Search

The recent case between Apple and the FBI, in which Apple refused to comply with a court order to aid the FBI in overriding the security features of an iPhone used by one of the San Bernardino terrorists, brought the tension between national security and individual rights to the forefront. This article looks at the case and these two core values from a liberal communitarian ethics perspective, and provides an analysis of how these values are reflected in U.S. law. It concludes with an ethical discussion relevant to the resolution of differences between high-tech corporations and the government. [ABSTRACT FROM AUTHOR]

To analyze self-reported HIPAA compliance with mobile technologies among residents, fellows, and attendings at ACGME training programs. A digital survey was sent to 678 academic institutions over a 1-month period. 2427 responses were analyzed using Chi-squared tests for independence. Post-hoc Bonferroni correction was applied for all comparisons between training levels, clinical setting, and specialty. 58 % of all residents self-report violating HIPAA by sharing protected health information (PHI) via text messaging with 27 % reporting they do it 'often' or 'routinely' compared to 15-19 % of attendings. For all specialties, 35 % of residents use text messaging photo or video sharing with PHI. Overall, 5 % of respondents 'often' or 'routinely' used HIPAA compliant (HCApps) with no significant differences related to training level. 20 % of residents admitted to using non-encrypted email at some point. 53 % of attendings and 41 % of residents utilized encrypted email routinely. Physicians from surgical specialties compared to non-surgical specialties demonstrated higher rates of HIPAA violations with SMS use (35 % vs. 17.7 %), standard photo/video messages (16.3 % vs. 4.7 %), HCApps (10.9 % vs. 4.9 %), and non-HCApps (5.6 % vs 1.5 %). The most significant barriers to complying with HIPAA were inconvenience (58 %), lack of knowledge (37 %), unfamiliarity (34 %), inaccessible (29 %) and habit (24 %). Medical professionals must acknowledge that despite laws to protect patient confidentiality in the era of mobile technology, over 50 % of current medical trainees knowingly violate these rules regularly despite the threat of severe consequences. The medical community must further examine the reason for these inconsistencies and work towards possible solutions. [ABSTRACT FROM AUTHOR]

Summary: The aims of this study are to develop a cloud-based application of the Fracture Liaison Service for practitioners to coordinate the care of osteoporotic patients after suffering primary fractures and provide a performance feedback portal for practitioners to determine quality of care. The application provides continuity of care, improved patient outcomes, and reduced medical costs. Introduction: The purpose of this study is to describe the content development and functionality of a cloud-based application to broadly deploy the Fracture Liaison Service (FLS) to coordinate post-fracture care for osteoporotic patients. Methods: The Bone Health Collaborative developed the FLS application in 2013 to support practitioners' access to information and management of patients and provide a feedback portal for practitioners to track their performance in providing quality care. A five-step protocol (identify, inform, initiate, investigate, and iterate) organized osteoporotic post-fracture care-related tasks and timelines for the application. A range of descriptive data about the patient, their medical condition, therapies and care, and current providers can be collected. Seven quality of care measures from the National Quality Forum, The Joint Commission, and the Centers for Medicare and Medicaid Services can be tracked through the application. Results: There are five functional areas including home, tasks, measures, improvement, and data. The home, tasks, and data pages are used to enter patient information and coordinate care using the five-step protocol. Measures and improvement pages are used to enter quality measures and provide practitioners with continuous performance feedback. The application resides within a portal, running on a multitenant, private cloud-based Avedis enterprise registry platform. All data are encrypted in transit and users access the application using a password from any common web browser. Conclusion: The application could spread the FLS model of care across the US health care system, provide continuity of care, effectively manage osteoporotic patients, improve outcomes, and reduce medical costs. [ABSTRACT FROM AUTHOR]

This work deals with the classification, security and efficiency of generalized Feistel networks (GFNs) with 4 lines. We propose a definition of a GFN, essentially limiting consideration to Feistel-type constructions with domain-preserving F-functions and rotation by one line between rounds. Under this definition, we demonstrate that there are only two non-contracting representatives in the class of 4-line GFNs up to equivalence, namely, the type-I and type-II GFNs that avoid obvious differential effects. We propose to instantiate the GFNs with SPS-functions (two substitution layers separated by a permutation layer) instead of single SP-functions (one substitution-permutation layer only). We prove tight lower bounds on the number of differentially and linearly active functions and S-boxes in such ciphers. We show that the instantiation with SPS-functions using MDS diffusion provides a proportion of differentially and linearly active S-boxes by up to 33 and 50 % higher than that with single SP-functions for type-I and type-II GFNs, respectively, if the same matrix is used in all rounds. Moreover, we present the upper bounds on the differential and the linear hull probability for the type-II GFNs with SPS-functions. This opens up the possibility of designing more efficient block ciphers based on GFN structure. [ABSTRACT FROM AUTHOR]

