But in following the clues that led me to Finney, I found something equally significant: a dying man who had been something like a far-more-brilliant Forrest Gump of cryptographic history: a witness to and participant in practically every important moment in the recent history of secret-keeping technologies. From the development of the first widely used strong encryption software known as PGP, to early anonymity systems, to the first Bitcoin transaction, Finney was there. Must-read.]]>
“It could return the same value over and over because it was reliant on clock information,” Mandt said.
This was supposedly addressed in iOS 7 where time-based correlation issues were avoided through the use of a Linear Congruential Generator (LCG). The LCG in iOS 7 leverages information from four state generations, Mandt said, each one producing 16 bits of output. Each time, the lower three bits of each piece of output are discarded because they are considered weak.
Mandt said there are generally known problems associated with LCGs, including serial correlation between outputs making them susceptible to brute force attacks. It's clearly Really Quite Abstruse Theoretical Security Weakness Day, if you read on...]]>
The Guardian specifically calls out the National Institute of Standards and Technology (NIST) for a standard they published in 2006. Cryptographers have always had complicated feelings about NIST, and that's mostly because NIST has a complicated relationship with the NSA.
Here's the problem: the NSA ostensibly has both a defensive and an offensive mission.]]>
The torproject therefore is dependent on a diverse and wide range of exit nodes. This update to an older page is where I attempt to display the exit nodes diversity in a Google map with Geolocation.]]>
The one-page policy memo from Public Safety Canada, updated in mid-January, attempts to dissuade government BlackBerry users from sending a PIN-to-PIN message largely because it could be read by any BlackBerry user, anywhere in the world. The messages are “the most vulnerable method of communicating on a BlackBerry,” a Public Safety Canada presentation says…
Political staffers use the device as well, regularly sending PIN-to-PIN messages and emails as government business has progressively migrated to mobile devices.
“Although PIN-to-PIN messages are encrypted, they key used is a global cryptographic ‘key’ that is common to every BlackBerry device all over the world,” the memo reads. “Any BlackBerry device can potentially decrypt all PIN-to-PIN messages sent by any other BlackBerry device.” You wonder whether certain governments have been granted access to that cryptographic key, don't you?]]>
The fix is an easy one – companies simply need to generate a new key at the stronger length and place it in their DNS records. But they also need to remember to revoke their old key, Harris says.
“As long as the old one is still in the DNS record, even if you’re not using it, an attacker can still use it,” he says. (Thanks @ponk2k for the link.)]]>