Hasty Briefsbeta

All tags

#encryption

136 stories total

Bilingual

New in Gmail: Making E2E encrypted emails easy to use for all organizations
a year ago
- Google introduces easy-to-use end-to-end encrypted (E2EE) emails for all organizations, breaking down traditional IT complexities.
- E2EE in Gmail now allows sending encrypted messages to any email inbox with minimal effort, enhancing data sovereignty and privacy.
- The new feature eliminates the need for S/MIME setup, certificate management, and custom software, simplifying the process for IT teams and users.
- Gmail's E2EE works by encrypting emails with keys controlled by the customer, not Google, ensuring enhanced security and privacy.
- For non-Gmail recipients, an invitation to view the email in a restricted Gmail version is sent, maintaining security.
- IT teams can enforce policies requiring external recipients to use the restricted Gmail version for additional data control.
- Client-side encryption (CSE) powers this feature, encrypting data before it reaches Google's servers, meeting regulatory requirements.
- Additional security enhancements include CSE default mode, classification labels, data loss prevention (DLP), and a new AI model for threat protection.
- Google continues to focus on strengthening security and compliance for all customers, with early access available for E2EE in Gmail.
Gmail Users Can Send Encrypted Email to Anyone
a year ago
- Google launched Gmail on April 1, 2004, which now has 2.5 billion active users.
- Gmail is introducing end-to-end encryption (E2EE) for enhanced security and privacy.
- Google claims to have invented a new type of encryption to simplify the process and overcome complexity and cost barriers.
- Enterprise Gmail users will be able to send E2EE messages to any email inbox with minimal effort.
- The new encryption model removes the need for complex certificates and administration, creating a 'protective bubble' around emails.
- Encryption keys are controlled by the customer, not Google, ensuring enhanced data privacy and security.
- Non-Gmail recipients will receive an invite to view the email via a restricted version of Gmail as a Google Workspace guest account.
- The E2EE functionality is powered by client-side encryption in Google Workspace and is being rolled out in phases, starting with beta access for enterprises.
Intuiting TLS
a year ago
- The internet's problem: Anyone between you and websites can see/edit communication.
- TLS (Transport Layer Security) aims to solve privacy issues in public settings.
- Encryption basics: Use a cipher known only to you and the website.
- Problems with simple ciphers: Complexity and uniqueness per website are needed.
- Random Number Generator (RNG) with a seed (key) for unique ciphers per website.
- Key Exchange problem: How to securely share the website's key without interception.
- Diffie-Hellman Key Exchange: Uses one-way and commutative operations for secure key sharing.
- Authentication challenges: Ensuring the other party is who they claim to be (Key Authenticity).
- Data Authenticity: Using hash functions to verify message integrity.
- Authenticated Encryption (AEAD): Combines encryption with hashing for data integrity.
- Key Authenticity solution: Pre-Shared Keys (PSK) or certificates for trust.
- Certificates: Use signatures from a trusted third-party (Root) to verify identities.
- Public Key Infrastructure (PKI): Centralized trust system using certificates.
- TLS handles edge cases like forward secrecy and data/timing attacks.
- Resources for learning TLS: Monocypher, TweetNaCl, Julia Evans’ Toy TLS 1.3, xargs’ Illustrated TLS 1.3.
NNCP
a year ago
- NNCP enables secure file transfers and remote execution between systems without requiring simultaneous online presence.
- It supports asynchronous communication via various mediums like USB sticks, tapes, radios, and cloud services.
- NNCP is an encrypted, authenticated, and onion-routed version of UUCP, enhancing privacy and security.
- Designed for small, ad-hoc friend-to-friend (F2F) networks, it ensures end-to-end encryption and integrity checks.
- Supports multiple applications including email, Usenet, web services, and more, with flexible routing options.
- NNCP is ideal for privacy-focused, resilient, and self-reliant technology setups.
- Documentation and learning resources are available, including concepts, getting started guides, and project ideas.
UK can't keep its encryption fight with Apple private, court rules
a year ago
- The UK government ordered Apple to provide a backdoor in iCloud for global surveillance, including content under Advanced Data Protection (ADP).
- Apple initially considered appealing the order but removed ADP access for UK users, leaving only Standard Data Protection (SDP).
- Apple formally appealed the directive, with rights groups pushing for a public hearing instead of closed-door proceedings.
- The Investigatory Powers Tribunal (IPT) rejected the UK government's request to keep case details private, dismissing national security concerns.
- Rights groups argued against secrecy, citing widespread reporting on the issue and Apple's removal of ADP for UK users as clear indicators of the case's nature.
