Reusable Security

When I said you could ignore this blog for the next couple of weeks, little did I realize how true that would be. I know this is the internet where no-one is ever wrong , but I'd like to retract some of the statements I made in the previous post about Safeberg's use of paper keys. As I said before , I won't always be right, but I will try to correct myself when I am proven wrong. My real failure was that I didn't take the time to perform the proper research. That's why I wasn't planning on posting anything in the first place. But then I saw pictures like the one below, and just about every, "Someone is BSing me" alarm I had went off. Hence the angry post. While some of the underlying points I made were factually correct, I had in my mind that Safeberg was selling standard file encryption software like Truecrypt. Instead they provide file storage and recovery. That's a pretty big misunderstanding on my part. The reason why that makes a differenc...

I know I said I wasn't going to post anything, but then I saw this craziness on slashdot and like other bad ideas I just have to share it. For those of you who don't want to click on the link, (smart move), a short summary is that a company called Safeberg is marketing file encryption software where the private RSA key is stored on a printed out piece of paper . To decrypt your files, you just take a picture of the key with your web-cam and their software will turn it back into a digital key. You can see a YouTube video they produced about it here . No seriously, this is a real product... How do I know this is snake oil? It's using zany solutions to something that's not a problem They spend all their time talking about key length First, let's back up and talk about file encryption. I've written a proof of concept password cracker for TrueCrypt encrypted files, and I'm currently working with another graduate student to implement it using GPU processors, so ...

I apologize for the lack of actual posts. Right now I'm facing several fairly strict deadlines when it comes to graduating, so you probably can ignore this blog for the next two weeks or so. I know, it's annoying for me too because from real life spies caught on camera , to a new WPA attack , there's a few things to blog about... For now though, it's LoLcats and funny comics 24/7

Click on the image to get the full comic, or better yet check it out at its original location . Courtesy of http://www.overcompensating.com/

Wired has a very interesting article talking about the FBI's investigation into the case of Brian Regan, who tried to sell a bunch of classified documents to foreign governments. Here is a link . The most interesting thing that I took from the article is that either A) The NSA was unable to crack a simple Caesar Cipher (ROT25), or B) they just didn't bother to share the results with the FBI after claiming to make no progress. Honestly I don't know which option would be better...

I've twice gotten into heated debates, (and I remember the count since I still find it weird that I've gotten into arguments about this), that there is no universal letter frequency probability values for the English language. Both times I stumbled into this argument by answering the question, "So, do passwords match letter frequency analysis of the English language as a whole", by replying, "Well, it depends on what training set you use to calculate the probabilities of the English language, but for the most part, yes". In reality I should have just said, "For the most part yes..." Letter frequency analysis, and its big brother Markov models, depend entirely on their training sets. This means while different training sets may share common characteristics, there is no one LFA, or Markov set of probabilities that perfectly model the English, (or any other), language. But what about those tables Wikipedia posted ? Well, they are based on a study in 1...

Leaving sunny, warm Florida for DC. What am I thinking... Ah, yah Shmoocon . I'll probably be wearing my FSU hat if anyone wants to grab a few drinks, (I know the picture on the side of the blog isn't very good for identification purposes).