Reply From: Synthe Omicron <syntheat_private> Oh wow. Watch how this gets torn up. What's sad here is that IBM has smart people, so I doubt that this is the fault of them or the Swiss university mentioned, but rather more shoddy reporting to the lowest common denominator (read: management). > [Moderator: Someone more into crypto correct me if I am wrong.. > but isn't one of the first signs of snake-oil the use of the > word "unbreakable"?] Right on. Hey, simple analogy: unbrekable crypto : bonafide product as riskfree : life. > Forwarded From: phreak moi <hackereliteat_private> > > http://www.news.com/News/Item/0,4,25598,00.html?st.ne.1.head > > Key Net security hitch resolved > By Reuters > Special to CNET NEWS.COM > August 24, 1998, 7:50 a.m. PT > > NEW YORK--Mathematicians at IBM and a Swiss university say they have > developed a new system of securing information against the most aggressive > type of attack by computer hackers--a step seen as resolving concerns > about privacy and the integrity of electronic transactions on the > Internet. Inside joke: IBM develops new cryptosystem. 30 years pass. British gov't, NSA, and the son of a Canadian fisherman from Manitoba claim they invented the *same exact system 10+ years before IBM*. ;] > But rather than take what IBM considers to be a fundamental breakthrough > and exploit it commercially, the researchers plan to give away their > findings for free--in the hopes of bolstering public confidence in the > security of the Internet. Or rather, having other people do their research for them, perhaps. RSADSI has done the same kind of thing before. > The two Zurich-based mathematicians--Victor Shoup, of IBM Research, and > Ronald Cramer, of the Swiss Federal Institute of Technology (ETH)--plan to > unveil today their new security scheme at Crypto '98, the main annual U.S. > academic conference devoted to computer security issues, in Santa Barbara, > California. > > The team has designed a practical and mathematically proven method for > effectively closing off back-door attempts to thwart computer security > systems using so-called "active" attacks, according to IBM and other top > computer security researchers. 'Active attacks'? News to me. Maybe they mean side-channel attacks. Maybe they mean differential cryptanalysis. Maybe they mean rubber-hose cryptanalysis. What do they mean? > All current commercially available cryptography, or secret coding, systems > are potentially vulnerable to active attacks, which are considered to be > the most aggressive and dangerous hacking attempts any encryption system > might face, they said. <exasperated look> WTF IS AN ACTIVE ATTACK?!? > "Businesses and consumers can have greater confidence in Internet > transactions, because we've effectively closed down the only way around a > cryptosystem's main line of defense," Jeff Jaffe, general manager for > IBM's security products and services, said in a statement announcing the > development. If you think there's only one way around a cryptosystem's main line of defense, you might want to think more. > Strong modern cryptography systems are based upon really difficult > mathematical problems that are thought to be unsolvable. If the underlying > problem of such a security can be solved, then the cryptosystem's security > could be violated. <annoying buzzer sound> Wrong! But come back and play again sometime. Strong crypto isn't based on problems thought to be unsolvable. It's based on a given algorithm which computes a mathematical equation and/or series of operations which result in a *very difficult* problem to solve without a given variable (key) which would other wise simplify the problem > One means for cracking computer security systems is through "brute force" > attacks that throw massive computer resources into attempts to calculate > every possible answer to complex math problems. Is this an 'active attack?' I hope not. > Another method hackers use is what security experts call "social > engineering," when, simply put, a hacker manages to trick someone inside > an organization into revealing secret codes that allow outsiders to break > into a computer system. Hrm. Is *this* an active attack? > But "active" attacks are considered to be the most difficult to prevent > because they bypass the difficulty of solving the underlying mathematical > problem by sending a series of cleverly constructed messages to Web site > computers. Ahh, so *THIS* is an active attack. Hrm. It's essentially the 'reaction attack' (as defined by Schneier). I like 'reaction attack' myself, since I could easily (especially from a a layman's point of view) classify brute-force as pretty active. But, that's me being esoteric. My main point here is that it would have been better to stipulate the attack and it's nature up front so that the people intended to read this (read: management) would have an easier time getting the gist of the article. But, I digress. 