DOCSLIB.ORG

Cryptographic Hash Functions Recent Results on Cryptanalysis and Their Implications on System Security

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Cryptographic Hash Functions Recent Results on Cryptanalysis and Their Implications on System Security Cryptographic Hash Functions Recent Results on Cryptanalysis and their Implications on System Security RudigerÄ Weis1 and Stefan Lucks2 1 Technical University of Applied Sciences Berlin 2 University of Mannheim Abstract. Recently, several severe attacks against cryptographic hash functions where discovered. This includes attacks against MD4 and MD5, two rather old hash functions. Very unfortunately, MD5 is still widely used in practice in many software integrity schemes, including, but not limited to the most popular Linux packet formats. This may pose a serious security problem. In this paper we discuss the current state of research on hash functions and some ¯rst-aid workarounds. We briefely discuss the trouble \Trusted" Computting has got into, by trusting the SHA-1 hash function which now has been broken. A spectre is haunting IT-security { the spectre of hash function cryptanalysis. Hash functions, the cryptographic workhorses for data authenticity and integrity, are broken one by one. There are three kinds of attacks: { structural weaknesses, { analytical weaknesses, and { exploits of both. In the current paper, we briey explain how current hash func- tions work, which attacks cryptographic hash functions should de- fend against, and what had gone wrong now (Section 1). More specif- ically, we describe how to exploit the currently known weaknesses, and discuss their practical consequences (Section 2), including the trouble for \Trusted" Computing, due to the \hardwired" use of SHA-1, and the risks of still using MD5 (3). We further describe the immediate consequences for the \users" of hash functions (Section 4) and an outlook on future development (Section 5). Finally, we give a short summary (Section 6). 1 Hash Functions and Attacks A cryptographic hash function H : f0; 1g¤ ! f0; 1gn maps an in¯nite set of inputs to the ¯nite set of n-bit hash values. Informally, a real hash function H should behave like an ideal one (i.e., like a random oracle). This would not be useful for a formal de¯nition, though. Instead, one considers somewhat simpler security goals for H : f0; 1g¤ ! f0; 1gn. While collisions (inputs X =6 Y with H(X) = H(Y )) necessar- ily exist, as there are more inputs than outputs, a hash function should be collision resistant: given H, it should be infeasible for an adversary to actually ¯nd any collisions. Additionally, a hash function should resist preimage and 2nd preimage attacks: Given Z, it should be infeasible for an adversary to ¯nd any X with H(X) = Z, and given Y , it should be infeasible to ¯nd Y with H(X) = H(Y ). Classes of Attacks A bit more formally, we distinguish the following classes of attacks: Collision attack: Find two messages M =6 M 0 with H(M) = H(M 0). Preimage attack: Given a random value Y 2 f0; 1gn, ¯nd a mes- sage M with H(M) = Y . 2nd preimage attack: Given a message M, ¯nd a message M 0 =6 M with H(M) = H(M 0). K-collision attack for K ¸ 2: Find K di®erent messages M i, with H(M 1) = ¢ ¢ ¢ = H(M K ). K-way (2nd) preimage attack for K ¸ 1: Given Y (or M with H(M) = Y ), ¯nd K di®erent messages M i, with H(M i) = Y (and M i =6 M). The last two are natural generalisations of the more `traditional" collision attacks (2-collisions) and `1-way" preimage and 2nd preim- age attacks. We compare the resistance of a given hash function against these attacks with the resistance a random oracle would pro- vide: Fact: Model H : f0; 1g¤ ! f0; 1gn as a random oracle. Finding a K-collision for H takes time ¼ 2(K¡1)¢n=K , and ¯nding a K-way preimage or a K-way 2nd preimage for H takes time ¼ K ¢ 2n. 2 Special case: Finding a \normal" (2-)collision for a random oracle H takes time ¼ 2n=2 and ¯nding a preimage or a 2nd preimage takes time ¼ 22n. 1.1 Hash Functions and Digital Signatures Why is