Wednesday, March 4, 2020
The BadUSB Attacks
Here is an introduction that I wrote about the class of attacks known as "BadUSB" attacks.
Basically, an innocent USB charger can be turned into a ghost USB controller that can copy files, replace content, input commands as a keyboard etc... without the user noticing anything at all.
Wednesday, February 12, 2020
Monday, February 3, 2020
EMV and Post-Quantum Crypto
Post-Quantum Crypto
Post-Quantum crypto refers to a class of cryptographic algorithms and methods that are deemed to resist Quantum Computing attacks.
Quantum computing uses quantum physics and works differently from “traditional” digital computers. Two quantum algorithms: Shor's Algorithm and Grover’s algorithm allow performing powerful quantum attacks against, respectively, asymmetric and symmetric cryptographic algorithms, which are widely used in the industry. RSA, 3-DES or AES, for instance, are considered to be vulnerable to quantum computing.
Shor’s algorithm is considered to be a real threat for algorithms with security based on the difficulty of factoring numbers into primes, such as RSA for instance.
For now, Quantum computers are still at an early stage of prototypes but it is difficult to predict how fast an operational quantum computer could be built. Therefore, post-quantum crypto algorithms are currently developed - in a ‘prophylactic’ way - to answer future threats from quantum computing.
These post-quantum algorithms are being actively developed and are usually based on complex and difficult mathematical challenges. As an example, NIST released the first set of such candidates.
EMV
EMV is the leading international system for payment smartcard. The EMV initiative was taken by Europay, MasterCard, and Visa (hence the ‘EMV’ term) in the 1990s with the goal to replace magnetic cards by smartcards.
Because it was designed and started in the ’90s, EMV still relies heavily on symmetric cryptography and especially on triple-DES.
In EMV (contact cards) the following algorithms - and only them - are approved:
- Triple DES ( 8-byte block cipher );
- AES ( 16-byte block cipher );
- RSA;
- SHA-1.
Additionally, EMV is painfully migrating to ECC algorithms (estimated time to completion is 2030) despite NSA’s recommendations to stop using the elliptic curves algorithms.
The NSA’s recommendations may not be inspired by the fears of a Quantum computer been built but rather by flaws discovered in the ECC algorithms or some small advances in solving the elliptic curve discrete logarithm problem (ECDLP), yet the EMV consortium issued on September 2016, a security position statement named “NSA Statement on Post Quantum Cryptography and Suite B” where the strategy of the EMV consortium regarding AES and ECC is clarified.
EMV uses three different card authentication mechanisms: SDA, DDA, and CDA. SDA is considered to be largely unsecured and generally should not be used so practically only DDA and CDA are to be considered here.
All these authentication mechanisms are using signature schemes. Since RSA is the only asymmetric algorithm available in EMV until ECC appears, this means that EMV card authentication schemes are - theoretically - vulnerable to a quantum computer.
A quantum computer could therefore potentially break a DDA or CDA algorithm.
EMV and Post-Quantum crypto
If a quantum computer could be built, it could potentially break the encryption in EMV, allowing to find the private keys of any card and therefore allowing to fully clone EMV cards.
EMV cards cannot be cloned like magnetic-stripe credit or debit cards because the private keys, which are used to authenticate the cards, are stored and protected into the smartcard’s crypto-processor.
EMV operates also a liability shift. In other terms the issuing bank will pay for the fraud, because EMV is not supposed to be vulnerable to any attack and especially EMV payment cards cannot be cloned.
If Quantum computers are developed and produced in the near future by - let us say - a ‘rogue’ country with enough funding and technological abilities, this may imply the worldwide cloning of EMV cards and could create very important financial losses for banks.
The risk has to be mitigated: EMV still uses as well massively symmetric cryptography (Triple-DES and AES) and, until a new quantum algorithm is found, such cryptography should resist in a better way to quantum computing.
EMV is not exactly crypto-agile even if the EMV norms are often “high-levels”. EMV does not specify directly which algorithm should be used so, theoretically, a post-Quantum signature scheme such as CRYSTALS-DILITHIUM could be used to perform CDA authentication for example but this would involve several important changes in EMV personalization norms, EMV card applets and custom EMV cryptographic schemes.
