Certificates and Keys

I want to talk about certificates. But first let's define a few terms. A key is a number in binary form, which is stored in a text file. That being said, a digital certificate is a pair of public and private keys. It is created by a certificate authority like Verisign. The digital certificate is used for encryption and decryption. The certificate is assigned to either an individual or an organization.

Now that we know what digital certificates are, we can define a key server as a machine which holds the public keys of the digital certificates. There are some potential problems with certificate use. Some applications do not take them. And some unscrupulous individuals forge digital certificates. Finally it can take a lot of work to get the certificates in the first place.

Let us put aside the certificate problems and talk some more about them. A digital certificate can hold a lot of information such as the version, serial number, issuer name, period of validity, and public key. For companies, you are going to want to set up a certificate policy. The policy covers issues like where logs are stored, whether keys get backed up, and validity periods. Armed with all this information, I am ready to discuss what PKCS is next time. See you then.

Texas Instruments Ownage

The online edition of IEEE Spectrum magazine alerted me to some major calculator hackage. A dude cracked the TI-83 Plus calculator from Texas Instruments. He got the signing key figured out. Now the key can be used to transfer your own O/S onto the calculator.

There was just one problem. The dude posted the key on his blog. The result was a cease and desist order from Texas Instruments. Damn. Apparently he was charged with violating the DCMA. The guy submitted and took down his post. Ouch. That's weak.

Another dude wrong about the incident. He linked to a page that had the signing key. I bet you can guess what happened. Texas Instruments slapped him with a cease and desist order. WTF?

Open Source Encryption

I read an article about the legality of open source encryption software. If the software has strong encryption, and is available to all, then it may be violating some laws. Specifically the Bureau of Industry and Security (part of the Department of Commerce) will have some things to say about it.

Now I don't want to waste any time right now discussing whether it is wrong or right to block export of encryption technology. What I did find interesting was the top encryption algorithms used by open source developers. These include familiar names like DES, AES, and Diffie-Hellman. However another top algorithm was ElGamal. I have never heard of ElGamal before.

A little research shows that ElGamal is an asymmetric algorithm. It dates all the way back to 1985. It is mostly found in open source cryptographic applications. Perhaps that is why it is foreign to me. I normally do not keep on top of the open source scene.

Mail and Tunneling

You would think that hackers would try to intercept network communications. However this is a difficult task if safeguards are used. Instead most hackers like to attack data at rest. In other words, they will try to get at data sitting on a machine, not stuff passing through the network.

If you want to encrypt email you send, there are two main options: (1) S/MIME and (2) PGP. MIME is an old standard that let's you attach binary files (like images) to email. S/MIME is a secure version of that protocol.

PGP stands for Pretty Good Privacy. It is a program written by Phil Zimmerman. There is a free version called GnuPGP. This program covers encryption and the storing of keys on your machine.

Let me close by talking about secure network connections. A VPN is a virtual private network. It let's you connect to a machine over the Internet. The encryption can be applied to just the data. You can also do tunneling where even the packet headers of the transmitted data as well. Popular tunneling protocols include IPSec and PPTP.

Next time look for a discussion on passwords, keys, and certificates.

Booth Babe Syndrome

A video from the Hack Day 2009 conference was released that cause a bit of a stir. They had some booth babes doing lap dances as entertainment. The video seems to have disappeared. However some pictures are still floating around.

The event was held in Taiwan. Many said it was the wrong place for such lewd behavior. Others thought it was fine to skip being politically correct. They have this thing going on at DefCon right?

Hey. The hackers conferences are fully of dudes. And most of those dudes will probably enjoy a bunch of booth babes making things interesting. So if they give out free lap dances, I say more power to them. Next time I will return to our regularly scheduled cryptography discussion.

Algorithms

Last time we discussed asymmetric key algorithms. Now allow me to talk about a familiar name in cryptography. This is the Diffie Hellman algorithm, also known as DH. It is named after the two researchers who first documented it. These guys are Whit Diffie and Martin Hellman.

The Diffie Hellman algorithm is one that allows two parties to perform a key exchange over an insecure connection. The use a technique where it would be hard for a person watching the communications to reverse engineer the key they share. The end communication is a symmetric one, where the two parties share the same key.

Next let me briefly cover PGP. It stands for pretty good privacy. This is an encryption program that allows users to communicate via secure email. This is a system that uses asymmetric keys.

Finally there is also a newer topic in cryptography called elliptical curve cryptography (ECC). It also uses asymmetric keys. This technique is good for encrypting large amounts of data. I will not go into the mathematics behind this technique right now. Perhaps that is a research topic for another day. Next time I will go over some other mail encryption methods, and also discuss tunnelling.

Asymmetric Keys

Last time I discussed symmetric keys. Now I will talk about asymmetric keys, where a different keys are used to encrypt and decrypt the data. You use the public key to encrypt. Only the private key can then decrypt the data. An example of an asymmetric encryption algorithm is RSA.

RSA was invented by Ron Rivest, Adi Shamir, and Leonard Adleman. Thus you get R-S-A for their last names. You can use RSA to encrypt keys which themselves can later be used to do symmetric encryption/decryption.

Next time I will talk about Diffie Hellman and PGP.