it so important for a hash function to be 2nd preimage re- sistant and even collision resistant? Why is it so dangerous if a hash function does not defend against ¯nding 2nd preimages or collisions? As a motivating example, consider digital signature schemes. A message M has to be signed. The signature scheme is broken, if the adversary can forge a signature for another message M 0. In practise, cryptographic signature schemes follow the hash-and-sign paradigm: Instead of signing the (potentially very long) message M, one actu- ally computes a short \¯ngerprint" H(M) and signs X. Given a signature for some message M, and adversary able to compute a 2nd preimage M 0 with H(M) = H(M 0) is able to forge a signature for M 0, as the signature for M is valid as well for M 0. So much about the importance of 2nd preimage resistance. But why is collision resistance a big deal? 2nd preimage resistance is ¯ne { if we always trust the party who chooses the message M to be signed. But if we don't, we need collision resistance! Otherwise, the adversary could compute the col- lision M =6 M 0, sign M or present M to be signed, and later claim the signature on M 0. 1.2 Structural Weaknesses of Today's Hash Functions The design of today's cryptographic hash functions, including but not limited to MD4, MD5, SHA-0, SHA-1, SHA-2 family, RIPEMD, RIPEMD-160, Whirlpool, Tiger, . ubiquitously follows the MD structure by Merkle and Damgºard (MD) [19, 5] for hash functions. As a hash function H : f0; 1g¤ ! f0; 1gn has to handle arbitrarily long inputs1, the idea is to design an internal compression function C : f0; 1gn£f0; 1gm ! f0; 1gn with ¯xed input size, to split the given message M into m-bit blocks M[1], . , M[L] (with some padding in 1 In practise, the input size of of all these hash function is limited to some ¯xed upper bound. As this bound is at least 264 bit, this is hardly a practical limitation. 3 the ¯nal block M[L]), and to compute the hash by straightforwardly iterating the compression C, as shown in Figure 1. C C C H[0] H[1] H[2] H[L−1] H[L] M[1] M[2] M[L] Fig. 1. The iterated Merkle-Damgºard (MD) structure for hash functions As shown in [19, 5], the hash function h is collision resistant, if the compression function is. This is the strong point of the MD structure. Unfortunately, there is a weak point, as well: the MD structure is rather failure-unfriendly { if computing a compression function collision is somehow feasible, all the bets are o®. In fact, it had turned out that these hash functions failed worse than expected. Length Extension Attacks The length extension property is a well-known generic weakness of the MD hash (see e.g. [8, Section 6.3.1]): Given H = H(M); it is straightforward to compute M 0 and H0, such that H0 = H(MjjM 0) { even for unknown M. (For the correct padding of the ¯nal message block, one needs to know the length of M.) 2nd Collision Attacks Once you have found a collision, it is trivial to produce more such collisions: If H(M) = H(N) for any two messages M, N, then H(MjjS) = H(NjjS) for all S 2 f0; 1gn. 4 Multiple Collisions Finding multiple collisions should be way more expensive than ¯nd- ing plain (2-)collisions { but Joux [15] disproved this for the MD design. He described a generic attack to ¯nd 2k-Collisions for a MD k k hash H in time ¼ k ¢ 2n=2, instead of ­(2n(2 ¡1)=2 ): For i in 1 . , k: 0 1 ! Find a local collision Mi =6 Mi with 0 1 Hi = C(Hi¡1; Mi ) = C(Hi¡1; Mi ): All the 2k messages 0 0 0 0 1 1 1 (M1 ; : : : ; Mk ); (M1 ; : : : ; Mk¡1; Mk ); : : : ; (M1 ; : : : ; Mk ) hash to the same value Hk. (Note that all messages are of the same (not too large) size of k blocks.) Using Joux' multicollision attack as a tool As Joux pointed out [15], the adversary's ability to ¯nd large K- collisions opens the door for further attacks. Below, we sketchily describe them. Attacking cascaded hash functions. Let a hash H : f0; 1g¤ ! f0; 1gn be de¯ned as H(M) = H1(M)jjH2(M) with two independent n-bit hashes H 1 and H2. If both H1 and H2 are independently de¯ned as random oracles, then ¯nding collisions for H takes time 2n. If, however, either is constructed as a MD hash, ¯nding a collision for H only takes time ¼ (n=2) ¤ 2n=2: W.l.o.g., let H1 be the MD hash: ! Find 2(n=2)-collisions for H1 (in (n=2) ¤ 2n=2 units of time). Sta- tistically, one such collision also collides for H 2 (and thus for H). 