DOCSLIB.ORG

Post-Snowden Cryptography

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Post-Snowden Crypto June 2016 Bart Preneel Post-Snowden Cryptography Bart Preneel COSIC KU Leuven and iMinds, Belgium Bart.Preneel(at)esat.kuleuven.be June 2016 1 2 NSA calls the iPhone users public 'zombies' who pay for their own surveillance 3 4 Outline NSA: • Snowden revelation and mass surveillance “Collect it all, • Going after crypto know it all, • The end of crypto exploit it all” • Security research www.wired.com 5 6 1 Post-Snowden Crypto June 2016 Bart Preneel Snowden revelations Snowden revelations (2) most capabilities could have been extrapolated from open Most spectacular: active defense sources • networks But still… – Quantum insertion: answer before the legitimate website massive scale and impact (pervasive) – inject malware in devices level of sophistication both organizational and technical • devices – redundancy: at least 3 methods to get to Google’s data – malware based on backdoors and 0-days (FoxAcid) – many other countries collaborated (beyond five eyes) – supply chain subversion – industry collaboration through bribery, security letters*, … Translation in human terms: complete control of networks and • including industrial espionage systems, including bridging the air gaps undermining cryptographic standards with backdoors No longer deniable (Bullrun) … and also the credibility of NIST Oversight weak * Impact of security letters reduced by Freedom Act (2 June 2015) 7 8 Rule #1 of cryptanalysis: search for plaintext [B. Morris] AliceEve/NSA Bob CRY Clear Clear CRY Clear Clear PTO PTO text text text text BOX BOX 9 10 Where do you find plaintext? SSO: Special Source Operations 1. PRISM (server) 2. Upstream (fiber) 11 12 2 Post-Snowden Crypto June 2016 Bart Preneel Muscular (GCHQ) 3. Traffic data (meta data) (DNR) help from not plaintext itself, but Level 3 • URLs of websites, MAC and IP addresses, location information,… (LITTLE) • it allows to map networks and reveals social relations 6 June 2013: NSA collecting phone records of millions of Verizon customers daily • Nov. 2015: USA Freedom act: “Final temporary reauthorization of the Section 215 bulk telephony metadata data program in the US expires” • Information stored at telcos – can be obtained via FISA court EU: data retention directive (2006/24/EC) – April 2014: direct is declared illegal by EU Court of Justice: Jan 9 2013: In the preceding 30 days, field collectors had processed and sent back disproportionate and contrary to some fundamental rights protected 181,280,466 new records — including “metadata,” which would indicate who sent or received e-mails and when, as well as content such as text, audio and video (from by the Charter of Fundamental Rights, in particular to the principle Yahoo! and Google) of privacy 13 DNR: Dial number recognition 14 4. Client systems: Quantum + TAO TEMPORA architecture (1) Gain “access” to raw content: intercept (cable, satellite), hack, buy, ask. • sophisticated malware based on 0-days (or Turbulence 3 days:125 Petabyte Tempora/Xks subversion of the update mechanism) (US$ 200M) • e.g. FOXACID – quantum insertion (2) “Selector” based Ring (3) Standard MetaMeta- Queries • hardware devices (air-gapped “promotion” Buffer Data machines) • radio interfaces and radar Selectors (4) “Map Reduce” activation Target Queries Selectors Promoted Traffic Promoted Enrichment • supply chain interception Signals Intelligence Traffic Promoted Queries Translation, Target Collation, Selectors Long Term Intel. Database Analysis, products TAO: Tailored Access Operations 15 Slide credit: George Danezis, UCL * Tempora ~ Deep Dive Xkeyscore (NSA) 16 Which questions can one answer with mass surveillance systems/bulk data collection? NSA is not alone Tempora (GCHQ) ~ Deep Dive Xkeyscore (NSA) • I have one phone number – find all the devices of this person, his surfing behavior, the location where he has travelled to and his closest collaborators • Find all Microsoft Excel sheets containing MAC addresses in Belgium • Find all exploitable machines in Panama • Find everyone in Austria who communicates in French and who use OTR or Signal BND has spied on EU (incl. German) companies and targets in exchange for access to these systems 17 18 3 Post-Snowden Crypto June 2016 Bart Preneel Mass Surveillance panopticon If data is the new oil, data mining yields the rocket fuel [Jeremy Bentham, 1791] industry discrimination fear conformism - stifles dissent oppression and abuse users government 19 20 Mass Surveillance Outline Economy of scale Pervasive surveillance requires pervasive collection • Snowden revelation and mass surveillance and active attacks • Going after crypto – implicates everyone - also innocent bystanders • The end of crypto – emphasis moving from COMSEC to COMPUSEC (from network security to systems security) • Security research – undermines integrity of and trust in computing infrastructure Human rights do not stop at your border 21 22 NSA foils much internet encryption If you can’t get the plaintext NYT 6 September 2013 The National Security Agency is winning its long- running secret war on encryption, using AliceEve/NSA Bob supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine CRY CRY %^C& %^C& Clear the major tools protecting the privacy of Clear PTO PTO @&^( @&^( text everyday communications in the Internet age text BOX BOX [Bullrun] Ask for the key! 23 24 4 Post-Snowden Crypto June 2016 Bart Preneel Find the Private Key (Somehow) Asking for the key • Logjam: TLS fallback to 512-bit export control legacy • (alleged) examples – through security letters? systems • Lavabit email encryption • 1024-bit RSA and Diffie-Hellman widely used default • CryptoSeal Privacy VPN option not strong enough • SSL/TLS servers of large companies? • GCHQ Flying Pig program • Silent Circle email? • Truecrypt?? [Adrian+] Imperfect Forward Secrecy: How Diffie- Source: SSL Pulse Hellman Fails in Practice, CCS 2015 25 26 If you can’t get the private key, If you can’t get the key substitute the public key 12M SSL/TLS servers make sure that the key is generated using a fake SSL certificates or SSL person-in-the-middle as random number generator with trapdoor commercial product or government attack – 650 CA certs trustable by common systems Pseudo- – Comodo, Diginotar, Turktrust, ANSSI, China Internet Network Information Center (CNNIC), Symantec random – Flame: rogue certificate by cryptanalysis seed number live since November 2015 generator https://letsencrypt.org/isrg/ (PRNG) [Holz+] TLS in the Wild, NDSS 2016 trapdoor allows to predict keys [Stevens] Counter-cryptanalysis, Crypto’13 27 28 Dual_EC_DRBG Dual_EC_DRBG Dual Elliptic Curve Deterministic Random Bit Generator • 10 Sept. 2013, NYT: "internal memos leaked by a former NSA • ANSI and ISO standard contractor suggest that [..] the Dual EC DRBG standard […] • 1 of the 4 PRNGs in NIST SP 800-90A contains a backdoor for the NSA." • draft Dec. 2005; published 2006; revised 2012 • 16 Sept. 2013: NIST “strongly recommends" against the use of Dual_EC_DRBG, as specified in SP 800-90A (2012) • Two “suspicious” parameters P and Q • Nov. 2013: RSA’s BSAFE library chooses DUAL_EC as default • Many warnings and critical comments • Dec. 2015: Juniper announces Dual_EC problems for Netscreen • before publication [Gjøsteen05], [Schoenmakers-Sidorenko06] • 08: 6.2.r01 uses Dual_EC in a way it can be exploited • after publication [Ferguson-Shumov07] • 12: someone changed the backdoor (6.2.r015) Appendix: The security of Dual_EC_DRBG requires that the [Checkoway+] On the Practical Exploitability of Dual EC in TLS points P and Q be properly generated. To avoid using Implementations, Usenix Security 2014 potentially weak points, the points specified in Appendix A.1 [Checkoway+] A Systematic Analysis of the Juniper Dual EC Incident, should be used. Cryptology ePrint Archive, Report 2016/376 29 30 5 Post-Snowden Crypto June 2016 Bart Preneel NSA can (sometimes) break Cryptovirology [Young-Yung] SSL/TLS, IPsec, SSH, PPTP, Skype http://www.cryptovirology.com/cryptovfiles/research.html • ask for private keys • implementation weaknesses • weak premaster secret (IPsec) • end 2011: decrypt 20,000 secure VPN connections/hour • http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html • http://blog.cryptographyengineering.com/2014/12/on-new-snowden-documents.html 31 32 Fighting cryptography Outline • Weak implementations • Going after keys • Undermining standards • Snowden revelation and mass surveillance • Cryptanalysis • Going after crypto • Increase complexity of standards • The end of crypto • Export controls • Security research • Hardware backdoors • Work with law enforcement to promote backdoor access and data retention We are going dark 33 34 Encryption to protect industry ~18.3B Not Encryption to protect user data ~12.5B end to (not meta data) Browser end log10 http:// https:// SSL 12 Transport System log10 HTTP over SSL 6.2B 6B 12 10 3B 2.4B 250M 6.3B 200M 200M 10 3.5B 1B 37M 700M 500M 500M 8 20- 8 50M? 12 M 6 6 ? ? 4 4 2 2 0 0 Mobile Browsers WhatsApp iMessage Skype Harddisk IPsec SSL/TLS © Bart Preneel 35 © Bart Preneel 36 6 Post-Snowden Crypto June 2016 Bart Preneel Deployment of cryptography Cryptography that seems to work • most crypto in volume and market serves for data and entity authentication • code updates • payments: credit/debit/ATM/POS and SSL/TLS • access cards • confidentiality • government/military secrets • DRM/content protection • telco: not end-to-end or with a backdoor • hard disk encryption: backdoored? • most data in
Recommended publications
  • Uila Supported Apps