- Apple has a history of resisting government demands to weaken encryption, notably refusing to unlock the iPhone of the San Bernardino shooter in 2016.
Apple's encryption row with UK should not be secret, court rules
a year ago
- A UK court ruled that the legal dispute between Apple and the UK government over data privacy cannot be held in secret.
- The UK Home Office seeks access to data protected by Apple's Advanced Data Protection (ADP) system under the Investigatory Powers Act.
- Apple opposes creating a 'backdoor' into ADP, citing security risks from hackers and criminals.
- The government argued that public disclosure of the case details would harm national security, but the tribunal rejected this, citing the principle of open justice.
- Privacy and digital rights groups, including Open Rights Group and Big Brother Watch, welcomed the ruling, emphasizing public interest and transparency.
- ADP uses end-to-end encryption (E2EE), making data accessible only to the user, posing challenges for law enforcement.
- The Home Office clarified it is not seeking blanket data access and requires court-approved warrants for individual account access.
- Apple reiterated its commitment to user privacy and security, stating it will never create a backdoor.
Apple-UK data privacy row should not be secret, court rules
a year ago
- A UK court ruled that the legal dispute between Apple and the UK government over data privacy cannot be held in secret.
- The UK Home Office seeks access to data protected by Apple's Advanced Data Protection (ADP) system under the Investigatory Powers Act.
- Apple opposes creating a 'backdoor' into ADP, citing security risks from potential exploitation by hackers and criminals.
- The government argued that publicizing the case details would harm national security, but the tribunal rejected this claim.
- Civil liberties groups and news organizations, including the BBC, advocated for the case to be heard publicly.
- ADP uses end-to-end encryption (E2EE), making data accessible only to the user, posing challenges for law enforcement.
- Privacy campaigners welcomed the ruling, emphasizing the importance of transparency in cases affecting global privacy rights.
Apple has won legal battle in UK to disclose backdoor publicly
a year ago
- Apple won its first legal battle against the UK government regarding encrypted data backdoor demands.
- The Investigatory Powers Tribunal ruled that Apple can publicly disclose the legal challenge, rejecting secrecy on national security grounds.
- The victory does not immediately restore ADP encryption in the UK or make hearings public, but increases transparency.
Florida's New Social Media Bill Explicitly Demands an Encryption Backdoor
a year ago
- Florida's SB 868/HB 743 bill mandates social media platforms to decrypt end-to-end encryption for law enforcement with a subpoena.
- The bill openly seeks a backdoor into encrypted platforms for minors, potentially leading companies to remove encryption for minors altogether.
- Encryption is crucial for online safety, and removing it for minors undermines their privacy and security.
- The bill is impractical; creating a backdoor for 'good guys' or specific user groups (like minors) is impossible without compromising everyone's privacy.
- Similar attempts, like in Nevada, argue law enforcement needs access for investigations, but evidence shows content-oblivious methods (e.g., user reporting) are more effective.
- Law enforcement can already investigate encrypted messages by accessing devices; the bill's additional restrictions on ephemeral messaging features are unnecessary and harmful.
- The bill expands Florida's controversial HB 3 social media law, which is already facing constitutional challenges in court.
- Weakening encryption harms privacy for all users, including minors and their contacts. Florida should focus on improving privacy laws and digital literacy instead.
AES and ChaCha
a year ago
- AES (Advanced Encryption Standard) and ChaCha20 are two leading symmetric encryption ciphers.
- AES, established in 2001, is widely used in TLS, VPNs, and messaging apps but relies on complex operations like SubBytes and MixColumns.
- ChaCha20, introduced in 2008, uses simpler ARX (Add, Rotate, XOR) operations, making it faster and more secure against timing attacks.
- AES performance benefits from hardware acceleration (AES-NI), while ChaCha20 performs consistently across all CPUs without special hardware.
- ChaCha20's simplicity reduces vulnerabilities like cache-timing attacks, common in AES due to lookup tables.
- ChaCha20 is increasingly adopted in technologies like TLS, WireGuard, and OpenSSH, often paired with Poly1305 for authenticated encryption.
- The article advocates for simplicity in cryptographic design, highlighting ChaCha20's advantages in security, performance, and ease of implementation.
Show HN: AES-256 brute force using structured logic (UUIDs and xy = x/y rule)
a year ago
- A compact toolkit for brute-force cracking of UUID-encrypted AES-256-CBC files using logic-based initialization.
- Demonstrates deterministic search behavior within defined entropy spaces using the principle xy = x / y.