5 Finding multiple (2nd) preimages. Given a target Y 2 f0; 1gn, the attack proceeds as follows: k ! Generate 2k colliding k-block messages M 1, . , M 2 with 1 2k Hk = H(M ) = ¢ ¢ ¢ = H(M ): ! Find a message chunk Mk+1, such that C(Hk; Mk+1) = Y . This provides a 2k-way preimage. The ¯rst step takes time k ¤ 2n=2, which is marginal, compared to the second step. This takes about the time for a single preimage attack, i.e., ¼ 2n. For a 2nd preimage message attack with the target message M, just set Y := H(M).
Load more

Recommended publications
  • Trusted Platform Module (TPM) Quick Reference Guide
    Trusted Platform Module (TPM) Quick Reference Guide System builders/integrators should give this Guide to the system owners to assist them in enabling and activating the Trusted Platform Module. Warning of Potential Data Loss ..........................3 Trusted Platform Module (TPM) .........................5 System Requirements ........................................5 Security Precautions ..........................................5 Password Procedures ............................................. 6 Emergency Recovery File Back Up Procedures ........... 7 Hard Drive Image Backup Procedures....................... 7 Clear Text Backup (Optional) .................................. 7 Trusted Platform Module Ownership ..................8 Trusted Platform Module Software Installation..8 Enabling the Trusted Platform Module ...............8 Assuming Trusted Platform Module Ownership..9 Recovery Procedures ........................................10 How to Recover from a Hard Drive Failure ............... 10 How to Recover from a Desktop Board, coin battery or TPM Failure........................................... 10 Clearing Trusted Platform Module Ownership ...11 Support Links ....................................................12 INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL® PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER,
    [Show full text]
  • Trusted Platform Module (TPM) TCG 1.2 / 2.0
    Trusted Platform Module (TPM) TCG 1.2 / 2.0 USER GUIDE Revision 1.20 The information in this user's guide has been carefully reviewed and is believed to be accurate. The vendor assumes no responsibility for any inaccuracies that may be contained in this document, and makes no commitment to update or to keep current the information in this manual, or to notify any person or organization of the updates. Please Note: For the most up-to-date version of this manual, please see our website at www.supermicro.com. Super Micro Computer, Inc. ("Supermicro") reserves the right to make changes to the product described in this manual at any time and without notice. This product, including software and documentation, is the property of Supermicro and/ or its licensors, and is supplied only under a license. Any use or reproduction of this product is not allowed, except as expressly permitted by the terms of said license. IN NO EVENT WILL SUPER MICRO COMPUTER, INC. BE LIABLE FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, SPECULATIVE OR CONSEQUENTIAL DAMAGES ARISING FROM THE USE OR INABILITY TO USE THIS PRODUCT OR DOCUMENTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN PARTICULAR, SUPER MICRO COMPUTER, INC. SHALL NOT HAVE LIABILITY FOR ANY HARDWARE, SOFTWARE, OR DATA STORED OR USED WITH THE PRODUCT, INCLUDING THE COSTS OF REPAIRING, REPLACING, INTEGRATING, INSTALLING OR RECOVERING SUCH HARDWARE, SOFTWARE, OR DATA. Any disputes arising between manufacturer and customer shall be governed by the laws of Santa Clara County in the State of California, USA. The State of California, County of Santa Clara shall be the exclusive venue for the resolution of any such disputes.
