Wireless Protected Access, Version 2 (WPA2) is the version of Wi-Fi security used in most cases today. This diagram illustrates the general layout of the security data used by WPA2. There's a new version coming out, WPA3, but it doesn't seem to be in any products yet. I put this diagram together several years ago... Continue Reading →
pin.it/fnnc4j6fjamugy Once we get past the creep factor of Nazi army uniforms, we see a communications team sending a secret message. They are using the legendary Enigma machine to encrypt the message. But why, why did that officer allow a photographer to record this highly sensitive activity? A failure of operational security (OPSEC). Allies in... Continue Reading →
In June, 1999, Senator John McCain had started his presidential bid and was visiting companies in Silicon Valley, including Secure Computing Corporation, where I worked. He was there to discuss government policies on several tech topics, including the export of cryptographic technologies and products. I had been writing policy statements about crypto exports as part of... Continue Reading →
My textbook lists categories of cyber-attacks that focus on an attack's lasting impact: how does it affect the target's assets and resources? Since the categories really reflect the attack's impact on the target, they really represent risks. Here are the categories I use right now: Denial of service - Pillage - Subversion Masquerade - Forgery - Disclosure This is a... Continue Reading →
Quantum computing gives us a way in theory to quickly crack certain types of cryptography. Well-funded startups are working on prototype quantum circuits, as are big guns like Intel, Microsoft, and IBM. Success could render a lot of today's encryption obsolete. In theory. Academic and industrial research labs have built basic quantum circuits. If Moore's... Continue Reading →
The big news this week is a protocol flaw in the Wireless Protected Access protocol, version 2 (WPA2). The Ars Technica article covers the details pretty well. This is what every Wi-Fi wireless router on the planet uses these days. The problem does not directly damage your system, but it can uncover data you had intended... Continue Reading →
I sympathize with developers who throw up their hands and say, "I don't do security stuff." No matter what you choose, there's a trade off that could go wrong. It's especially troublesome if one deploys a "security website." I've deployed security education websites in many environments over the past 20 years, and I rarely achieve... Continue Reading →
I have posted the fifteenth video in the Cryptosmith Series on practical basic cryptography. The video collection falls into three parts: the network crypto introduction, the DVD example, and the public-key certificate discussion. There are also updates to other series videos. They now use the acronym "SSL" a lot more, since people recognize it more often than "TLS."... Continue Reading →
Here are a couple of short videos that describe the basic cryptographic mechanisms used in DVDs. These don't quite fit into my Cryptosmith series, at least, not right now. They're short and interesting, so I went ahead and posted them.