- Requires Python 3.x and pycryptodome for operation.
- Includes demo files for generating and cracking UUID-encrypted files with structured suffixes.
- uuid_demo_kit.py encrypts messages with UUIDs based on numeric suffixes.
- uuid_demobreaker.py scans UUID space linearly from index 0 to 1 million (adjustable).
- The system explores UUID space without guessing, filtering, or probabilistic shortcuts.
- Field ignition principle defines the search terrain rather than guiding the search.
Encryption Is Not a Crime
a year ago
- Encryption is not a crime but a protective shield for digital privacy and security.
- End-to-end encryption ensures only intended recipients can access data, protecting against unauthorized surveillance.
- Authorities in various countries attempt to undermine encryption under the guise of crime prevention, despite expert warnings.
- Breaking encryption endangers everyone, including children, by exposing sensitive data to potential misuse.
- The concept of a 'magical backdoor' for encryption is flawed and would be exploited by criminals.
- Support for encryption rights includes using encrypted services, educating others, and advocating with policymakers.
- Organizations and individuals continue to fight against attempts to weaken encryption globally.
Syncing Keyhive
a year ago
- Ink & Switch introduces Beelay, a new RPC protocol for data transfer between devices, focusing on local-first access control and encryption.
- Beelay is designed to work over HTTPS, WebSockets, or raw TLS, ensuring confidentiality and requiring authentication via Ed25519 keys.
- Keyhive's structure uses 'groups' and 'individuals' for access control, with documents represented as groups to manage permissions.
- Authentication in Beelay involves signing messages and addressing PITM and replay attacks by including audience fields and timestamps.
- RIBLT (Rateless Invertible Bloom Lookup Tables) is used for efficient set reconciliation, minimizing data transfer for synchronization.
- The sync process involves membership graph synchronization, document state comparison, and CGKA operations synchronization.
- Sedimentree protocol is introduced for compacting Automerge commit graphs, optimizing bandwidth usage during document synchronization.
- The common case sync is optimized to reduce round trips, aiming for efficient updates with minimal network overhead.
How encryption for Cinema Movies works
a year ago
- The DCI (Digital Cinema Initiatives) specification defines standards for secure movie distribution, including file formats, encryption, and projection systems.
- DCP (Digital Cinema Package) contains all movie components (metadata, subtitles, audio, and video) in separate files, encrypted with a static AES-128 key.
- KDM (Key Delivery Message) is an XML file containing cryptographic information to decrypt a DCP for playback on a specific projector.
- The distribution process involves encrypted AES keys, certificate chains (Root CA, Intermediate CA, Leaf Certificate), and trusted device lists.
- Projection systems consist of a server, audio processor, and projector, with a 'Media Block' handling DRM and decryption in real-time.
- DCPs are stored encrypted and can be imported via USB/CRU hard drives or internet download.
- MXF (Material Exchange Format) files are used for movie frames, encrypted with AES-128 and unique IVs (Initialization Vectors) per frame.
- DCI compliance ensures security through unique AES keys per DCP, TPM-like hardware for key storage, and distributor verification of projector certificates.
- DCI v1.4.4 now allows playback of DCPs with expired signer certificates, with manufacturers working on updates.
- Open-source tools like DCP-o-matic and asdcplib are used for DCP creation and decryption.
AES-128 Plaintext Recovery in Nordic Semiconductor NRF52840 SoC
a year ago
- CryptoCell CC310 vulnerability affects ECB, CBC, and CTR modes, undermining data confidentiality.
- Plaintext recovery is achieved with voltage fault injection in ECB, CBC, and CTR modes, though key extraction in ECB mode via DFA is not possible.
- Observed fault patterns include plaintext output, all-zeroes output, full and partial error byte diffusion.
- Root cause: AES hardware engine lacks protection against fault injection, leading to corrupted encryption outputs.
- Hardware-based fault injection uses a custom voltage glitching tool with a MOSFET crowbar circuit, requiring no capacitor removal.
- DFA analysis in ECB mode did not yield key extraction; precise fault patterns for optimal DFA were not consistently generated.
- Impact: Vulnerability exposes sensitive plaintext data (e.g., passwords, cryptographic keys), bypassing encryption protections.
- Affects secure communication protocols between SoC and other devices, compromising confidentiality.
What the heck is AEAD again?
a year ago
- AEAD stands for 'Authenticated Encryption with Associated Data' and is the current industry standard for encryption.
- AEAD ensures both the confidentiality and authenticity of encrypted messages, preventing tampering and unauthorized access.