At CRYPTO 2006, Halevi and Krawczyk proposed two randomized hash function modes and analyzed the security of digital signature algorithms based on these constructions. They showed that the security of signature schemes based on the two randomized hash function modes relies on properties similar to the second preimage resistance rather than on the collision resistance property of the hash functions. One of the randomized hash function modes was named the RMX hash function mode and was recommended for practical purposes. The National Institute of Standards and Technology (NIST), USA standardized a variant of the RMX hash function mode and published this standard in the Special Publication (SP) 800-106. In this article, we first discuss a generic online birthday existential forgery attack of Dang and Perlner on the RMX-hash-then-sign schemes. We show that a variant of this attack can be applied to forge the other randomize-hash-then-sign schemes. We point out practical limitations of the generic forgery attack on the RMX-hash-then-sign schemes. We then show that these limitations can be overcome for the RMX-hash-then-sign schemes if it is easy to find fixed points for the underlying compression functions, such as for the Davies-Meyer construction used in the popular hash functions such as MD5 designed by Rivest and the SHA family of hash functions designed by the National Security Agency (NSA), USA and published by NIST in the Federal Information Processing Standards (FIPS). We show an online birthday forgery attack on this class of signatures by using a variant of Dean's method of finding fixed point expandable messages for hash functions based on the Davies-Meyer construction. This forgery attack is also applicable to signature schemes based on the variant of RMX standardized by NIST in SP 800-106. We discuss some important applications of our attacks and discuss their applicability on signature schemes based on hash functions with 'built-in' randomization. Finally, we compare our attacks on randomize-hash-then-sign schemes with the generic forgery attacks on the standard hash-based message authentication code (HMAC). [ABSTRACT FROM AUTHOR]

The Advanced Encryption Standard (AES) is a 128-bit block cipher with a user key of 128, 192 or 256 bits, released by NIST in 2001 as the next-generation data encryption standard for use in the USA. It was adopted as an ISO international standard in 2005. Impossible differential cryptanalysis and the boomerang attack are powerful variants of differential cryptanalysis for analysing the security of a block cipher. In this paper, building on the notions of impossible differential cryptanalysis and the boomerang attack, we propose a new cryptanalytic technique, which we call the impossible boomerang attack, and then describe an extension of this attack which applies in a related-key attack scenario. Finally, we apply the impossible boomerang attack to break 6-round AES with 128 key bits and 7-round AES with 192/256 key bits, and using two related keys we apply the related-key impossible boomerang attack to break 8-round AES with 192 key bits and 9-round AES with 256 key bits. In the two-key related-key attack scenario, our results, which were the first to achieve this amount of attacked rounds, match the best currently known results for AES with 192/256 key bits in terms of the numbers of attacked rounds. The (related-key) impossible boomerang attack is a general cryptanalytic technique, and can potentially be used to cryptanalyse other block ciphers. [ABSTRACT FROM AUTHOR]

One-time Password (OTP) Token has become one of the main stream security products during the past few years. OTP Token can automatically generate a random password. It is especially popular to be used with the Two-factor Authentication (2FA) system. OTP Token has proliferated into many different form factors such as standalone token, PC, PDA, cellular phone and Cloud-based token. But most of the implementation has their short comings with high token cost, not easy to carry and high supporting or deployment cost. Certain implementations may also compromise the network security when the token is lost or stolen. Moreover, most of the tokens can be broken-in by Man-in-the-Middle Seed-tracing and Shoulder-surfing security attacks. To overcome such aforementioned issues, we propose a secure encryption algorithm - Rubbing Encryption Algorithm (REAL). We use REAL to implement a Mobile-based and a Cloud-based OTP Token as design examples. Both of them are of high security level, lower total token cost and can resist the aforementioned security attacks as well. [ABSTRACT FROM AUTHOR]

Cryptography is an essential component of America’s national security infrastructure. Billions of dollars are spent on cryptosystems every year, in both the public and private sector. Unfortunately, the field is rife with dubious claims, snake oil salesmen, and outright fraud. This paper highlights the importance of skepticism and critical thinking in the role of evaluating and procuring cryptosystems. We discuss our experiences in teaching future leaders about testing extraordinary cryptographic claims by asking hard questions and show examples from our own experience. We believe that the rigorous application of skepticism and critical thinking in cryptography are absolutely essential to the wise use of America’s resources and the security of the nation. [ABSTRACT FROM AUTHOR]

The article focuses on the use of encryption for criminal purposes and looks at the future of encryption policy in the U.S. as of 1997. It mentions the current trend of integration of robust digital encryption technologies into commercial desktop applications and networks. The author believes that these developments present important challenges to governments and particularly law enforcement authorities. Federal Bureau of Investigation (FBI) Director Louis Freeh says there is a need for a national strategy to deal with encryption. The National Research Council recommends the use of cryptography to meet the increased need for information security.

Supports the unrestricted commercial use of encryption technology within the United States, based on a report by the National Research Council.