    Uila Supported Apps

    Uila Supported Applications and Protocols updated Oct 2020 Application/Protocol Name Full Description 01net.com 01net website, a French high-tech news site. 050 plus is a Japanese embedded smartphone application dedicated to 050 plus audio-conferencing. 0zz0.com 0zz0 is an online solution to store, send and share files 10050.net China Railcom group web portal. This protocol plug-in classifies the http traffic to the host 10086.cn. It also 10086.cn classifies the ssl traffic to the Common Name 10086.cn. 104.com Web site dedicated to job research. 1111.com.tw Website dedicated to job research in Taiwan. 114la.com Chinese web portal operated by YLMF Computer Technology Co. Chinese cloud storing system of the 115 website. It is operated by YLMF 115.com Computer Technology Co. 118114.cn Chinese booking and reservation portal. 11st.co.kr Korean shopping website 11st. It is operated by SK Planet Co. 1337x.org Bittorrent tracker search engine 139mail 139mail is a chinese webmail powered by China Mobile. 15min.lt Lithuanian news portal Chinese web portal 163. It is operated by NetEase, a company which 163.com pioneered the development of Internet in China. 17173.com Website distributing Chinese games. 17u.com Chinese online travel booking website. 20 minutes is a free, daily newspaper available in France, Spain and 20minutes Switzerland. This plugin classifies websites. 24h.com.vn Vietnamese news portal 24ora.com Aruban news portal 24sata.hr Croatian news portal 24SevenOffice 24SevenOffice is a web-based Enterprise resource planning (ERP) systems. 24ur.com Slovenian news portal 2ch.net Japanese adult videos web site 2Shared 2shared is an online space for sharing and storage.
  • The Handshake - Establishing Secure Connections Over Insecure Channels

