Meet Moxie Marlinspike, the Anarchist Bringing Encryption to All of Us | WIRED
▻https://www.wired.com/2016/07/meet-moxie-marlinspike-anarchist-bringing-encryption-us
As the crypto war once again intensifies, Signal and its core protocol have emerged as darlings of the privacy community. Johns Hopkins computer science professor Matthew Green recalls that the first time he audited Marlinspike’s code, he was so impressed that he “literally discovered a line of drool running down my face.”
Johns Hopkins researchers poke a hole in Apple’s encryption
Researcher Matthew Green from John Hopkins university claims to have found a way through iMessage to intercept messages, photos and encryption key, and this for iOS versions prior to 9.3. This is done by forging TLS certificates and intercepting traffic by pretending to be an Apple server.
The recently released iOS 9.3 is supposed to incorporate the mitigation advise proposed by the researchers and correct this problem.
The paper can be found here:
Dancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage
▻https://isi.jhu.edu/~mgreen/imessage.pdf
▻http://docdro.id/0wPiqeJ
Our analysis shows that iMessage has significant vulnerabilities that can be exploited by a sophisticated attacker. In particular, we outline a novel chosen ciphertext attack on Huffman compressed data, which allows retrospective decryption of some iMessage payloads in less than 2^18 queries. The practical implication of these attacks is that any party who gains access to iMessage cipher texts may potentially decrypt them remotely and after the fact.
[...]
Specifically, we attempt to answer the following question: how secure is Apple iMessage?
[...]
To perform our analysis, we derived a specification for iMessage by conducting a partial black-box reverse engineering of the protocol as implemented on multiple iOS and OS X devices.
Also interesting statement in the paper:
Apple stores encrypted, undelivered messages on its servers and retains them for up to 30 days, such messages are vulnerable to any party who can obtain access to this infrastructure, e.g., via court order
Their long-term recommendation to Apple:
Replace the iMessage encryption mechanism. ;-)
The Washington Post wrote about this paper:
▻https://www.washingtonpost.com/world/national-security/johns-hopkins-researchers-discovered-encryption-flaw-in-apples-imessage/2016/03/20/a323f9a0-eca7-11e5-a6f3-21ccdbc5f74e_story.html
Christopher Soghoian, principal technologist at the American Civil Liberties Union, said that Green’s attack highlights the danger of companies building their own encryption without independent review. “The cryptographic history books are filled with examples of cryptoalgorithms designed behind closed doors that failed spectacularly,” he said.
Also funny is this quote from Green:
it scares me that we’re having this conversation about adding back doors to encryption when we can’t even get basic encryption right.
#iMessage
#FBI
#TLS #SSL
#backdoor
#MITM
APN - Apple Push Notification
“A RIDDLE WRAPPED IN AN ENIGMA \ In August 2015 the U.S. National Security Agency (#NSA) released a major policy statement on the need for post-quantum #cryptography (PQC). This announcement will be a great stimulus to the development, standardization, and commercialization of new quantum-safe algorithms. However, certain peculiarities in the wording and timing of the statement have puzzled many people and given rise to much speculation concerning the NSA, #elliptic_curve_cryptography (#ECC), and quantum-safe cryptography. Our purpose is to attempt to evaluate some of the theories that have been proposed.”
▻https://eprint.iacr.org/2015/1018.pdf
Spoiler: after reading the very interesting and detailed paper, we still don’t know :-(
Neal Koblitz, Alfred J. Menezes
see also ▻https://www.schneier.com/blog/archives/2015/08/nsa_plans_for_a.html
À noter la sortie d’un nouveau RFC sur les courbes elliptiques, ce qui semble indiquer que tout le monde ne fait pas confiance à la NSA ▻http://seenthis.net/messages/453312
Sur cet article, voir aussi l’opinion de Matthew Green ►http://blog.cryptographyengineering.com/2015_10_01_archive.html suggérée par @X_cli
PGP Encryption is Fundamentally Broken, Time for #PGP to Die, says Cryptography Expert Matthew Green
▻http://thehackernews.com/2014/08/cryptography-expert-pgp-encryption-is_19.html
According to Green, the solution of the problem is to stop plugging encryption software into today’s plaintext email systems, and instead build networks that are designed from the base level to protect messages from eavesdroppers. He suggested TextSecure and #DarkMail as potentially interesting projects that are looking forward to this direction.
#sécurité_informatique Cf. ▻http://seenthis.net/messages/281017
Mouais. D’abord il faut noter que PGP fonctionne aujourd’hui et que si on a besoin de sécurité maintenant on n’a pas d’autre solution. Ensuite, Green est très bavard sur les problèmes et les limites de PGP et très très bref sur les solutions. Donc, en attendant qu’il mette au point quelque chose, les gens qui travaillent vont continuer à utiliser PGP.
Un long article sur la politique du #chiffrement sur l’Internet, est-ce un bien, un mal, est-ce entre les deux, faut-il faciliter la vie des pédonazis pour gêner la #NSA, etc.
#histoire #crypto très intéressant
cf. The daunting challenge of secure e-mail
By Matthew Green - 09/11/13
▻http://www.newyorker.com/online/blogs/elements/2013/11/the-daunting-challenge-of-secure-e-mail.html
très concis, où il est question de #dark_mail
