory isn’t very long – half a year is like an ice age and the memory will fade.”

Now, how much impact the Israeli (population 7 million) boycott would have on Turkey (70 million) – would be interesting to watch. Turkey is home to over 26,000 Jews (second largest Jewish community in a Muslim-majority country – after Islamic Iran). Turkish Jews are (96% Sephardic, and the rest Ashkenazi and Kurds. However, they have carried immense power in the secular Turkey since WW I – as Christopher Jon Bjerknes wrote:

“Long before the ‘cultural revolution’ of communist china, and starting before the Bolshevik Jews of Russia destroyed Christianity and Christians in the Slavik World, the Doenmeh (the secret Jews of Turkey) and especially Mustafa Kemal (Attaturk), tried very hard to strip Turkey of its religion and its culture. It’s vital to World Jewry to prevent the Muslims of Turkey from taking back their nation and their faith and aligning themselves with their Muslim neighbours.

Encrypt – decrypt successful.

Recently I had delved into the source code of Mozilla’s Weave (the firefox extension part) to check how things are done. I did that because in the recent years, I never found a way to sync different parts of my digital life in a painless way and as a result I’m always in the look for new tools/products that might ease my pain (explaining why nothing works for me, will be analyzed in a different post).

So, during my adventures with the Weave extension, I stumbled upon the “crypto” directory:

[abrown@bifteki]weave $ pwd
/usr/home/abrown/clones/weave
[abrown@bifteki]weave $ ls -1
Makefile
README
crypto/
source/
tests/
tools/


Unfortunately, I didn’t even try building the component due to lack of time. But before bringing my little exploration to a halt, I tried to find some more information about how their cryptography module is utilized by the Weave extension but I didn’t had any luck. However, after a month or so, a friend of mine passed me this wonderful link:
How does Weave use Cryptography?

Really a very nice article explaining Weave’s crypto scheme. Thanks!

I’ve added a database that we can all update. It’s currently still in the works. Right now I only have UFO, Hauntings, and Cryptids for categories, but I plan on adding a Religious section and a Mysterious Locations section.

You can update it, but you have to sign up as a contributor. If you need me to re-send you the invite, you have to let me know.

The Eurocrypt deadline is today, which gives me an excuse to talk about a recent paper of mine that I had been promising to talk about for a while.

In the setting of distributed computation, a protocol is fair if all parties receive their outputs even in the event of malicious behavior by some of the other parties (in particular, even if they abort the protocol early). Unfortunately, Cleve showed in 1986 that complete fairness is impossible — even for some very simple functions — whenever an honest majority is not present. In particular, fairness is impossible, in general, in the two-party setting. (Although complete fairness turns out to be possible for some non-trivial functions, as discussed here.)

As such, there has been a significant amount of work trying to achieve partial fairness. I won’t survey all this work here; instead, I will just note that (1) several papers on the topic don’t give any formal definition of what they are trying to achieve; (2) a few papers give definitions that are either ad-hoc, or are not very easy to understand (to put it mildly); (3) protocols suggested in many of the papers have significant drawbacks.

Expanding a little on this last point, one line of work has studied protocols guaranteeing something of the following form: at any point in the protocol, the computational efforts required by each party to recover their output are within a constant factor of each other. While at first appealing, one severe drawback of this approach is that it leaves ambiguous what the honest party is supposed to do in case of an abort! If the honest party always tries to recover its output, then it can be forced to run for exponential time. On the other hand, if there is some cut-off round before which point the honest party does not invest the time to recover its output, then the adversary can always abort the protocol just before that point.

In a recent paper by Dov Gordon and myself, we suggest for the first time a simulation-based definition of partial fairness within the standard real/ideal world paradigm. (A slightly outdated version of our paper is available here.) Our definition is as follows: we take the usual ideal-world model (used when defining secure computation with complete fairness) and require that the real-world execution of the protocol and this ideal world be indistinguishable up to to an additive distance of (for some specified polynomial ). We refer to this notion as “-security”. Note that -security is technically incomparable to (but intuitively more appealing than) the standard approach (“security with abort”), which weakens the ideal model to one where fairness is not guaranteed at all but requires full-fledged computational indistinguishability (with respect to this weaker ideal model). Also, although the definition of -security allows privacy to be violated with probability , in fact all our protocols are completely private. (Some of them will also be secure with abort.)

In addition to introducing this new definition, we also completely settle the question of feasibility of partial fairness (with respect to this definition) in the two-party setting. Namely, we show:

Positive results:
Let be a (randomized) functionality, where player 1 provides input and receives output , and player 2 provides input and receives output .

1. As long as one of is polynomial-size, then for any polynomial there is a protocol computing that is both -secure and secure-with-abort.
2. As long as one of is polynomial-size, then for any polynomial there is a protocol computing that is -secure.

Negative results:
Our negative results show that the above are optimal:

1. There is a (deterministic) function where each of have super-polynomial size, such that there is no protocol computing that is both -secure and secure-with-abort.
2. There is a (deterministic) function where each of have super-polynomial size, such that there is no protocol computing that is -secure.

Open questions:

This line of work (continuing the earlier work on complete fairness) is among my favorites of the things I’ve worked on recently. Fairness is a natural and basic problem that we still don’t fully understand; questions in the area are easily accessible, yet resolving these questions is difficult and seems to require new techniques. Several compelling questions remain; here are some of my favorites:

• Partial fairness in the multi-party setting is wide open. The only positive results I am aware of (besides those functions for which complete fairness is possible) are for coin tossing, and the only negative results I know about are those that can be derived as extensions of the impossibility results from the two-party case.
• Determining the exact round complexity of protocols achieving fairness or partial fairness seems interesting — not just in its own right, but because I suspect it will shed light on the issue of fairness itself. The round complexity of partially fair, two-party coin tossing was recently resolved by Moran, Naor, and Segev; other than that, the question is completely open.