    The Handshake - Establishing Secure Connections Over Insecure Channels

    Lecture 13: The handshake - establishing secure connections over insecure channels Boaz Barak We’ve now compiled all the tools that are needed for the basic goal of cryptography (which is still being subverted quite often) allowing Alice and Bob to exchange messages assuring their integrity and confidentiality over a channel that is observed or controlled by an adversary. Our tools for achieving this goal are: • Public key (aka assymetric) encryption schemes. • Public key (aka assymetric) digital signatures schemes. • Private key (aka symmetric) encryption schemes - block ciphers and stream ciphers. • Private key (aka symmetric) message authentication codes and psedoran- dom functions. • Hash functions that are used both as ways to compress messages for authentication as well as key derivation and other tasks. The notions of security we require from these building blocks can vary as well. For encryption schemes we talk about CPA (chosen plaintext attack) and CCA (chosen ciphertext attacks), for hash functions we talk about collision-resistance, being used (combined with keys) as pseudorandom functions, and then sometimes we simply model those as random oracles. Also, all of those tools require access to a source of randomness, and here we use hash functions as well for entropy extraction. Cryptography’s obsession with adjectives. As we learn more and more cryptography we see more and more adjectives, every notion seems to have modifiers such as “non malleable”, “leakage-resilient”, “identity based”, “concurrently secure”, “adaptive”, “non-interactive”, etc.. etc. Indeed, this motivated a parody web page of an automatic crypto paper title generator. Unlike algorithms, where typically there are straightforward quantitative tradeoffs (e.g., faster is better), in cryptography there are many qualitative ways protocols can vary based on the assumptions they operate under and the notions of security they provide.
  • Wiretapping End-To-End Encrypted Voip Calls Real-World Attacks on ZRTP

    Wiretapping End-To-End Encrypted Voip Calls Real-World Attacks on ZRTP

    Institute of Operating Systems and Computer Networks Wiretapping End-to-End Encrypted VoIP Calls Real-World Attacks on ZRTP Dominik Schürmann, Fabian Kabus, Gregor Hildermeier, Lars Wolf, 2017-07-18 wiretapping difficulty End-to-End Encryption SIP + DTLS-SRTP (SIP + Datagram Transport Layer Security-SRTP) End-to-End Encryption & Authentication SIP + SRTP + ZRTP Introduction Man-in-the-Middle ZRTP Attacks Conclusion End-to-End Security for Voice Calls Institute of Operating Systems and Computer Networks No End-to-End Security PSTN (Public Switched Telephone Network) SIP + (S)RTP (Session Initiation Protocol + Secure Real-Time Transport Protocol) 2017-07-18 Dominik Schürmann Wiretapping End-to-End Encrypted VoIP Calls Page 2 of 13 wiretapping difficulty End-to-End Encryption & Authentication SIP + SRTP + ZRTP Introduction Man-in-the-Middle ZRTP Attacks Conclusion End-to-End Security for Voice Calls Institute of Operating Systems and Computer Networks No End-to-End Security PSTN (Public Switched Telephone Network) SIP + (S)RTP (Session Initiation Protocol + Secure Real-Time Transport Protocol) End-to-End Encryption SIP + DTLS-SRTP (SIP + Datagram Transport Layer Security-SRTP) 2017-07-18 Dominik Schürmann Wiretapping End-to-End Encrypted VoIP Calls Page 2 of 13 wiretapping difficulty Introduction Man-in-the-Middle ZRTP Attacks Conclusion End-to-End Security for Voice Calls Institute of Operating Systems and Computer Networks No End-to-End Security PSTN (Public Switched Telephone Network) SIP + (S)RTP (Session Initiation Protocol + Secure Real-Time
  • Bernhard Esslinger: Cryptool – Cryptography for the Masses