EMV also works with the Global Platform (GP) system, which is totally “high-level” and essentially crypto-agile. The GP Secure Messaging, key exchanges etc…could be theoretically converted to post-Quantum cryptographic algorithms without touching the Global platform specifications.
In terms of the banking industry a migration of EMV to post-Quantum algorithms does not seem currently possible. EMV is still ‘only’ in the slow process of migrating to ECC.
It is always difficult to apprehend how fast a technology can be developed.
Unfortunately (for the actual cryptography), Quantum computing may develop itself exponentially in such a way that even the most pessimistic predictions about the date when such computers would be built, could be much too ‘optimistic’ and at the same time new quantum algorithms could amplify that threat.
EMV and Crypto-agility
A solution exists. It is called crypto-agility. Crypto-agility allows existing platform to move from one cryptographic algorithm to another without changing their systems which could, then, move to post-quantum crypto algorithms, when the time has come, without being modified.
Banks using EMV should start to consider crypto-agility for their projects, and they also should check how efficiently this simple and elegant solution can counter, for instance, the threat of quantum computers.
Of course there is no way to know how the EMV consortium will apprehend the need to use Post-Quantum cryptography and changing the EMV norm in that direction would be a huge task requiring lots of energy . But there are “super-EMV” norms such as the SECCOS norm issued by the german ZKA. SECCOS could become crypto-agile with the idea of making post-quantum crypto payment cards in Germany for example. This idea could also be implemented by the French “Groupement des Cartes Bancaires” (GIE cartes bancaires) or the British “CHIP and PIN”.
Finally, there are multiple scenarios where banks can, from their own initiative, add crypto-agile systems inside their EMV infrastructure without the EMV norm be explicitly crypto-agile. For instance a middleware system can equip both EMV payment cards and EMV terminals (ATMs, EFT terminals etc…). These middleware systems could add an extra-layer of encryption to the EMV flow, using crypto-agility.
In conclusion, EMV isn’t crypto-agile and cannot for the moment deal with the threat created by Quantum Computing. Nevertheless, it is possible for cooperating banks to implement additional systems which will protect their EMV infrastructures. Such additional equipment can be installed inside bank cards and bank terminals managed by cooperating banks or within personalization systems for instance.
Sunday, February 2, 2020
Why we're technologically very late
Why we're technologically very late
A general opinion is that we are now living into a world driven by technological progress...
Actually we're not. We live in a world of profit progress driven by a reduced use of technology.
The only things that is dramatically increasing is the profit rate that we can see in the commercial entities which are developing themselves inside the post-capitalistic societies.
That profit rate is made possible by several tricks, one of them is using a degraded and reduced version of technological progress from the techno-science itself.
Techno-science has not access to freedom and autonomy and must be submissive to markets and profitable organizations often driven by very dumb people and individuals.
As a result, only the following directions have been artificially developed at a maximal scale:
Since in post-capitalistic societies, spectacular-based goods are superior in value, profits and quantity to other goods, technology must be orientated so to follow that direction.
Techno-science is unable to develop priority targets such as :
Contrarily to what many may think, the technology developed in the previous decades stays superior to what is not been developed now. In fact there are just no other technologies to replace them!
We are therefore technologically very late on what we should already have developed!
We should stop that condition and revert to a normal course, but the giant female brain which is now ruling our planet, has certainly other goals for us...
A general opinion is that we are now living into a world driven by technological progress...
Actually we're not. We live in a world of profit progress driven by a reduced use of technology.
The only things that is dramatically increasing is the profit rate that we can see in the commercial entities which are developing themselves inside the post-capitalistic societies.
That profit rate is made possible by several tricks, one of them is using a degraded and reduced version of technological progress from the techno-science itself.
Techno-science has not access to freedom and autonomy and must be submissive to markets and profitable organizations often driven by very dumb people and individuals.
As a result, only the following directions have been artificially developed at a maximal scale:
- Digital computers
- Software orientated for mass consumption
- Video-based technologies
- Advertisement and marketing
- Mobile phones (smart phones)
- Toy robotics
- Bio-technology aimed at cosmetics
Since in post-capitalistic societies, spectacular-based goods are superior in value, profits and quantity to other goods, technology must be orientated so to follow that direction.
