{"id":824,"date":"2009-01-30T05:13:21","date_gmt":"2009-01-30T10:13:21","guid":{"rendered":"http:\/\/ironwil.net\/blog\/?p=824"},"modified":"2014-10-22T19:38:45","modified_gmt":"2014-10-22T19:38:45","slug":"security-now-181-netcast","status":"publish","type":"post","link":"http:\/\/www.ironwil.net\/cs\/2009\/01\/security-now-181-netcast\/","title":{"rendered":"Security Now [#181] NetCast"},"content":{"rendered":"<p class=\"title podcast\"><strong>Crypto Recap<\/strong><\/p>\n<p><span class=\"mw-headline\">Topics <\/span><\/p>\n<ul>\n<li>future topic: keyed message authentication code<\/li>\n<\/ul>\n<p><a name=\"News_and_Errata\"><\/a><\/p>\n<p><span class=\"mw-headline\"> News and Errata <\/span><\/p>\n<ul>\n<li>Quicktime 7.6 Update for both Mac and Windows, critical, 7 exploits patched<\/li>\n<li>illegal iWork &#8217;09 with a trojan that will deeply infect your Mac with a bot net<\/li>\n<li>you have options for your windows automatic update, choose the one right for you, make sure you are patched<\/li>\n<li><a class=\"mw-redirect\" title=\"Yubikey\" href=\"http:\/\/wiki.twit.tv\/wiki\/Yubikey\">Yubikey<\/a>, limited size of password discussed last show, someone wrote in to say longer password is possible<\/li>\n<li><a class=\"external free\" title=\"http:\/\/cryptolink.com\" href=\"http:\/\/cryptolink.com\/\" rel=\"nofollow\">http:\/\/cryptolink.com<\/a> trademark is in place now<\/li>\n<li><a class=\"external free\" title=\"http:\/\/My.BarackObama.com\" href=\"http:\/\/my.barackobama.com\/\" rel=\"nofollow\">http:\/\/My.BarackObama.com<\/a> forum, people were putting up trojans<\/li>\n<\/ul>\n<p><a name=\"Crypto_Recap\"><\/a><\/p>\n<p><span class=\"mw-headline\"> Crypto Recap <\/span><\/p>\n<p>3.5 year review of all the security pieces that have been talked about<\/p>\n<p>threat model &#8211; what is it we can do? what are we trying to do?<\/p>\n<p>for example, we assume the endpoints are secure while we try to secure the communication between the two endpoints &#8211; keystroke logger, for example, we can&#8217;t secure against &#8211; if someone gets physical access, we&#8217;re insecure<\/p>\n<p>we assume non-infinite computational power because all of the crypto is subject to brute force attack, no matter how long the key is<\/p>\n<p>&#8220;perfect&#8221; security? yes, one-time pad &#8211; still isn&#8217;t secure if someone has physical access<\/p>\n<p>much crypto depends on this fact: it is very easy to multiply two big prime numbers together, not easy to factor the result into those two original primes<\/p>\n<p>taking something to a power is easy, taking the log is hard &#8211; also a fundamental assumption of security at present<\/p>\n<p>you want there not to be a single point of failure, even if single communications is cracked, all the rest of the communications should still be secure &#8211; a single shared key is a bad idea for this reason<\/p>\n<p>assume endpoints secure, path inbetween (the internet) totally insecure<\/p>\n<p>what do we mean by security? in this context where we&#8217;re protecting traffic between two endpoints, we want 3 things:<\/p>\n<ol>\n<li>confidentiality, interceptor in the middle cannot read the messages<\/li>\n<li>integrity of message, guard against message being modified<\/li>\n<li>authenticate the endpoints, are we really talking who we think we are?<\/li>\n<\/ol>\n<p>encryption gives confidentiality, symmetric (same key at both ends used to encrypt and decrypt), asymmetric (two different keys used, one to encrypt a random symmetric key that&#8217;s used to encrypt the message, the other to decrypt that symmetric key), key agreement<\/p>\n<p>message integrity, using hashes to create a signature (md5, sha1, etc), a hash is a digest of a much-larger communication, a fingerprint &#8211; any change to the original message will change that fingerprint &#8211; not computationally feasible to make a change to the original message and deliberately produce the same signature &#8211; md5 has been broken in this respect<\/p>\n<dl>\n<dd>in a couple of weeks we&#8217;ll talk about keyed digest, giving an authenticated signature, which we don&#8217;t have now<\/dd>\n<\/dl>\n<p>endpoint authentication, certificates and chain of trust anchored to a root authority<\/p>\n<p>get yours <a title=\"Security Now! #181\" href=\"http:\/\/twit.tv\/sn181\" target=\"_blank\">here<\/a>.<\/p>\n<p>iron wil<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Crypto Recap Topics future topic: keyed message authentication code News and Errata Quicktime 7.6 Update for both Mac and Windows, critical, 7 exploits patched illegal iWork &#8217;09 with a trojan that will deeply infect your Mac with a bot net you have options for your windows automatic update, choose the one right for you, make [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[582,27],"tags":[372,168,235,247,197,183,206,207,170,224,174,412],"class_list":["post-824","post","type-post","status-publish","format-standard","hentry","category-link","category-note","tag-certificates","tag-errata","tag-ie","tag-mac","tag-netcasts","tag-news","tag-opinion","tag-quicktime","tag-security","tag-windows","tag-xp","tag-yubikey"],"_links":{"self":[{"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/posts\/824","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/comments?post=824"}],"version-history":[{"count":1,"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/posts\/824\/revisions"}],"predecessor-version":[{"id":2285,"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/posts\/824\/revisions\/2285"}],"wp:attachment":[{"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/media?parent=824"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/categories?post=824"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.ironwil.net\/cs\/wp-json\/wp\/v2\/tags?post=824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}