    Bernhard Esslinger: Cryptool – Cryptography for the Masses

    CrypTool Cryptography for the masses Prof. Bernhard Esslinger (presentation layout done with some help from Gonzalo; pictures by pixabay) Cryptography everywhere … In the digital era, we are all cryptography consumers, whether we know it or not. Whenever we use the mobile telephone, withdraw money from an ATM, go shopping to an e-commerce site using SSL, or use a messenger, we are using cryptographic services which protect the confidentiality, integrity, and authenticity of our data. The world as we know it wouldn’t exist without cryptography. Cryptography challenges education Around all of us perceived as difficult lack of understanding curricula teachers need useful tools Context of Cryptography CrypTool today: 5 products version 1.x http://www.cryptool.org/en/cryptool1 http://www.cryptool.org/en/ct2 https://github.com/jcryptool/ http://www.cryptool-online.org http://www.mysterytwisterc3.org/ CrypTool Portal: website today JCrypTool: User presentation https://github.com/jcryptool/core/wiki/jcryptool_us er_presentation/jcryptool_presentation_en.pdf CrypTool 2: Sample screen CrypTool: founded 1998 like … • Attac, Paris • Google, Menlo Park • CrypTool, Frankfurt CrypTool 1: Two warnings • legal • worrywarts besides the warnings: CT1 still made it Playful learning Serious tool CrypTool can be used to visualize many concepts of cryptology: including digital signatures, symmetric, asymmetric and hybrid encryption, protocols, cryptanalysis, etc. CrypTool 1 package Self-contained Documentation (online help, readme, CTB, presentation; programs later website) Stories CrypTool 1 Self-contained programs Flash animations The Dialogue of the Sisters The Chinese Labyrinth There are two stories included dealing with number theory and cryptography: • In "The Dialogue of the Sisters" the title-role sisters use a variant of the RSA algorithm, in order to communicate securely.
  • Advocating for Basic Constitutional Search Protections to Apply to Cell Phones from Eavesdropping and Tracking by Government and Corporate Entities

    Advocating for Basic Constitutional Search Protections to Apply to Cell Phones from Eavesdropping and Tracking by Government and Corporate Entities

    University of Central Florida STARS HIM 1990-2015 2013 Brave New World Reloaded: Advocating for Basic Constitutional Search Protections to Apply to Cell Phones from Eavesdropping and Tracking by Government and Corporate Entities Mark Berrios-Ayala University of Central Florida Part of the Legal Studies Commons Find similar works at: https://stars.library.ucf.edu/honorstheses1990-2015 University of Central Florida Libraries http://library.ucf.edu This Open Access is brought to you for free and open access by STARS. It has been accepted for inclusion in HIM 1990-2015 by an authorized administrator of STARS. For more information, please contact [email protected]. Recommended Citation Berrios-Ayala, Mark, "Brave New World Reloaded: Advocating for Basic Constitutional Search Protections to Apply to Cell Phones from Eavesdropping and Tracking by Government and Corporate Entities" (2013). HIM 1990-2015. 1519. https://stars.library.ucf.edu/honorstheses1990-2015/1519 BRAVE NEW WORLD RELOADED: ADVOCATING FOR BASIC CONSTITUTIONAL SEARCH PROTECTIONS TO APPLY TO CELL PHONES FROM EAVESDROPPING AND TRACKING BY THE GOVERNMENT AND CORPORATE ENTITIES by MARK KENNETH BERRIOS-AYALA A thesis submitted in partial fulfillment of the requirements for the Honors in the Major Program in Legal Studies in the College of Health and Public Affairs and in The Burnett Honors College at the University of Central Florida Orlando, Florida Fall Term 2013 Thesis Chair: Dr. Abby Milon ABSTRACT Imagine a world where someone’s personal information is constantly compromised, where federal government entities AKA Big Brother always knows what anyone is Googling, who an individual is texting, and their emoticons on Twitter.
  • Cryptology with Jcryptool V1.0

