Search

The Internet of Things (IoT) market has expanded significantly, encompassing various sectors like home, retail, manufacturing, and transportation, with millions of devices and servers dedicated to monitoring real-world aspects. Regardless of the field, all IoT devices share the characteristic of transitioning from initial ownership to target application ownership to fulfill their intended functions, a process known as onboarding, which requires fast, reliable, and secure interaction between devices and servers. Two distinct approaches to onboarding, trusted and untrusted installers, exist, with trusted installers employing configurator tools to establish trust between devices and servers, while untrusted installers rely on mechanisms like ownership vouchers for authentication, offering scalability and parallel device onboarding.

This article discusses the application of indistinguishability obfuscation for circuits in the context of the pseudo-canonicalization. The article first discusses arithmetic circuits and the use of pseudo-canonical form for polynomials when hiding implementation choices, then applies this to computer programs with discussion of public-key cryptography and program obfuscation. Then the indistinguishability obfuscator for circuits is defined, its assumptions are detailed, and its applications are discussed.

The article looks at the problem of maintaining the confidentiality and security of data kept and processed on virtual machines (VMs) in the cloud and the security approach called confidential computing (CC). It outlines the features of the Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology from semiconductor company AMD.

The author presents information on an encryption technology that permits encrypted data computation without necessitating decryption, enabling the protection of privacy. This type of encryption is referred to as fully homomorphic encryption. The article mentions that development of a general purpose transpiler will simplify the use of fully homomorphic encryption and allow for widespread use of the technology, transforming the way sensitive data is handled.

Traffic classification is essential in network management for a wide range of operations. Recently, it has become increasingly challenging with the widespread adoption of encryption in the Internet, for example, as a de facto in HTTP/2 and QUIC protocols. In the current state of encrypted traffic classification using deep learning (DL), we identify fundamental issues in the way it is typically approached. For instance, although complex DL models with millions of parameters are being used, these models implement a relatively simple logic based on certain header fields of the TLS handshake, limiting model robustness to future versions of encrypted protocols. Furthermore, encrypted traffic is often treated as any other raw input for DL, while crucial domain-specific considerations are commonly ignored. In this paper, we design a novel feature engineering approach used for encrypted Web protocols, and develop a neural network architecture based on stacked long short-term memory layers and convolutional neural networks. We evaluate our approach on a real-world Web traffic dataset from a major Internet service provider and mobile network operator. We achieve an accuracy of 95% in service classification with less raw traffic and a smaller number of parameters, outperforming a state-of-the-art method by nearly 50% fewer false classifications. We show that our DL model generalizes for different classification objectives and encrypted Web protocols. We also evaluate our approach on a public QUIC dataset with finer application-level granularity in labeling, achieving an overall accuracy of 99%. [ABSTRACT FROM AUTHOR]

The article focuses on the research behind hiding secrets within computer programs, also known as program obfuscation. The author discusses how program obfuscation could revolutionize cryptography, examines how it could impact reverse engineering with a proposed virtual black box (VBB), and explores the alternate security of so-called indistinguishability obfuscation (iO)

The article examines efforts being made to establish confidential cloud computing. It discusses the ability of computer hardware to provide a trusted execution environment (TEE), the concept of dynamic TEE implementation, and confidential virtual machines (VMs).

The article discuses the computer science concept known as differential privacy (DP) cryptography, and its use and implementation in developing computer applications. It describes DP's data collection methods, the security aspects of DP, and cryptography for DP. It also discusses various DP frameworks, trust and accuracy in DP, and cryptographic security.

The article examines the timeline for the development of post-quantum cryptography. Warnings from the U.S. National Security Agency and the U.S. National Institute of Standards and Technology to develop public-key cryptography resistant to the quantum computers of the future are reiterated and alleged challenges associated with the transition of cryptography standards are outlined.

The article discusses the issue of hiding metadata for encrypted communications. It mentions the question of maintaining online privacy, the possibility of government agencies using the metadata to intercept encrypted communications, and the questions of computing levels used in opening such communications.

