Thursday, March 17, 2005

“You’re not totally naked in the world,” cryptologist Jon Graff reassured his audience at SD West 2005, “you’re wearing a towel.” By the time that Graff finished his day-long tutorial, “A Lucid and Easily Understood Explanation of Modern Cryptography,” on Monday, March 14, he had shocked attendees by pointing out that even using an ATM can be a minefield of security holes—but he’d also equipped them with mine detectors in the form of a solid grounding in today’s crypto.

Graff, head of architecture in Nokia’s Enterprise Solutions group, knows that cryptology is vital, yet insufficient on its own. “Cryptology definitely does not solve all the world’s problems—except when you’re selling it to a customer,” he quipped. He explained that attention must be paid to technical cryptographic strength, but that’s not enough. Cryptosystems like the Data Encryption Standard (DES)—long sanctioned by the U.S. government—do become obsolete, said Graff, for a variety of reasons, including the accelerating pace of Moore’s Law and the discovery of previously unknown flaws in cryptosystems commonly considered secure. But as a seemingly endless series of examples illustrated, it’s often not the cryptology at fault, but the larger system in which it’s embedded. A case in point: the worldwide automated-teller-machine network. “This thing is secure,” said Graff, one eyebrow raised; “—like a sieve.” Attacks range from the obvious (cameras placed to record the victim punching in his PIN number) to the sophisticated (fraudulent ATM machines that read and record PIN and card number), to the forehead-slapping (most ATMs worldwide, said Graff, depend on the continued secrecy of a single cryptographic key), to scenarios lifted straight from CSI (dusting a stolen card with iron filings to decipher the bar code). Graff’s advice on fake ATMs: “If you’re not sure, enter an incorrect PIN the first time. If the machine accepts it, run away!”

Because of the economics of security and the inertia of already deployed systems, even your car and your cell phone aren’t safe: Bluetooth networking uses only a 40-bit key, which can be cracked by brute force in minutes by a laptop computer. “This is a good example,” said Graff, “of why you can’t layer security on after the fact—it has to be designed in from the first. Security is a way of making things not happen, so if you put it in afterwards, things break.”

Graff went beyond the horror stories into crypto’s inner workings. Crypto has a reputation for fearsome complexity, but Graff led the class bit by bit through the arcana, delivering it in chunks small enough to be digested by “mathematically perplexed people.” Starting with symmetric-key encryption, he showed how key exchange rapidly escalates to a huge problem as the number of communicating entities increases, then elucidated the Kerberos system as a clever solution to the problem. After that, it was on to the mysteries of public-key cryptosystems and the internals of technologies like Secure Sockets Layer (SSL), which many use but few comprehend—unless they’ve attended Graff’s class.

10:41 PM

25 comments:

at 10:45 AM Anonymous said...

Is it possible to get hold of this presentation?

at 6:09 PM Anonymous said...

Hey, I go to see your blog everyday and you have a great blog here! I'm definitely going to bookmark you!

I have a battery cellular phone site/blog. It pretty much covers ##KEYWORD## related stuff.

Come and check it out if you get time mate :-)

at 12:27 AM Anonymous said...

It's as easy as filling out the form in the SoloAdTraffic Mailer Area to start your campaign.

at 6:35 PM Anonymous said...

Wow! Awesome blog... Check me out if you get a chance :cell free phone trace

at 7:18 PM Anonymous said...

I really enjoyed reading your Blog about brighton jewelry. I also have a Blog/Website about brighton jewelry come check it out!! Have a great day!

at 8:53 PM Anonymous said...

Imagine the power of tens of thousands of other web sites being able to easily

at 1:46 AM Anonymous said...

Cool blog you have. I have a cingular pager related site. Check it out if you get a chance. The URL is cingular pager

at 11:19 PM Anonymous said...

At least she's no long-winded.
cellular phone data backup

at 5:16 AM Anonymous said...

I appreciate your blog. Well done, even though it's not mine! Just kidding! Off to find free cell phone wallpaper or something like that. Take care.

at 5:13 PM Anonymous said...

Hey what's up, just letting you know that someone from C.A. read your blog!

Regards,
Charles
2003 hosting reseller window

at 7:40 AM Anonymous said...

Searching blogs for sort traffic.
Came here. Interesting blog.
http://www.1st-choice-4-website-traffic.com
sort traffic

at 12:06 PM Anonymous said...

Nice blog and info. Keep up the good work.

I have a site that you are welcome to see at http://www.small-business-web-design.ssr.be it is about small business web design

at 5:28 PM Anonymous said...

