DOCSLIB.ORG

What Happened to the Crypto Dream?

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
What Happened to the Crypto Dream? ON THE HORIZON Editors: Alessandro Acquisti, [email protected] | Hugh Thompson, [email protected] hand, crypto-for-privacy often has What Happened to the social and political goals, and a mis- alignment of incentives frequently occurs. It’s crypto-for-privacy’s Crypto Dream?, Part 1 track record that’s of interest to us. The pioneers of modern crypto clearly recognized both types of Arvind Narayanan | Princeton University goals. In particular, they foresaw that as analog activities moved online, the ease of monitoring, logging, and searching everything meant that we could easily slip into a surveillance teven Levy’s fascinating 2001 in a way that would resist attack society. They saw crypto as a way to S book Crypto has the subtitle by governments, as long as the key thwart this danger and keep the same How the Code Rebels Beat the Gov- was secret. For the first time, some level of privacy we had in the analog ernment, Saving Privacy in the Digi- encryption algorithms came with world. I call this, for lack of a better tal Age.1 The “code rebels”—a loose clear mathematical evidence (albeit term, “Pragmatic Crypto”—cryp- coalition of academics, hobbyists, not proofs) of their strength. These tographic enhancements to various and civil-liberties organizations— developments came on the eve of digital systems that roughly maintain did indeed beat the government, the microcomputing revolution, and predigital privacy levels. I’ll return to causing the earlier restrictions on computers were gradually coming this in part 2 of this article. distribution of cryptographic tools to be seen as tools of empowerment In addition, there was a grander to be largely abandoned. However, and autonomy rather than instru- crypto dream. Its technical roots are this victory seems to have done ments of the state. These were the in the work of David Chaum in the miserably little to save privacy. In seeds of the “crypto dream.” early ’80s, culminating in his 1985 fact, you might look at the early paper “Security without Identifica- 2000s as the years when digital pri- Flavors of Crypto tion: Transaction Systems to Make vacy took a nosedive. Why did Levy To delve further, we must distin- Big Brother Obsolete.”2 Anony- and many other observers get it so guish different uses of cryptogra- mous digital cash, one of the key wrong back then? phy. The first distinction is between parts of Chaum’s proposal, by itself For over 2,000 years, evidence crypto-for-security and crypto-for- has political significance in that it seemed to support Edgar Allan Poe’s privacy. Even though they’re simi- offers an alternative to government- assertion, “human ingenuity can- lar at the technical level, they’re backed currencies. But Chaum went not concoct a cypher which human quite different at the social level. further. In his ideas of credentials ingenuity cannot resolve,” implying a The former is used in contexts and “blacklisting without lists,” we cat-and-mouse game with an advan- such as protecting financial trans- can see hints of pseudonymous rep- tage to the party with more skills and actions (for example, encrypting utation systems. Also, his technique resources. This changed abruptly in your credit card number when you for anonymity revocation contin- the 1970s owing to three separate buy stuff online). This means that, gent on double-spending of a coin developments: the symmetric cipher crucially, the incentives of all par- can be seen as an example of encod- DES (Data Encryption Standard), ties are aligned toward using crypto ing a social norm or rule (public the asymmetric cipher RSA, and to maintain security. And indeed, exposure of thieves) into crypto. Diffie-Hellman key exchange. For crypto-for-security has been the first time, it was conceivable that extremely successful, at least by the Cypherpunk someone with modest computing criterion that it has been a key to The cypherpunk activist move- resources could encrypt a message enabling e-commerce. On the other ment, which originated in the late 2 March/April 2013 Copublished by the IEEE Computer and Reliability Societies 1540-7993/13/$31.00 © 2013 IEEE ’80s, took Chaum’s ideas and ran anonymity technologies have an contributed to its success, although quite far with them in terms of rhet- important role to play in oppressive this impact shouldn’t be overstated. oric—in an explicitly subversive regimes. In particular, Tor (www. The organization itself derives its direction. For cypherpunks, crypto torproject.org) has found consider- protection primarily from Sweden’s was at the