We investigate the security of Diffie-Hellman key exchange as used in popular Internet protocols and find it to be less secure than widely believed. First, we present Logjam, a novel flaw in TLS that lets a man-in-the-middle downgrade connections to "export-grade" Diffie-Hellman. To carry out this attack, we implement the number field sieve discrete logarithm algorithm. After a week-long precomputation for a specified 512-bit group, we can compute arbitrary discrete logarithms in that group in about a minute. We find that 82% of vulnerable servers use a single 512-bit group, and that 8.4% of Alexa Top Million HTTPS sites are vulnerable to the attack. In response, major browsers have changed to reject short groups. We go on to consider Diffie-Hellman with 768- and 1024-bit groups. We estimate that even in the 1024-bit case, the computations are plausible given nation-state resources. A small number of fixed or standardized groups are used by millions of servers; performing precomputation for a single 1024-bit group would allow passive eavesdropping on 18% of popular HTTPS sites, and a second group would allow decryption of traffic to 66% of IPsec VPNs and 26% of SSH servers. A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break. We conclude that moving to stronger key exchange methods should be a priority for the Internet community. [ABSTRACT FROM AUTHOR]

The article discusses binary code analysis in Asia, sometimes referred to as binary analysis, a data security approach to protecting commercial off-the-shelf (COTS) software and gaining knowledge of malware.It discusses scholarly binary analysis research projects including BitBlaze, BAP, and DECAF which involve universities including Carnegie Mellon, California at Berkeley, and Syracuse University. Topics including fuzzing to discover vulnerabilities, memory vulnerabilities, and Automatic Exploit Generation (AEG) which exploits vulnerabilities of binary code.

An introduction to an article about network traffic classification is presented.

Why the law-enforcement access question will not just go away. [ABSTRACT FROM AUTHOR]

Researchers hunt for ways to keep quantum computing honest. [ABSTRACT FROM AUTHOR]

The article discusses proposed benefits of blockchain technologies, including smart contracts, or the automated execution of transactions, encryption and distributed ledger. Topics include the efficiency and cost savings associated with smart contracts, and blockchain's cost savings resulting from disintermediation as it does not require a trusted third party to be virtually immutable.

Can we hide secrets in software? Can we obfuscate programs-- that is, make programs unintelligible while preserving their functionality? What exactly do we mean by "unintelligible"? Why would we even want to do this? In this article, we describe some rigorous cryptographic answers to these quasi-philosophical questions. We also discuss our recent "candidate indistinguishability obfuscation" scheme and its implications. [ABSTRACT FROM AUTHOR]

A review of the article "40 Years of Suffix Trees," by Alberto Apostolico and colleagues is presented.

The article discusses the different aspects and applications of software obfuscation. Topics covered include the fundamental definition and potential applications of obfuscating compilers, the different features of indistinguisability obfuscators, and details relating to the structures and functions of the fully homomorphic encryption and quasi-encryption schemes.

The article focuses on online anonymity tools and the technological challenges to achieving anonymity online. The authors point out that governments, retail companies, and advertisers all gather online data about Internet use. The online anonymity tools that are available are discussed with particular attention paid to Tor, which uses what is described as an “onion routing” approach to promote anonymity. However, the authors point out that Tor can be vulnerable to attack. They then describe the Dissent project, which uses a different approach than Tor; the benefits and the possible shortcomings of the Dissent approach are discussed.

The article offers information on bitcoins. Bitcoin, a digital cryptocurrency which was launched in the year 2009, has been growing gradually. It is a purely digital currency that allows payments to be sent fast over the Internet with very less fees. Digital wallets with advanced interfaces can be found in app stores, and point-of-sale systems allow businesses to accept bitcoins more readily than earlier. Bitcoin's core innovation, which may prolong its effect beyond digital currencies, is the basis of a famous problem in computer science, the Byzantine consensus problem. INSET: Bitcoin¿s Proof-of-Work.

The article discusses the impact of prosthetic intelligence on the implications of law enforcement access to private data. Topics include the impact of human-computer interaction on human intelligence and abilities, the relation of data encryption to freedom of thought, and a legal dispute between the U.S. Federal Bureau of Investigation (FBI) and the firm Apple Inc.