    Cryptology with Jcryptool V1.0

    www.cryptool.org Cryptology with JCrypTool (JCT) A Practical Introduction to Cryptography and Cryptanalysis Prof Bernhard Esslinger and the CrypTool team Nov 24th, 2020 JCrypTool 1.0 Cryptology with JCrypTool Agenda Introduction to the e-learning software JCrypTool 2 Applications within JCT – a selection 22 How to participate 87 JCrypTool 1.0 Page 2 / 92 Introduction to the software JCrypTool (JCT) Overview JCrypTool – A cryptographic e-learning platform Page 4 What is cryptology? Page 5 The Default Perspective of JCT Page 6 Typical usage of JCT in the Default Perspective Page 7 The Algorithm Perspective of JCT Page 9 The Crypto Explorer Page 10 Algorithms in the Crypto Explorer view Page 11 The Analysis tools Page 13 Visuals & Games Page 14 General operation instructions Page 15 User settings Page 20 Command line parameters Page 21 JCrypTool 1.0 Page 3 / 92 JCrypTool – A cryptographic e-learning platform The project Overview . JCrypTool – abbreviated as JCT – is a free e-learning software for classical and modern cryptology. JCT is platform independent, i.e. it is executable on Windows, MacOS and Linux. It has a modern pure-plugin architecture. JCT is developed within the open-source project CrypTool (www.cryptool.org). The CrypTool project aims to explain and visualize cryptography and cryptanalysis in an easy and understandable way while still being correct from a scientific point of view. The target audience of JCT are mainly: ‐ Pupils and students ‐ Teachers and lecturers/professors ‐ Employees in awareness campaigns ‐ People interested in cryptology. As JCT is open-source software, everyone is capable of implementing his own plugins.
  • The Nsa's Prism Program and the New Eu Privacy Regulation: Why U.S

    The Nsa's Prism Program and the New Eu Privacy Regulation: Why U.S

    American University Business Law Review Volume 3 | Issue 2 Article 5 2013 The SN A'S Prism Program And The ewN EU Privacy Regulation: Why U.S. Companies With A Presence In The EU ouldC Be In Trouble Juhi Tariq American University Washington College of Law Follow this and additional works at: http://digitalcommons.wcl.american.edu/aublr Part of the International Law Commons, and the Internet Law Commons Recommended Citation Tariq, Juhi "The SAN 'S Prism Program And The eN w EU Privacy Regulation: Why U.S. Companies With A Presence In The EU ouldC Be In Trouble," American University Business Law Review, Vol. 3, No. 2 (2018) . Available at: http://digitalcommons.wcl.american.edu/aublr/vol3/iss2/5 This Note is brought to you for free and open access by the Washington College of Law Journals & Law Reviews at Digital Commons @ American University Washington College of Law. It has been accepted for inclusion in American University Business Law Review by an authorized editor of Digital Commons @ American University Washington College of Law. For more information, please contact [email protected]. NOTE THE NSA'S PRISM PROGRAM AND THE NEW EU PRIVACY REGULATION: WHY U.S. COMPANIES WITH A PRESENCE IN THE EU COULD BE IN TROUBLE JUHI TARIQ* Recent revelations about a clandestine data surveillance program operated by the NSA, Planning Tool for Resource Integration, Synchronization, and Management ("PRISM'), and a stringent proposed European Union ("EU") data protection regulation, will place U.S. companies with a businesspresence in EU member states in a problematic juxtaposition. The EU Proposed General Data Protection Regulation stipulates that a company can be fined up to two percent of its global revenue for misuse of users' data and requires the consent of data subjects prior to access.
  • Malicious Cryptography: Kleptographic Aspects

    Malicious Cryptography: Kleptographic Aspects

    Malicious Cryptography: Kleptographic Aspects Adam Young1 and Moti Yung2 1 Cigital Labs [email protected] 2 Dept. of Computer Science, Columbia University [email protected] Abstract. In the last few years we have concentrated our research ef- forts on new threats to the computing infrastructure that are the result of combining malicious software (malware) technology with modern cryp- tography. At some point during our investigation we ended up asking ourselves the following question: what if the malware (i.e., Trojan horse) resides within a cryptographic system itself? This led us to realize that in certain scenarios of black box cryptography (namely, when the code is inaccessible to scrutiny as in the case of tamper proof cryptosystems or when no one cares enough to scrutinize the code) there are attacks that employ cryptography itself against cryptographic systems in such a way that the attack possesses unique properties (i.e., special advantages that attackers have such as granting the attacker exclusive access to crucial information where the exclusive access privelege holds even if the Trojan is reverse-engineered). We called the art of designing this set of attacks “kleptography.” In this paper we demonstrate the power of kleptography by illustrating a carefully designed attack against RSA key generation. Keywords: RSA, Rabin, public key cryptography, SETUP, kleptogra- phy, random oracle, security threats, attacks, malicious cryptography. 1 Introduction Robust backdoor attacks against cryptosystems have received the attention of the cryptographic research community, but to this day have not influenced in- dustry standards and as a result the industry is not as prepared for them as it could be.
  • Tamper-Evident Digital Signatures: Protecting Certification Authorities