    [Show full text]
  • Pitx-APL V2.0
    USER GUIDE pITX-APL V2.0 Doc. Rev. 1.4 Doc-ID: 1065-6365 pITX-APL V2.0 – Rev. 1.4 This page has been intentionally left blank pITX-APL V2.0 – Rev. 1.4 PITX-APL V2.0 – USER GUIDE Disclaimer Kontron would like to point out that the information contained in this manual may be subject to alteration, particularly as a result of the constant upgrading of Kontron products. This document does not entail any guarantee on the part of Kontron with respect to technical processes described in the manual or any product characteristics set out in the manual. Kontron assumes no responsibility or liability for the use of the described product(s), conveys no license or title under any patent, copyright or mask work rights to these products and makes no representations or warranties that these products are free from patent, copyright or mask work right infringement unless otherwise specified. Applications that are described in this manual are for illustration purposes only. Kontron makes no representation or warranty that such application will be suitable for the specified use without further testing or modification. Kontron expressly informs the user that this manual only contains a general description of processes and instructions which may not be applicable in every individual case. In cases of doubt, please contact Kontron. This manual is protected by copyright. All rights are reserved by Kontron. No part of this document may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without the express written permission of Kontron.
    [Show full text]
  • Intel® Select Solutions for Microsoft SQL Server* on Windows Server
    SOLUTION BRIEF Intel® Select Solutions Enterprise Data Center Infrastructure April 2019 Intel® Select Solutions for Microsoft SQL Server* Business Operations Flexible, easy-to-deploy, scalable solutions optimized for performance enable organizations to achieve their needed results. The quantity, size, and complexity of data center workloads increases almost every day. It’s crucial that those workloads run on compute, network, and storage infrastructure that is ideally tuned—and tested—to deliver optimized performance. Intel® Select Solutions for Microsoft SQL Server* Business Operations are optimized for online transaction processing (OLTP) to provide that assurance. Intel Select Solutions are hardware and software stacks optimized for specific workloads. Intel and data center solution providers tune the configurations using Intel® Xeon® Scalable processors and Intel® technologies to help ensure enterprises receive their needed performance. Intel Select Solutions for SQL Server Business Operations SQL Server is one of the world’s most popular relational database management systems (RDBMSs). Intel Select Solutions for SQL Server Business Operations can help minimize the time, cost, and complexity required for an enterprise to evaluate hardware and software integrations. Intel Select Solutions are tested to deliver optimum performance, improved security, reliability, and agility. Intel Select Solutions for SQL Server Business Operations are not only optimized to meet current performance needs, they also include technologies ready to help reduce the complexity of meeting evolving data center needs. What Are Intel® Select Solutions? Intel Select Solutions are verified hardware and software stacks that are optimized for specific software workloads across compute, storage, and network. The solutions are developed from deep Intel experience with industry solution providers, in addition to extensive collaboration with the world’s leading data center and service providers.
