Philosophically Secure » encryption

45th and 46th Mersenne prime numbers discovered

eugenekogan — Sat, 27 Sep 2008 19:37:43 +0000

A distributed computing project known as GIMPS (The Great Internet Mersenne Prime Search) was used to discover the 45th and 46th Mersenne prime numbers. These are huge numbers, with way more digits than the human mind can really grasp the size of. Every time something like this happens, I’m reminded of the incredible reliance of cryptography on prime numbers. Obviously, numbers this big are not exactly useful, but the process of discovering them could teach us something about primes in general. In any case, it’s an interesting mathematical achievement.

Some of the press coverage I’ve seen has been wrong, giving credit to UCLA mathematicians, when it was really just a computer that happened to be in UCLA, which was connected to the GIMPS network. GIMPS has thousands of computers from volunteers all over the world working on the problem simultaneously.

(2^37156667-1) and (2^43112609-1) are both prime!

TrueCrypt’s Deniable File System

eugenekogan — Sat, 19 Jul 2008 13:43:34 +0000

Bruce Schneier talks about a paper he helped write with a few other researchers on breaking the deniable encryption feature of TrueCrypt.

The claim behind this feature is that you can have a secret encrypted file system that will remain undetected, and so you can deny its existence if your drive is confiscated somehow. Schneier and the other authors prove that this deniability is rather weak. Since the encrypted file system is stored and used within a normal operating system (Windows, Linux, etc.), traces of its existence are scattered throughout the unencrypted parts of the hard drive. There are swap files, temporary files, and other remnants created by various applications, such as word processors.

Since the paper [PDF] came out, TrueCrypt released version 6.0, which addresses many of the issues presented in this paper. But the bottom line is that you shouldn’t depend on this deniability feature. It’s much safer to encrypt the entire disk, to ensure that sensitive data isn’t left on unencrypted portions of the file system. The only problem with this method is that you can’t deny having anything encrypted.

Leave your laptop at home

eugenekogan — Thu, 14 Feb 2008 01:04:04 +0000

Most people don’t realize how limited their rights are when they are crossing the U.S. border. This is especially true when it comes to portable electronics, such as your laptop. Of course border guards can search your luggage to look for contraband, such as drugs, illegal food items, or even animals. But did you know that they can also search within your personal laptop? They don’t need just cause or any suspicion of illegal activity. It doesn’t matter if it’s your personal laptop, or one owned by your company. Not only can they ask you to turn it on, but they can also request that you login and allow them to examine the contents of your system.

My advice: leave the laptop at home, unless you absolutely need it on your trip. At the very least, don’t bring any sensitive data with you, especially in an obvious and unencrypted state. Ideally, if you travel often, you may want to have a basic laptop without any real data just for this purpose.

Let’s just hope these laws never apply to crossing state borders, as well…

Wireless keyboard hacked

eugenekogan — Wed, 05 Dec 2007 01:59:57 +0000

This is some cool research done by Dreamlab to “hack” the latest Microsoft 27 MHz wireless keyboards. It looks like the hardest part was reverse engineering the proprietary protocol. After that, the encryption was trivial, and the key was even passed in the clear.

There are more technical details in the PDF paper, such as this gem:

The one byte USB Hid code is encrypted using a simlple XOR mechanism with a single byte of random data generated during the association procedure.

That’s a pathetic attempt at security, really. Maybe Microsoft were hoping that no one would try hacking a keyboard, or that the new protocol would save them, but they should know better by now.

German Enigma encryption device

eugenekogan — Tue, 27 Feb 2007 12:52:39 +0000

If you’ve ever wanted to see how a German Enigma machine encrypts something, this Flash demo is perfect.

Like other rotor machines, the Enigma machine is a combination of mechanical and electrical systems. The mechanical mechanism consists of a keyboard; a set of rotating disks called rotors arranged adjacently along a spindle; and a stepping mechanism to turn one or more of the rotors with each key press. The exact mechanism varies, but the most common form is for the right-hand rotor to step once with every key stroke, and occasionally the motion of neighbouring rotors is triggered. The continual movement of the rotors results in a different cryptographic transformation after each key press.

For more on Enigma’s history and mathematical foundations, check out the Wikipedia site.