Techno-science is unable to develop priority targets such as :
- Space conquest
- Fusion energy
- Serious robotics
- Medical cyber-systems
- etc...
Contrarily to what many may think, the technology developed in the previous decades stays superior to what is not been developed now. In fact there are just no other technologies to replace them!
We are therefore technologically very late on what we should already have developed!
We should stop that condition and revert to a normal course, but the giant female brain which is now ruling our planet, has certainly other goals for us...
How RSA Works
While 'basic', it may be interesting to know how many developers and even security specialists manipulate RSA every day without any understanding of how it works.
Number theory is deeply linked with the creation of ciphers. In some next posts, I shall describe the math principles behind ECC, AES and many other modern ciphers.
One of my new key research at the moment consists of trying to find a novel cipher algorithm combining number theory and neural networks. The idea is to use the complexity inherent to neural networks as a cryptographic system. I should post some more news about that.
Saturday, February 1, 2020
An introduction to Deep Learning
Deep learning is a recurring topic in the context of “Artificial Intelligence” but its definition is often unclear. Indeed, there are several ways of understanding the concept as it groups a collection of notions and facts in Neural Networks.
In general Deep learning is connected with the idea of a ‘real’ Artificial Intelligence, in the sense that it achieves higher complexity than the average machine Learning algorithms for instance (...)
https://documents890.blogspot.com/p/an-introduction-to-deep-learning.html
In general Deep learning is connected with the idea of a ‘real’ Artificial Intelligence, in the sense that it achieves higher complexity than the average machine Learning algorithms for instance (...)
https://documents890.blogspot.com/p/an-introduction-to-deep-learning.html
Dr Ahmadreza Djalali is still in jail...
Dr Ahmadreza Djalali is still in jail...
Several years ago, in April 2016. Dr Ahmadreza Djalali, a researcher in emergency medicine, was arrested by the Iranian authorities on the suspicion of being a spy.
Shortly after, he was 'condemned' to death and was sent to the Evin prison waiting for his execution.
His colleagues started a mobilization and some other people organized petitions.
Petitions after petitions, indignation after indignation, more than a hundred Nobel prizes, mostly in scientific disciplines (physics, medicine, chemistry...), wrote a letter to the Iranian authorities asking for human treatment of Dr. Djalali and his release.
So what happened? Nothing except that Dr. Djalali has not been executed yet.
'They' just wait for a better moment. His death sentence was not reconsidered. Dr. Djalali is very ill and may have leukemia. Imagine as well the terrible psychological stress to wait for an execution that can happen any day!
Everybody sleeps well because "he should be freed soon, very soon" ... I hardly see how that's going to happen without some plan.
As for me, I have already been in touch with the relevant people about him and what strategy scientists should adopt. The petition with the Nobel prizes was my idea but anyway it was done much too late.
Scientists now rely (relied?) on the European Union 'diplomacy' to have Djalali released.
I already mentioned to the interested parties what strategy 'WE' should adopt, acting as an organization and not relying on vanishing powers and crooked third party 'human rights' consultants.
There is a proverb that says "The pen is mightier than the sword".
Actually yes... I agree... a pen is easier to use in close combat by pushing it into each of the eyes of your adversary very fast.
Sometimes it is better to be John Rambo than Albert Einstein... (*)
This is certainly very provocative but it also underlines the very limit of such reasoning. An association such as the "concerned scientists' or 'endangered scholars' have nothing to offer but ... 'writing'.
A boycott has never even been considered as an option. No university, no academic institution wants to take the risk to lose some piece of a cake - as small as it can be. After all, we're all here to make money in one way or another, isn't it? Money is a question of survival and nobody would want to take a chance to do the bad move.
The employees of 'scholars at risk' and others get paid, they get salaries to give 'advice', to provide 'help'. That help is totally useless. Even worse, as long as Dr. Djalali is in jail, there will be a small 'industry' working with it.
Nobody will do any sacrifice again. In terms of careers, reputations. Things must stay smooth.
Then why we don't just forget Dr. Djalali rather than playing that abject comedy? Indignation is a good business and it has the merit of combining money and pride.