    Tamper-Evident Digital Signatures: Protecting Certification Authorities

    Tamper-Evident Digital Signatures: Protecting Certification Authorities Against Malware Jong Youl Choi Philippe Golle Markus Jakobsson Dept. of Computer Science Palo Alto Research Center School of Informatics Indiana Univ. at Bloomington 3333 Coyote Hill Rd Indiana Univ. at Bloomington Bloomington, IN 47405 Palo Alto, CA 94304 Bloomington, IN 47408 Abstract The threat of covert channels (also called subliminal channels) was first studied by Simmons [18, 19] and later We introduce the notion of tamper-evidence for digi- by, among others, Young and Yung [23, 24]. These authors tal signature generation in order to defend against attacks show how an attacker may leak bits of the private signing aimed at covertly leaking secret information held by cor- key in covert channels present in the randomized key gen- rupted signing nodes. This is achieved by letting observers eration or signing algorithm. For the sake of concreteness, (which need not be trusted) verify the absence of covert let us consider the RSA-PSS signature scheme (known as channels by means of techniques we introduce herein. We RSA's Probabilistic Signature Scheme [7]) as an example. call our signature schemes tamper-evident since any de- The message encoding scheme of RSA-PSS specifies that viation from the protocol is immediately detectable. We the hash of the message to be signed be concatenated with demonstrate our technique for the RSA-PSS (known as a random octet string known as a “salt”. A malicious im- RSA’s Probabilistic Signature Scheme) and DSA signature plementation of RSA-PSS may choose bits of the private schemes and show how the same technique can be ap- key for the salt, instead of a value produced by the pseudo- plied to the Schnorr and Feige-Fiat-Shamir (FFS) signature random number generator.
  • Ashley Deeks*

    Ashley Deeks*

    ARTICLE An International Legal Framework for Surveillance ASHLEY DEEKS* Edward Snowden’s leaks laid bare the scope and breadth of the electronic surveillance that the U.S. National Security Agency and its foreign counterparts conduct. Suddenly, foreign surveillance is understood as personal and pervasive, capturing the communications not only of foreign leaders but also of private citizens. Yet to the chagrin of many state leaders, academics, and foreign citizens, international law has had little to say about foreign surveillance. Until recently, no court, treaty body, or government had suggested that international law, including basic privacy protections in human rights treaties, applied to purely foreign intelligence collection. This is now changing: Several UN bodies, judicial tribunals, U.S. corporations, and individuals subject to foreign surveillance are pressuring states to bring that surveillance under tighter legal control. This Article tackles three key, interrelated puzzles associated with this sudden transformation. First, it explores why international law has had so little to say about how, when, and where governments may spy on other states’ nationals. Second, it draws on international relations theory to argue that the development of new international norms regarding surveillance is both likely and essential. Third, it identifies six process-driven norms that states can and should adopt to ensure meaningful privacy restrictions on international surveillance without unduly harming their legitimate national security interests. These norms, which include limits on the use of collected data, periodic reviews of surveillance authorizations, and active oversight by neutral bodies, will increase the transparency, accountability, and legitimacy of foreign surveillance. This procedural approach challenges the limited emerging scholarship on surveillance, which urges states to apply existing — but vague and contested — substantive human rights norms to complicated, clandestine practices.
  • Mass Surveillance