core of a vision of how able success as a censorship-circum- laws rather than anonymity tech- technology would cause sweeping vention tool. nologies. On the other hand, cryp- social and political change, weaken- Two more problems with tographic anonymity does seem to ing the power of governments and Cypherpunk Crypto seem worth be a factor in some whistleblowers’ established institutions. A closely pointing out. First, the more ambi- decisions to take that step. related term is crypto-anarchism, tious ideas such as Chaum’s pro- a political philosophy that, in its posal of commerce using “card idealized form, recognizes no laws computers” seem to require societal he lesson, I think, is reassur- except those that can be described buy-in. This requirement for a criti- T ing. Crypto and other tech- by math and enforced by code. cal mass of potential users unhappy nological tools have a role to play in Combined with ideas such as with the status quo makes the ide- keeping power in check, whether in information markets and predic- ology even more infeasible. In con- protecting those resisting authori- tion markets, even relatively simple trast, more modest tools such as tarian regimes or in bringing more crypto can be quite powerful. One email encryption are more incre- transparency to democratic ones. proposal was for markets that would mentally deployable. On the other hand, the evidence render legal intellectual-property Second, to impact the real world, doesn’t support an overly techno- restrictions meaningless. Another cryptosystems must come into logically determinist view in which was for pervasive untraceable (and contact with the real world; many crypto has its own logic that’s pow- hence unregulable) transactions. convenient abstractions and math- erful enough to reshape society The vision of crypto fundamentally ematical assumptions break down against the collective will. and inexorably reshaping social, at this boundary. For example, soft- economic, and political power ware security remains an unsolved Acknowledgments structures is what I call “Cypher- problem, which means digital cre- I’m extremely grateful to Joseph Bon- punk Crypto.” (Although I’ve dentials and cash can be stolen with neau, Ed Felten, and Vitaly Shmatikov described two extremes, a spectrum little recourse available to the vic - (in no particular order) for comments on exists between Cypherpunk Crypto tim. Also, anonymous digital mar- a draft, and to the audience at my talks at and Pragmatic Crypto.) kets for physical goods are useless if the Electronic Frontier Foundation and I don’t mean to suggest that this the goods aren’t actually shipped, so Princeton for useful feedback. Any errors, belief was mainstream in the crypto such systems still must contend with opinions, and omissions are my own. or tech communities—when law enforcement. cypherpunk cofounder Tim May References handed out copies of his Crypto- Rebirth? 1. S. Levy, Crypto: How the Code Reb- Anarchist Manifesto at the 1988 Some have claimed that Bit- els Beat the Government, Saving Crypto conference in Santa Bar- coin (http://bitcoin.org) and Privacy in the Digital Age, Penguin bara, the academics “pretty much WikiLeaks represent a rebirth of the Putnam, 2002. ignored him.”3 But the cypher- cypherpunk dream. I find this ques- 2. D. Chaum, “Security without Iden- punks were vocal enough and per- tionable. Although Bitcoin is a fine tification: Transaction Systems suasive enough that Wired, for technology with interesting niche to Make Big Brother Obsolete,” example, was a prominent early uses, it so far has had essentially Comm. ACM, vol. 28, no. 10, 1985, champion of the movement. no societal impact. The fact that its pp. 1030–1044. At least in retrospect, explaining more prominent uses such as Silk 3. A. Greenberg, This Machine Kills why the cypherpunk dream remains Road (an online black market) tar- Secrets: How WikiLeakers, Cypher- unrealized is like shooting fish in get fringe elements reinforces my punks, and Hacktivists Aim to Free a barrel. To put it simply, demo- point in the previous section. the World’s Information, Dutton cratic governments exist, to a first WikiLeaks is more complicated. Adult, 2012. approximation, with the consent Like Cryptome (www.cryptome. of the governed. So, the demand org), it has played a valuable role in Arvind Narayanan is an assistant for technologies that will upset that shining the light on abuses of power, professor of computer science at power balance is quite low. By the albeit a far cry from cypherpunk Princeton University. Contact him same token, however, crypto and rhetoric. And crypto has indeed at [email protected]. www.computer.org/security 3.