This isn't bad, but I wish there were more folks out there that could provide. Thanks.
-Piano Guru
learn to play piano

at 9:41 PM Anonymous said...

Great work!
[url=http://mcgtzpfs.com/jgap/jtqr.html]My homepage[/url] | [url=http://rqdffosx.com/zmzm/gcoz.html]Cool site[/url]

at 9:41 PM Anonymous said...

Great work!
My homepage | Please visit

at 9:41 PM Anonymous said...

Great work!
http://mcgtzpfs.com/jgap/jtqr.html | http://vfezuvzi.com/zhec/figg.html

at 7:13 AM Anonymous said...

Really great blog very informative re ntl broadband speed test. In a simliar vain to ntl broadband speed test, I would definitely recommend http://www.bargainplace.co.uk for **mobile phones** or **cheap broadband**. Also you can get **cheap gas & electricity**, **gifts for your loved one** and **loan deals, free phone calls with talktalk, free broadband with Sky and bargain electrical equipment**

at 6:16 PM Anonymous said...

Great blog on advertising ppc services. I've stumbled on a superb money making website. Linkreferral is free to join and drives traffic to your website in an inivitive way (the more sites you visit, the more links you get back to your website.)

I've only been a member of Linkreferral for aproximately 2 weeks but I have already seen the volume of people coming to my site double - if not treble.

Linkreferral is not only driving visitors to my website but as a result my affiliate sales income has doubled also.

I really cannot push this website enough. It is free and it is fantastic!! www.linkreferral.com is a must for money making opportunities online.

at 3:23 AM Anonymous said...

Nice blog!! I'm into web site traffic builder and to drive traffic to my website I signed up free for this superb traffic gereating tool - I now have loads of hits to my websites and blogs. This can see your affiliate commission shoot through the roof - meaning lots of extra money coming in for you and your family. Sign up now - it's free.. Best of luck, cheers for now, dave.

at 9:41 PM Anonymous said...

Good blog - very interesting!! Thought you might like some excellent advice on driving extra traffic to your website/blog - I'm into digital electronics and to drive traffic to my website I was searching around the internet for absolutely ages looking for SEO tools to fire my site up the Google search engine, then I signed up free for this superb traffic gereating tool - I now have loads of hits to my websites/blogs and my site is shooting up the Google rankings quicker than ever before.

Consequently this can see your affiliate commissions shoot through the roof - meaning lots of extra money coming in for you and your family. Sign up now - it's free.
. Sorry if this information is of no use to you but seeing as you have the anonymous feature enabled I thought I should share this free bit of essential promotional advice with you and would hope you would do the same for me.

I hope the tool will serve you equally as well as it has me!!

Best of luck, cheers for now, dave.

at 1:17 PM Anonymous said...

salute!
Very like it!
I enjoyed visiting your site. Tomorrow I shall return again.
Sponsored links:
http://onlinecasinos-online.blogspot.com/ online casinos
http://onlinecasinos-here.blogspot.com/ onlinecasinos
http://craps-onl.blogspot.com/ craps
http://gambling-online-s.blogspot.com/ gambling online
http://ws-poker.blogspot.com/ world series of poker
Sayonara!

at 4:45 PM Anonymous said...

high internet phone speed


Hi, just wondering if anyone has ever tried SKYPE for telephone calls over the internet?? A pal of mine says it's brilliant and works out much cheaper than conventional calls, just wondered if anyone else has signed up for it?

at 8:01 PM Anonymous said...

Thanks a lot for sharing this with all of us you actually
recognise what you're talking about! Bookmarked. Please additionally consult with my website =). We can have a link trade agreement between us

Look at my page ... dm500

at 8:11 AM Anonymous said...

I visited multіple ωeb pagеs hoωever the auԁiο quality foг audіo songs currеnt at this site is
tгuly supeгb. rippln reviews - lindberg construction prescott az - rippln reviews

Also visit my blog ... rippln app

at 7:13 AM Anonymous said...

I have been ѕurfing online more than 4 houгѕ toԁау, уеt Ӏ neνеr found аny interestіng aгtiсle liκe
yourѕ. Іt is рrettу worth еnough foг mе.
Ιn my opinіon, if аll ωеb owners аnd
bloggеrs maԁe good content as you ԁіd, the web will be a lοt moгe useful than evеr
befοгe. life insurance calculator aarp - american general life insurance vs aig - american General life insurance company telephone number

Mу websitе: 30 term life insurance quotes