The author looks at a range of risks and potential negative events related to computer systems, calling for a greater effort to anticipate, prevent, and prepare for them. He discusses potential problems including attacks on the cryptographic systems used for computer security such as public-key cryptography; vulnerabilities in computer security related to the needs of government mass surveillance; and vulnerabilities related to the role of computers and computer networks in critical infrastructure such as water supply and electric power systems. Other topics include privacy and anonymity on the Internet, the use of information technology in health care, and climate change.

The article discusses two experiments published in "Physical Review" in August 2016 which demonstrate the potential for quantum mechanics to improve the efficiency of secure data communications through quantum data locking (QDL). Topics include the efficiency of QDL in encrypting information compared to that of other systems such as quantum key distribution (QKD), the ability for users of QKD to agree on an encryption key without risk of it being obtained by others, and speed limitations of QKD.

The article focuses on computer system administrator Edward Snowden's copying of up to 1.7 million top secret documents from the U.S. National Security Agency's (NSA) computer networks and methods of preventing this from happening again in the future. It comments on the need for different sections to have different root passwords and user passwords with traffic between systems encrypted. It states that the ability to plug in USB memory sticks or blank DVDs should be disabled while mobile phones and cameras should be forbidden and guarded against. It talks about the use of Faraday cages to block radio frequency emissions and two-factor authentication. It reflects on the NSA's decision to fire 90 percent of its system administrators and the NSA's cloud computing network.

Cryptographic systems often rely on the secrecy of cryptographic keys given to users. Many schemes, however, cannot resist coercion attacks where the user is forcibly asked by an attacker to reveal the key. These attacks, known as rubber hose cryptanalysis, are often the easiest way to defeat cryptography. We present a defense against coercion attacks using the concept of implicit learning from cognitive psychology. Implicit learning refers to learning of patterns without any conscious knowledge of the learned pattern. We use a carefully crafted computer game to allow a user to implicitly learn a secret password without them having any explicit or conscious knowledge of the trained password. While the trained secret can be used for authentication, participants cannot be coerced into revealing it since they have no conscious knowledge of it. We performed a number of user studies using Amazon's Mechanical Turk to verify that participants can successfully re-authenticate over time and that they are unable to reconstruct or even robustly recognize the trained secret. [ABSTRACT FROM AUTHOR]

The article discusses public-key encryption, a computer science method for securely sharing data over an insecure computer network or storage server. It states that the method is a valuable aspect of securing Internet communication such as HTTPS (Hypertext Transfer Protocol Secure) and SSH (Secure Shell), voice traffic, and confidential files. The author address several issues related to encryption, including access control, data storage and retrieval systems, and functional encryption, which uses a decryption key that allows users to learn specific functions of the encrypted data.

The article presents CryptDB, a system which enables the use of SQL queries over encrypted data and can provide confidentiality for applications which use database management systems (DBMSes). The authors argues that CryptDB addresses threats from adversaries who gain access to or control of DBMS servers or applications, presenting information on the system architecture. The article examines how CryptDB can perform query processing on encrypted databases, SQL-aware encryption, and computing joins supported by CryptDB.

How to guarantee files encrypted and transmitted today stay confidential for years to come. [ABSTRACT FROM AUTHOR]

The interactive proof system model of computation has been studied extensively in computational complexity theory and theoretical cryptography for more than 25 years, and has driven the development of interesting new techniques and insights in those fields. This work considers the quantum interactive proof system model, which is the classical model's natural quantum computational analog. An exact characterization of the expressive power of quantum interactive proof systems is obtained: the collection of computational problems having quantum interactive proof systems consists precisely of those problems solvable with an ordinary classical computer using at most a polynomial amount of memory (or QIP = PSPACE in complexity-theoretic terminology). One striking implication of this characterization is that it implies quantum computing provides no increase in computational power whatsoever over classical computing in the context of interactive proof systems. [ABSTRACT FROM AUTHOR]

Suppose that you want to delegate the ability to process your data, without giving away access to it. We show that this separation is possible: we describe a "fully homomorphic" encryption scheme that keeps data private, but that allows a worker that does not have the secret decryption key to compute any (still encrypted) result of the data, even when the function of the data is very complex. In short, a third party can perform complicated processing of data without being able to see it. Among other things, this helps make cloud computing compatible with privacy. [ABSTRACT FROM AUTHOR]

The article presents the results of a study which investigated computer security flaws in wireless networks. It focused on the problem of public internet access points known as hot spots. These are often unencrypted, or only weakly protected. The danger of malicious software targeting such vulnerable points, and subsequently spreading to other parts of a network, is noted. The study involved a college campus system, and the firewall and port vulnerabilities which were found are discussed. Recommendations on formulating security policies to prevent data security breaches are provided.