Load more

Recommended publications
  • State of the Art in Lightweight Symmetric Cryptography
    State of the Art in Lightweight Symmetric Cryptography Alex Biryukov1 and Léo Perrin2 1 SnT, CSC, University of Luxembourg, [email protected] 2 SnT, University of Luxembourg, [email protected] Abstract. Lightweight cryptography has been one of the “hot topics” in symmetric cryptography in the recent years. A huge number of lightweight algorithms have been published, standardized and/or used in commercial products. In this paper, we discuss the different implementation constraints that a “lightweight” algorithm is usually designed to satisfy. We also present an extensive survey of all lightweight symmetric primitives we are aware of. It covers designs from the academic community, from government agencies and proprietary algorithms which were reverse-engineered or leaked. Relevant national (nist...) and international (iso/iec...) standards are listed. We then discuss some trends we identified in the design of lightweight algorithms, namely the designers’ preference for arx-based and bitsliced-S-Box-based designs and simple key schedules. Finally, we argue that lightweight cryptography is too large a field and that it should be split into two related but distinct areas: ultra-lightweight and IoT cryptography. The former deals only with the smallest of devices for which a lower security level may be justified by the very harsh design constraints. The latter corresponds to low-power embedded processors for which the Aes and modern hash function are costly but which have to provide a high level security due to their greater connectivity. Keywords: Lightweight cryptography · Ultra-Lightweight · IoT · Internet of Things · SoK · Survey · Standards · Industry 1 Introduction The Internet of Things (IoT) is one of the foremost buzzwords in computer science and information technology at the time of writing.
    [Show full text]
  • Privacy-Enhancing Technologies for the Internet
    Privacy-enhancing technologies for the Internet Ian Goldberg David Wagner Eric Brewer University of California, Berkeley iang,daw,brewer ¡ @cs.berkeley.edu Abstract ing privacy issues on the Internet, and Section 3 provides some relevant background. We then discuss Internet pri- The increased use of the Internet for everyday activi- vacy technology chronologically, in three parts: Section 4 ties is bringing new threats to personal privacy. This pa- describes the technology of yesterday, Section 5 explains per gives an overview of existing and potential privacy- today’s technology, and Section 6 explores the technology enhancing technologies for the Internet, as well as moti- of tomorrow. Finally, we conclude in Section 7. vation and challenges for future work in this field. 2. Motivation 1. Introduction The threats to one’s privacy on the Internet are two-fold: your online actions could be (1) monitored by unauthorized Recently the Internet has seen tremendous growth, with parties and (2) logged and preserved for future access many the ranks of new users swelling at ever-increasing rates. years later. You might not realize that your personal infor- This expansion has catapulted it from the realm of academic mation has been monitored, logged, and subsequently dis- research towards new-found mainstream acceptance and in- closed; those who would compromise your privacy have no creased social relevance for the everyday individual. Yet incentive to warn you. this suddenly increased reliance on the Internet has the po- The threat of long-term storage and eventual disclosure tential to erode personal privacies we once took for granted. of personal information is especially acute on the Internet.
    [Show full text]
  • Blockchain and The
    NOTES ACKNOWLEDGMENTS INDEX Notes Introduction 1. The manifesto dates back to 1988. See Timothy May, “The Crypto Anarchist Manifesto” (1992), https:// www . activism . net / cypherpunk / crypto - anarchy . html. 2. Ibid. 3. Ibid. 4. Ibid. 5. Ibid. 6. Timothy May, “Crypto Anarchy and Virtual Communities” (1994), http:// groups . csail . mit . edu / mac / classes / 6 . 805 / articles / crypto / cypherpunks / may - virtual - comm . html. 7. Ibid. 8. For example, as we wi ll describe in more detail in Chapter 1, the Bitcoin blockchain is currently stored on over 6,000 computers in eighty- nine jurisdictions. See “Global Bitcoin Node Distribution,” Bitnodes, 21 . co, https:// bitnodes . 21 . co / . Another large blockchain- based network, Ethereum, has over 12,000 nodes, also scattered across the globe. See Ethernodes, https:// www . ethernodes . org / network / 1. 9. See note 8. 10. Some blockchains are not publicly accessible (for more on this, see Chapter 1). These blockchains are referred to as “private blockchains” and are not the focus of this book. 11. See Chapter 1. 12. The Eu ro pean Securities and Market Authority, “Discussion Paper: The Dis- tributed Ledger Technology Applied to Securities Markets,” ESMA / 2016 / 773, June 2, 2016: at 17, https:// www . esma . europa . eu / sites / default / files / library / 2016 - 773 _ dp _ dlt . pdf. 213 214 NOTES TO PAGES 5–13 13. The phenomena of order without law also has been described in other con- texts, most notably by Robert Ellickson in his seminal work Order without Law (Cambridge, MA: Harvard University Press, 1994). 14. Joel Reidenberg has used the term “lex informatica” to describe rules imple- mented by centralized operators online.