    [Show full text]
  • Using Remote Attestation of Trust for Computer Forensics
    Using Remote Attestation of Trust for Computer Forensics Gabriela Claret Limonta Marquez School of Electrical Engineering Thesis submitted for examination for the degree of Master of Science in Technology. Espoo 20.11.2018 Supervisor Prof. Raimo Kantola Advisor Dr. Ian Oliver Copyright ⃝c 2018 Gabriela Claret Limonta Marquez Aalto University, P.O. BOX 11000, 00076 AALTO www.aalto.fi Abstract of the master’s thesis Author Gabriela Claret Limonta Marquez Title Using Remote Attestation of Trust for Computer Forensics Degree programme Computer, Communication and Information Sciences Major Communications Engineering Code of major ELEC3029 Supervisor Prof. Raimo Kantola Advisor Dr. Ian Oliver Date 20.11.2018 Number of pages 94+34 Language English Abstract Telecommunications systems are critical systems with high quality of service con- straints. In Network Function Virtualization (NFV), commonly known as the Telco Cloud, network functions are distributed as virtual machines that run on generic servers in a datacenter. These network functions control critical elements; therefore, they should be run on trusted hardware. Trusted computing concepts can be used to guarantee the trustworthiness of the underlying hardware platform running critical workload. These concepts include the Trusted Platform Module and Remote Attestation. This work identifies limitations in existing solutions and uses those as motivation for designing and implementing a finer-grained definition of trust. This thesis designs and develops a remote attestation solution, which includes a policy and rule based mechanism for determining platform trust in a trusted cloud. Additionally, it develops a fine-grained concept of trust in a cloud environment based on NFV. Finally, this thesis utilizes the remote attestation solution to develop a forensics system based on root cause analysis, which allows the investigation of attestation failures and their mitigation.
    [Show full text]
  • Arxiv:1905.08164V1 [Cs.CR] 20 May 2019
    simTPM: User-centric TPM for Mobile Devices (Technical Report) Dhiman Chakraborty Lucjan Hanzlik Sven Bugiel CISPA Helmholtz Center CISPA Helmholtz Center CISPA Helmholtz Center for Information Security, for Information Security, for Information Security Saarland University Stanford University Abstract as preventing software version rollback, protecting RSA keys, or attesting protected keys. Trusted Platform Modules are valuable building blocks for TPM is also of interest for the different stakeholders on security solutions and have also been recognized as benefi- mobile devices. However, the particular benefits that the cial for security on mobile platforms, like smartphones and TPM offers have historically hung on the TPM’s implemen- tablets. However, strict space, cost, and power constraints of tation as a dedicated security chip that can act as a ”local mobile devices prohibit an implementation as dedicated on- trusted third party” on devices. Mobile devices are, however, board chip and the incumbent implementations are software constrained in space, cost, and power consumption, which TPMs protected by Trusted Execution Environments. prohibits a classical deployment of TPM. To address the par- In this paper, we present simTPM, an alternative imple- ticular problems of the mobile domain, the Trusted Com- mentation of a mobile TPM based on the SIM card avail- puting Group (TCG) introduced the Mobile Trusted Mod- able in mobile platforms. We solve the technical challenge ule (MTM) specifications [64]. Although the MTM concept of implementing a TPM2.0 in the resource-constrained SIM has never left the prototype status, its ideas influenced the card environment and integrate our simTPM into the secure latest TPM2.0 specification [67].
    [Show full text]
  • The Trusted Execution Module: Commodity General-Purpose Trusted Computing
    The Trusted Execution Module: Commodity General-Purpose Trusted Computing Victor Costan, Luis F. G. Sarmenta, Marten van Dijk, and Srinivas Devadas MIT Computer Science and Artificial Intelligence Laboratory, Cambridge, USA [email protected], flfgs,marten,[email protected] Abstract. This paper introduces the Trusted Execution Module (TEM); a high-level specification for a commodity chip that can execute user- supplied procedures in a trusted environment. The TEM is capable of se- curely executing partially-encrypted procedures/closures expressing ar- bitrary computation. These closures can be generated by any (potentially untrusted) party who knows the TEM's public encryption key. Compared to a conventional smartcard, which is typically used by pre-programming a limited set of domain- or application- specific commands onto the smartcard, and compared to the Trusted Platform Module (TPM), which is limited to a fixed set of cryptographic functions that cannot be com- bined to provide general-purpose trusted computing, the TEM is sig- nificantly more flexible. Yet we present a working implementation us- ing existing inexpensive Javacard smartcards that does not require any export-restricted technology. The TEM's design enables a new style of programming, which in turn enables new applications. We show that the TEM's guarantees of secure execution enable exciting applications that include, but are not limited to, mobile agents, peer-to-peer multiplayer online games, and anonymous offline payments. 1 Introduction The Trusted Execution Module (TEM) is a Trusted Computing Base (TCB) de- signed for the low-resource environments of inexpensive commercially-available secure chips. The TEM can securely execute small computations expressed as partially-encrypted compiled closures.