- Modern protocols like TLS 1.3 and QUIC require AEAD, and libraries like Google's Tink and libsodium support it.
- Authenticated Encryption (AE) ensures the message hasn't been altered and originates from someone with the secret key.
- Associated Data (AD) allows unencrypted data to be authenticated alongside encrypted data, ensuring its integrity.
- AEAD simplifies secure encryption by combining encryption and authentication into a single, misuse-resistant API.
- Popular AEAD ciphers include AES256-GCM and ChaCha20-Poly1305, with recommendations varying by use case and library.
Indian court orders blocking of Proton Mail
a year ago
- Karnataka High Court orders blocking of Proton Mail in India following a complaint by M Moser Design Associates.
- Proton Mail allegedly refused to share sender details of offensive emails despite a police complaint.
- Indian government suggests criminal courts could seek information from Swiss authorities.
- Proton Mail has faced previous legal challenges in India, including a 2023 attempt to block it over hoax bomb threats.
- Proton argues blocking its service does not prevent cybercrime but hinders secure communication for law-abiding users.
- Delhi High Court in October 2024 calls for investigation into Proton Mail's use in India.
When encryption works perfectly and still fails
a year ago
- Encryption is fundamental for secure communication but has inherent vulnerabilities beyond mathematical strength.
- Publicly discussed cryptography threats include breakthroughs in mathematical problems (e.g., P = NP, quantum computing), cryptanalysis (e.g., Enigma machine), and side-channel attacks (e.g., Spectre, Meltdown, Rowhammer).
- The most significant threat is human error, such as adding the wrong person to a group chat, bypassing encryption security.
- Example: National Security Advisor Mike Waltz accidentally added a journalist to a sensitive Signal group chat, exposing classified information.
- Key management is a critical and often overlooked challenge in cryptography, harder than the encryption itself (Kissner’s law).
- Key management issues include identity verification, key generation authority, and key revocation/rotation.
- Many breaches stem from key management failures (e.g., phishing) rather than cryptographic weaknesses.
- Key management lacks standardized solutions and heavily depends on application-specific user experience.
TeleMessage, a modified Signal clone used by US govt. officials, has been hacked
a year ago
- A hacker exploited a vulnerability in TeleMessage to extract archived messages and data related to U.S. government officials and companies.
- TeleMessage provides modified versions of encrypted messaging apps like Signal, Telegram, and WhatsApp for message archiving.
- The compromised data included message contents, contact details of officials, backend login credentials, and information from U.S. Customs and Border Protection, Coinbase, and Scotiabank.
- The hack revealed that archived chat logs in TeleMessage's modified Signal version are not end-to-end encrypted during storage.
- Entities like Smarsh, Signal, U.S. Customs and Border Protection, Coinbase, and Scotiabank did not immediately respond to comment requests.
TeleMessage suspends services after hackers claim to have stolen files
a year ago
- TeleMessage, an encrypted messaging app used by government officials, suspended services after a security breach.
- Hackers claimed to have stolen files from TeleMessage, prompting an investigation by parent company Smarsh.
- The app's encryption and security protocols are unclear, unlike Signal, which is highly regarded by cybersecurity experts.
- TeleMessage's use by officials raises concerns about balancing secrecy with legal requirements to archive communications.
- A hacker provided evidence of breaching TeleMessage, including a screenshot of Coinbase employees' contact list.
- Coinbase confirmed the screenshot's authenticity but stated no customer data was compromised.
- Government agencies like DHS and Treasury have active contracts with TeleMessage, per NBC News.
- Another hacker also claimed to have breached TeleMessage, though NBC News has not verified this claim.

firstprev0next

About|Login

#encryption

New in Gmail: Making E2E encrypted emails easy to use for all organizations

Gmail Users Can Send Encrypted Email to Anyone

Intuiting TLS

NNCP

UK can't keep its encryption fight with Apple private, court rules

Apple's encryption row with UK should not be secret, court rules

Apple-UK data privacy row should not be secret, court rules

Apple has won legal battle in UK to disclose backdoor publicly

Florida's New Social Media Bill Explicitly Demands an Encryption Backdoor

AES and ChaCha

Show HN: AES-256 brute force using structured logic (UUIDs and xy = x/y rule)

Encryption Is Not a Crime

Syncing Keyhive

How encryption for Cinema Movies works

AES-128 Plaintext Recovery in Nordic Semiconductor NRF52840 SoC

What the heck is AEAD again?

Indian court orders blocking of Proton Mail

When encryption works perfectly and still fails

TeleMessage, a modified Signal clone used by US govt. officials, has been hacked

TeleMessage suspends services after hackers claim to have stolen files