There are other ways to try to free Dr. Djalali than writing letters and sending balloons in the air!
I think that specialists can unite their power and strengths to come to the help of each other.
When the great soviet physicist Lev Landau had a terrible car accident in 1962 and was between life and death, all the physicists, medicine specialists of the time teamed altogether to build a device aimed at saving his life, an artificial lung, something that was unprecedented at the time. These were real men of science!
But they say now, we must start praising the merits of 'female brains'... these words sound like 'military intelligence' ... they are perfect opposition of each other! Yet with their basic methods, they both quite dominate us.
There should be a mobilization from scientists to actively and frantically rescue Dr. Djalali because if he dies in jail, scientists won't get anymore the 'magical' protection they used to have.
It will mean that any one of them can be arrested and executed at will for any exotic reason, as decided by 'female brains' and 'military intelligence'.
(*) I'm sure Albert Einstein would have agreed ... somehow
Several years ago, in April 2016. Dr Ahmadreza Djalali, a researcher in emergency medicine, was arrested by the Iranian authorities on the suspicion of being a spy.
Shortly after, he was 'condemned' to death and was sent to the Evin prison waiting for his execution.
His colleagues started a mobilization and some other people organized petitions.
Petitions after petitions, indignation after indignation, more than a hundred Nobel prizes, mostly in scientific disciplines (physics, medicine, chemistry...), wrote a letter to the Iranian authorities asking for human treatment of Dr. Djalali and his release.
So what happened? Nothing except that Dr. Djalali has not been executed yet.
'They' just wait for a better moment. His death sentence was not reconsidered. Dr. Djalali is very ill and may have leukemia. Imagine as well the terrible psychological stress to wait for an execution that can happen any day!
Everybody sleeps well because "he should be freed soon, very soon" ... I hardly see how that's going to happen without some plan.
As for me, I have already been in touch with the relevant people about him and what strategy scientists should adopt. The petition with the Nobel prizes was my idea but anyway it was done much too late.
Scientists now rely (relied?) on the European Union 'diplomacy' to have Djalali released.
I already mentioned to the interested parties what strategy 'WE' should adopt, acting as an organization and not relying on vanishing powers and crooked third party 'human rights' consultants.
There is a proverb that says "The pen is mightier than the sword".
Actually yes... I agree... a pen is easier to use in close combat by pushing it into each of the eyes of your adversary very fast.
Sometimes it is better to be John Rambo than Albert Einstein... (*)
This is certainly very provocative but it also underlines the very limit of such reasoning. An association such as the "concerned scientists' or 'endangered scholars' have nothing to offer but ... 'writing'.
A boycott has never even been considered as an option. No university, no academic institution wants to take the risk to lose some piece of a cake - as small as it can be. After all, we're all here to make money in one way or another, isn't it? Money is a question of survival and nobody would want to take a chance to do the bad move.
The employees of 'scholars at risk' and others get paid, they get salaries to give 'advice', to provide 'help'. That help is totally useless. Even worse, as long as Dr. Djalali is in jail, there will be a small 'industry' working with it.
Nobody will do any sacrifice again. In terms of careers, reputations. Things must stay smooth.
Then why we don't just forget Dr. Djalali rather than playing that abject comedy? Indignation is a good business and it has the merit of combining money and pride.
There are other ways to try to free Dr. Djalali than writing letters and sending balloons in the air!
I think that specialists can unite their power and strengths to come to the help of each other.
When the great soviet physicist Lev Landau had a terrible car accident in 1962 and was between life and death, all the physicists, medicine specialists of the time teamed altogether to build a device aimed at saving his life, an artificial lung, something that was unprecedented at the time. These were real men of science!
But they say now, we must start praising the merits of 'female brains'... these words sound like 'military intelligence' ... they are perfect opposition of each other! Yet with their basic methods, they both quite dominate us.
There should be a mobilization from scientists to actively and frantically rescue Dr. Djalali because if he dies in jail, scientists won't get anymore the 'magical' protection they used to have.
It will mean that any one of them can be arrested and executed at will for any exotic reason, as decided by 'female brains' and 'military intelligence'.
(*) I'm sure Albert Einstein would have agreed ... somehow
Subscribe to:
Posts (Atom)