    [Show full text]
  • The Trusted Execution Module: Commodity General-Purpose Trusted Computing
    The Trusted Execution Module: Commodity General-Purpose Trusted Computing Victor Costan, Luis F. G. Sarmenta, Marten van Dijk, and Srinivas Devadas MIT Computer Science and Artificial Intelligence Laboratory, Cambridge, USA [email protected], {lfgs,marten,devadas}@mit.edu Abstract. This paper introduces the Trusted Execution Module (TEM); a high-level specification for a commodity chip that can execute user- supplied procedures in a trusted environment. The TEM is capable of se- curely executing partially-encrypted procedures/closures expressing ar- bitrary computation. These closures can be generated by any (potentially untrusted) party who knows the TEM’s public encryption key. Compared to a conventional smartcard, which is typically used by pre-programming a limited set of domain- or application- specific commands onto the smartcard, and compared to the Trusted Platform Module (TPM), which is limited to a fixed set of cryptographic functions that cannot be com- bined to provide general-purpose trusted computing, the TEM is sig- nificantly more flexible. Yet we present a working implementation us- ing existing inexpensive Javacard smartcards that does not require any export-restricted technology. The TEM’s design enables a new style of programming, which in turn enables new applications. We show that the TEM’s guarantees of secure execution enable exciting applications that include, but are not limited to, mobile agents, peer-to-peer multiplayer online games, and anonymous offline payments. 1 Introduction The Trusted Execution Module (TEM) is a Trusted Computing Base (TCB) de- signed for the low-resource environments of inexpensive commercially-available secure chips. The TEM can securely execute small computations expressed as partially-encrypted compiled closures.
    [Show full text]
  • Trust and Trusted Computing Platforms
    Trust and Trusted Computing Platforms David A. Fisher Jonathan M. McCune Archie D. Andrews January 2011 TECHNICAL NOTE CMU/SEI-2011-TN-005 CERT Program Unlimited distribution subject to the copyright. http://www.sei.cmu.edu This report was prepared for the SEI Administrative Agent ESC/XPK 5 Eglin Street Hanscom AFB, MA 01731-2100 The ideas and findings in this report should not be construed as an official DoD position. It is published in the interest of scientific and technical information exchange. This work is sponsored by the U.S. Department of Defense. The Software Engineering Institute is a federally funded research and development center sponsored by the U.S. Department of Defense. Copyright 2011 Carnegie Mellon University. NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder. Internal use. Permission to reproduce this document and to prepare derivative works from this document for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works. External use. This document may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission.
    [Show full text]
  • HP Color Laserjet Enterprise MFP M578 Printer Series
    Datasheet | NA HP Color LaserJet Enterprise MFP M578 Printer series HP’s mid-level Enterprise-class color MFP with speeds up to 40 ppm6 and strongest security.2 Ideal for 5-15 people printing up to 10,000 pages per month who want premium color at fast speeds plus quick scanning and copying into workflows. Dynamic security enabled printer. Only 2 intended to be used with cartridges using an The world’s most secure printing HP original chip. Cartridges using a non-HP chip may not work, and those that work The operating code (BIOS) is automatically checked during startup and repairs itself if today may not work in the future. compromised. http://www.hp.com/go/learnaboutsupplies Common Criteria certified3 to continually monitor memory activity to detect and stop attacks in real time. Firmware is automatically checked during startup to determine if it’s authentic code— digitally signed by HP. The printer’s outgoing network connections are inspected to stop suspicious requests and thwart malware. Easy to use, simple to manage HP FutureSmart firmware can be updated with the latest features1 to optimize your HP Color LaserJet Enterprise MFP M578dn investment for years to come. Centralize control of your printing environment with HP Web Jetadmin—and help build business efficiency.5 Easily enable workflows across your fleet with a consistent user experience and intuitive, tablet-like icons. Expect consistent, high-quality results with technology that automatically adjusts print settings to paper type. Give workgroups the speed they need HP Color LaserJet Enterprise MFP M578f Help workgroups capture every page easily and detect potential errors or missed pages —every time.