The article discusses the history of public key computer cryptography since its 1977 development by computer scientists Whitfield Diffie and electrical engineer Martin E. Hellman. The presentation of the 2015 ACM A.M. Turing Award computing prize to Diffie and Hellman is examined, basic elements of public key cryptography are outlined, and the plans of both researchers for their shares of the prize money are announced.

The article discusses the management of information security with regard to dynamic Web Content Management Systems (WCMS). The paper presents strategies for integrating the goals of information security with eight dimensions of WCMS, including the proper configuration of WCMS on the server, the usage of non-persistent cookies or short-duration persistent cookies transmitted through a secure encrypted connection, and the proper secure design of Web-based forms. A security framework is developed, based upon the integration of security with the eight dimensions of WCMS, and the security of the Web architecture at the level of the WCMS software applications is addressed using the framework.

This article reports on how to achieve cryptographic long-term security. The author explains why information system infrastructures are already vulnerable, why this vulnerability will increase with time, and what computer users can do. The article discusses the RSA digital signature algorithm, which was first proposed in 1978, and why it remains the most important digital signature algorithm. Its security derives from the intractability of factoring composite integers which are generated as the result of two large prime numbers.

The article discusses disk wiping, which is the process of destroying all digital data on a computer system so that it can never be recovered. Disk wiping is important when users are concerned with privacy or are attempting to guard corporate and personal secrets. An evaluation comparing several popular consumer and professional disk wiping utilities, including Cipher, which is built into Microsoft Windows, Cyberscrub, PGP Shred, Wincleaner Destroy-It! Pro, and Evidence Eliminator, is presented.

This article focuses on steganography and steganalysis. The rise of the Internet and multimedia techniques in the mid-1990s has prompted increasing interest in hiding data in digital media. Early research concentrated on watermarking to protect copyrighted multimedia products such as images, audio, video, and text. Data embedding has also been found to be useful in covert communication, or steganography. Compared to watermarking, steganography has drawn less attention until recently, as computer specialists, signal-processing researchers, and multimedia product vendors concerned about information security have recognized that illicit use of the technique might become a threat to the security of the worldwide information infrastructure. Researchers have thus begun to study steganalysis, or the detection of embedded information. Steganography also differs from cryptography, which does not conceal the communication itself but only scrambles the data to prevent eavesdroppers understanding the content. Images are the most popular cover media for steganography and can be stored in a straightforward bitmap format such as BMPor in a compressed format such as JPEG.

Advances in high-performance computing have ironically evolved into threats for computer security. An instant example to this bind is that spam now exceeds 60% of all emails transmissions. Certain rules continue to apply to computational evolution, like Moore's Law, which holds that electronic data processing power will double every 18 months while the equivalent price will halve in the same time frame. Not much improvement has been witnessed even under these situations. Paul Kocher of Cryptography Research Inc. asserts that the current trend stands for building systems that are conceptually strong but in practice, are not able to resist attacks on computer networks. Some believe that cryptography can help reverse this trend, and cryptosystems are playing their part well. However, efforts on this front often go futile, as every new generation of computer brings with it an obsolescence of earlier versions of data encryption techniques. The fact stands that computers cannot surpass human intelligence, and will remain vulnerable.