'Web site computers'? Whatever happened to 'server'? Besides, where is it written that an 'active' (reaction) attack has to be launched on a web server? Why not FTP? More importantly, I'd say that *any machine with any cryptographic implementation* is potentially at risk, e.g., anything relying on smartcards (especially). > By analyzing the electronic responses to the messages from the Web sites, > an attacker could get information that could be used to decode an > intercepted session. > > The Cramer-Shoup method thwarts active attacks by offering the first > cryptosystem that prevents eavesdropping while also being efficient enough > for commercial use, IBM said. The first? Umm, no. As RSA docs tell us and Schneier restates in his Crypto-Gram Newsletter (July 15th, 1998), the RSA system in SET is fine, and this attack gained notoriety after being appiled in attacking RSA in PCKS 1. > The new system would eliminate a security flaw that allowed a Bell Labs > researcher earlier this year to demonstrate how a well-equipped computer > hacker could break the encryption software code used for electronic > commerce. > > That discovery had set off a flurry of activity by Netscape > Communications, Microsoft, and Security Dynamics Technologies' RSA Data > unit that led to a software patch that fixed the immediate problem. But > the Bell Labs development left lingering doubts among security experts > about the fundamental integrity of computer networks and suggested future > attacks were possible. Somehow I can't comprehend the words 'flurry' 'activity' 'security' 'flaw' 'fix' 'patch' and 'Microsoft' when used in conjunction with each other. > However, in a phone interview on Friday, Bell Labs researcher Daniel > Bleichenbacher said the Cramer-Shoup system had demonstrated a method that > was impervious to the sort of attack he had developed and graciously > accepted defeat. > > These theorists are part of a chummy world elite of computer scientists > engaged in a collegial competition to discover cracks in networks before > criminal hackers do, thus keeping Internet security several steps ahead of > the bad guys. I fail to see why this escapes people, but the 'bad guys' are using things that should have been patched 10, 20 years ago. To make matters worse, they're using someone else's tool that exploits a flaw found by yet another person 10 or 20 years ago. > Bleichenbacher said his research was complementary to that of the > IBM-Swiss university team. "My paper suggested the problem," the Bell Labs > researcher said. "I have an attack and they present a solution." > > For its own part, IBM said it plans to incorporate the new system into a > future version of its Vault Registry software, designed to allow > electronic commerce transactions to travel across organizational > boundaries in a private, secure manner. > > "The game is over as far as cryptography systems being subject to these > nasty kinds of attacks," Charles Campbell Palmer, the manager of network > security and cryptography at IBM Research, said in a phone interview. ROTFLMAO. (I gotta stop reading ISN, I'm having to replace a spleen every month.) > Palmer leads a team of "ethical hackers" who practice breaking into > computer systems, with permission, to detect potential security holes. ethical hackers == redundant statement. These are probably the very same 'ethical hackers' who were mentioned in ISN's Phrack World News component in P 53. > He said IBM plans to freely disseminate its findings to other researchers > with the goal of ensuring the success of electronic commerce by making it > easier to use and more secure. > > "This is not the sort of stuff you hold tight and patent," Palmer said. > "This is the sort of stuff you publish...and hope everyone adopts it > quickly." It'll be interesting to see if the right hand knows what the left is doing later on at IBM. We'll have to check back in a few months or years and see if anyone else at IBM has adopted these solutions (assuming they're all valid, which we'll know after Crypto '98). > The improvement comes at a time when consumers are still concerned about > security and the safety of sending personal information, or their credit > card numbers, over the Internet. > > Having secure transactions is crucial for persuading more consumers to buy > products on the Internet and keep the burgeoning industry growing. Reuters should start up a government pep talk service in order to educate Congresspeople about such novel ideas. Then again, they should contract out some one to do all the technical work. -- Synthe Omicron <syntheat_private> [http://www.ronin.net/~synthe] Hacker Advanced Research Projects Agency [http://harpa.ronin.net/] RSA: 0xE5DD7B9D/57B6 06E1 EF62 228A 3676 3D64 0580 6201 DSS: 0x7B216BA8/A710 B524 DBCC 2B96 9E32 246C 1F98 F044 7B21 6BA8 -o- Subscribe: mail majordomoat_private with "subscribe isn". Today's ISN Sponsor: Repent Security Incorporated [www.repsec.com]
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:02:12 PDT