    [Show full text]
  • (CS1) - Cyber Security
    Committee: (CS1) - Cyber Security National Designation Title (Click here to purchase standards) ISO/IEC Document CS1 :[] Information technology - Security techniques - Information security management IS TR 27015:2012 guidelines for financial services :[] Information technology - Security techniques -Information security for supplier IS 27036-1:2014 relationships - Part 1: Overview and concepts :[] Information technology - Security techniques - Refining software vulnerability IS TR 20004:2012 analysis under ISO/IEC 18045 INCITS/ISO/IEC 27010:2012:[2014] Information technology -- Security techniques - Information security management for IS 27010:2012 inter-sector and inter-organizational communications INCITS/ISO/IEC 30111:2013:[2014] Information technology -- Security techniques - Vulnerability handling processes IS 30111:2013 INCITS/ISO/IEC 20009-1:2013:[2014] Information technology -- Security techniques -- Anonymous entity authentication - IS 20009-1:2013 Part 1: General INCITS/ISO/IEC 29115:2013:[2014] Information technology -- Security techniques --Entity authentication assurance IS 29115:2013 framework INCITS/ISO/IEC 20008-2:2013:[2014] Information technology - Security techniques - Anonymous digital signatures - Part 2: IS 20008-2:2013 Mechanisms using a group public key :[] Information technology - Security techniques - Information security for supplier IS 27036-2:2014 relationships - Part 2: Requirements Created: 11/16/2014 Page 1 of 19 Committee: (CS1) - Cyber Security National Designation Title (Click here to purchase standards) ISO/IEC Document INCITS/ISO/IEC 20008-1:2013:[2014] Information technology - Security techniques - Anonymous digital signatures - Part 1: IS 20008-1:2013 General INCITS/ISO/IEC 27013:2012:[2014] Information technology - Security techniques - Guidance on the integrated IS 27013:2012 implementation of ISO/IEC 27001 and ISO.
    [Show full text]
  • Trusted Computing & Digital Rights Management – Theory & Effects
    School of Mathematics and Systems Engineering Reports from MSI - Rapporter från MSI Trusted Computing & Digital Rights Management – Theory & Effects Daniel Gustafsson Tomas Stewén Sep MSI Report 04086 2004 Växjö University ISSN 1650-2647 SE-351 95 VÄXJÖ ISRN VXU/MSI/DA/E/--04086/--SE Preface First we want to thank Pernilla Rönn, Lena Johansson and Jonas Stewén that made it possible for us to carry out this master thesis at AerotechTelub. A special thank to Lena Johansson, our supervisor at AerotechTelub, for her help with ideas and opinions. A special thank to Jonas Stewén, employee at AerotechTelub, for his help with material and his opinions on our work. We also want to thank Ola Flygt our supervisor and Mathias Hedenborg our examiner at Växjö University. Växjö, June 2004 Abstract Trusted Computing Platform Alliance (TCPA), now known as Trusted Computing Group (TCG), is a trusted computing initiative created by IBM, Microsoft, HP, Compaq, Intel and several other smaller companies. Their goal is to create a secure trusted platform with help of new hardware and software. TCG have developed a new chip, the Trusted Platform Module (TPM) that is the core of this initiative, which is attached to the motherboard. An analysis is made on the TCG’s specifications and a summary is written of the different parts and functionalities implemented by this group. Microsoft is in the development stage for an operating system that can make use of TCG’s TPM and other new hardware. This initiative of the operating system is called NGSCB (Next Generation Secure Computing Base) former known as Palladium.
    [Show full text]