The article discusses the use of digital watermarking in copyright protection. Digital watermarking, a popular technique for content authentication and forgery prevention, is viewed as an enabling technology to protect distributed content from unauthorized reuse, or reuse with inadequate credit. Digital watermarks of ownership embedded onto digital content offer copyright protection, ownership assertion and integrity checks for digital content and can provide evidence of copyright infringement after an attack. Watermark researchers and information systems professional raised uses regarding the security aspect of watermarking techniques. A key issue to resolve in watermark-based copyright protection is the deadlock problem, which occur when a pirate inserts a watermark in publicly available content and claims he or she is the legitimate owner of the copyright-protected content. There are three ways to break a watermark-based copyright protection system. Attackers can remove embedded watermarks or cause them to be undetectable; they can replace a watermark with a false one and they can insert an addition watermark into copyright-protected content. A simple anti-deadlock strategy with a watermark clearance center could involve a mechanism to set the valid ranges of watermarks for various entities involved.

The article examines the key factors and influences in the development of cryptography. In electronic commerce and communication, encryption and digital signatures are being increasingly used between people who have never met before. Businesses and private individuals encrypt their communication without prior exchange of secret keys. Industry sets up key certification services for handling digitally signed electronic business documents. In these situations, the relying party does not need the signer's secret key and also cannot counterfeit the signature. These security features are only possible due to public key cryptography, which solved seemingly insoluble problems. The role of enabling structures and vocational ethics and how they led to such radical crypto innovation have been examined. In order to solve the problems faced in exchanging confidential correspondence with an unknown individual and that of a digital signature, public key cryptography was invented. It uses two keys, a public one and a secret one. The secret key can be used to sign, and the public key to verify a signature. A public key can also be used to encrypt a message to be sent to someone and the recipient can then use the secret key to decrypt it. Such algorithms avoid negative effects of traditional communication. INSET: Merkle's Puzzle System..

The article focuses on the emerging trends and future of cryptography. Cryptography is an elaborate electronic, mathematical, and computational edifice that transforms trillions of bits into or out of cipher text every second. In cryptography, the problems fall into three general areas. These areas are mathematics, computational complexity and computing technology. The mathematical problems lie largely in the area of algebraic geometry, the branch of mathematics that deals with solving sets of algebraic equations over very general arithmetic structures. Mathematics generally exhibits a very permissive attitude toward the issue of when a problem can be solved, taking little account of efficiency. The progress of computing is the most predicted and perhaps least certain of the three areas. Physicists today are working on quantum computing, an ambitious attempt to expand parallelism in computing by computing in quantum superposition, a phenomenon in which a computer's state evolves toward all possible outcomes simultaneously.

The article features the technical development in the process of designing public-key cryptography to protect international commerce and communications. In 1997, the National Institute of Standards and Technology (NIST) announced a competition for the algorithm, Data Encryption Standard replacement, and held public meetings to discuss the criteria for a proposed Advanced Encryption Standard (AES) with much focus on its key length. NIST allowed foreign participation in the AES competition, settling requirements like implementation of symmetric key cryptography, must of an algorithm to be a block cipher, designing 128-bit blocks algorithm and to have three key sizes of 128, 192 and 256 bits. While designing, nonlinear functions form the basis of cryptographic design. Simplest techniques for encrypting a block of symbols are substitution, which replaces a symbol by another and transposition permutes the symbols of a block around. The purpose of a cryptosystem is to make decryption of messages extremely difficult without the key and the design of a cryptosystem has a dual objective, ensuring difficulty in cryptanalysis while enabling certification of the algorithm's security. Block-structured algorithms, whose non-linearity is achieved by substitution boxes attacked by differential and linear cryptanalysis.

The article focuses on the use of side-channel analysis by hackers to reveal secure cryptographic keys and protected data and some countermeasures. It states that the affordable programmable integrated circuit open-source platform Chip-Whisperer has widened the potential user base of hackers using side-channel attacks. It mentions that side-channel analysis focuses on the core algorithm by detecting changes in data processed by algorithms running on a dedicated hardware unit or microprocessor. It comments on the vulnerability of Web application programming interface keys to side-channel attacks and talks about countermeasures against side-channel attacks.

The article focuses on the use of the obfuscation strategy to protect electronic data from computer hackers. Topics discussed include an attacker's inability to understand the code even if it is accessed, obfuscation techniques' reliance on heuristics, and the development of indistinguishability obfuscation (IO). Also mentioned are challenges associated with building a general-purpose theory of obfuscation, IO's power as a tool for designing cryptography, and the uses of other protocols such as functional encryption.