    Mass Surveillance

    Mass Surveillance Mass Surveillance What are the risks for the citizens and the opportunities for the European Information Society? What are the possible mitigation strategies? Part 1 - Risks and opportunities raised by the current generation of network services and applications Study IP/G/STOA/FWC-2013-1/LOT 9/C5/SC1 January 2015 PE 527.409 STOA - Science and Technology Options Assessment The STOA project “Mass Surveillance Part 1 – Risks, Opportunities and Mitigation Strategies” was carried out by TECNALIA Research and Investigation in Spain. AUTHORS Arkaitz Gamino Garcia Concepción Cortes Velasco Eider Iturbe Zamalloa Erkuden Rios Velasco Iñaki Eguía Elejabarrieta Javier Herrera Lotero Jason Mansell (Linguistic Review) José Javier Larrañeta Ibañez Stefan Schuster (Editor) The authors acknowledge and would like to thank the following experts for their contributions to this report: Prof. Nigel Smart, University of Bristol; Matteo E. Bonfanti PhD, Research Fellow in International Law and Security, Scuola Superiore Sant’Anna Pisa; Prof. Fred Piper, University of London; Caspar Bowden, independent privacy researcher; Maria Pilar Torres Bruna, Head of Cybersecurity, Everis Aerospace, Defense and Security; Prof. Kenny Paterson, University of London; Agustín Martin and Luis Hernández Encinas, Tenured Scientists, Department of Information Processing and Cryptography (Cryptology and Information Security Group), CSIC; Alessandro Zanasi, Zanasi & Partners; Fernando Acero, Expert on Open Source Software; Luigi Coppolino,Università degli Studi di Napoli; Marcello Antonucci, EZNESS srl; Rachel Oldroyd, Managing Editor of The Bureau of Investigative Journalism; Peter Kruse, Founder of CSIS Security Group A/S; Ryan Gallagher, investigative Reporter of The Intercept; Capitán Alberto Redondo, Guardia Civil; Prof. Bart Preneel, KU Leuven; Raoul Chiesa, Security Brokers SCpA, CyberDefcon Ltd.; Prof.
  • Downloads (‘High-Volume, Low-Value Traffic’).43 Reports with Regard to UK and German Programmes Also Cite the Use of ‘Selectors’ (E.G

    Downloads (‘High-Volume, Low-Value Traffic’).43 Reports with Regard to UK and German Programmes Also Cite the Use of ‘Selectors’ (E.G

    DIRECTORATE GENERAL FOR INTERNAL POLICIES POLICY DEPARTMENT C: CITIZENS' RIGHTS AND CONSTITUTIONAL AFFAIRS CIVIL LIBERTIES, JUSTICE AND HOME AFFAIRS NATIONAL PROGRAMMES FOR MASS SURVEILLANCE OF PERSONAL DATA IN EU MEMBER STATES AND THEIR COMPATIBILITY WITH EU LAW STUDY Abstract In the wake of the disclosures surrounding PRISM and other US surveillance programmes, this study makes an assessment of the large-scale surveillance practices by a selection of EU member states: the UK, Sweden, France, Germany and the Netherlands. Given the large-scale nature of surveillance practices at stake, which represent a reconfiguration of traditional intelligence gathering, the study contends that an analysis of European surveillance programmes cannot be reduced to a question of balance between data protection versus national security, but has to be framed in terms of collective freedoms and democracy. It finds that four of the five EU member states selected for in-depth examination are engaging in some form of large-scale interception and surveillance of communication data, and identifies parallels and discrepancies between these programmes and the NSA-run operations. The study argues that these surveillance programmes do not stand outside the realm of EU intervention but can be engaged from an EU law perspective via (i) an understanding of national security in a democratic rule of law framework where fundamental human rights standards and judicial oversight constitute key standards; (ii) the risks presented to the internal security of the Union as a whole as well as the privacy of EU citizens as data owners, and (iii) the potential spillover into the activities and responsibilities of EU agencies.