    [Show full text]
  • Pdf-Fulltext (142
    IRIE International Review of Information Ethics Vol. XY (MM/YYYY) Breilla Zanon: Transparency for institutions, privacy for individuals: the globalized citi- zen and power relations in a postmodern democracy Abstract: The aim of this article is to observe how technologies of communication, especially the Internet - allow extensive and intensive connections between several global territories and how they begin to influence the formation of demands and the organization and participation of individuals/citizens around local and global causes. For this, the below article uses Wikileaks and the cypherpunk philosophy to exemplify how information can be both used and abused in the common space of the internet, allowing new citizenship developments as well as government control strategies. Agenda: Introduction .................................................................................................................................. 56 An information paradox ................................................................................................................ 56 Wikileaks and the lesson of transparency ............................................................................................. 57 Free and controlled information: a philosophical reflection on the conduction of practices ....................... 58 Conclusion ..................................................................................................................................... 59 Author: Breilla Zanon: Federal University of Uberlândia, João Naves
    [Show full text]
  • The Mathematics of Bitcoin Cyril Grunspan, Ricardo Pérez-Marco
    The mathematics of Bitcoin Cyril Grunspan, Ricardo Pérez-Marco To cite this version: Cyril Grunspan, Ricardo Pérez-Marco. The mathematics of Bitcoin. European Mathematical Society Newsletter, 2020. hal-02486029 HAL Id: hal-02486029 https://hal.archives-ouvertes.fr/hal-02486029 Submitted on 20 Feb 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Newsletter of the EMS – Manuscript Page 1 The mathematics of Bitcoin Cyril Grunspan (De Vinci Research Center, Paris, France) Ricardo Pérez-Marco (CNRS, IMJ-PRG, Sorbonne Université, Paris, France) 1 Introduction to Bitcoin. Bitcoin is a new decentralized payment network that started operating in January 2009. This new technology was created by a pseudonymous author, or group of authors, called Satoshi Nakamoto in an article that was publically released [1] in the cypherpunk mailing list. The cypherpunks are anarchists and cryptographers that who have been concerned with personal privacy in the Internet since the 90’s. This article follows on a general presentation of Bitcoin by the second author [2]. We refer to this previous article for general background. Here we focuss on mathematics being a feature of the security and effectiveness of Bitcoin protocol.
    [Show full text]
  • Bitcoin Yongdae Kim
    EE817/IS893 Blockchain and Cryptocurrency Bitcoin Yongdae Kim 1 Cypherpunk v 1970년대 암호는 군과 스파이 기관의 전유물 v 1980년 경부터 큰 변화 – Data Encryption Standard (DES) by NIST – “New DirectionS in Cryptography” by Diffie-Hellman – David Chaum: ecaSh, pSeudonym, reputation, … v 1992년: Gilmore 등이 작은 그룹을 만듬 – Cypherpunk: cipher + cyberpunk, Cypherpunk mailing liSt v A Cypherpunk’S ManifeSto "Privacy iS neceSSary for an open Society in the electronic age. Privacy iS not Secrecy. A private matter iS Something one doeSn't want the whole world to know, but a Secret matter iS something one doesn't want anybody to know. Privacy is the power to selectively reveal oneSelf to the world.” – “Privacy”는 잘못된 것을 숨기는게 아님! 커텐은 집안에 나쁜게 있어서? 주목할 만한 Cypherpunk들 v Jacob Appelbaum: Tor v Paul Kocher: SSL 3.0 v Julian Assange: WikiLeaks v Moxie Marlinspike: Signal v Adam Back: Hashcash v Zooko Wilcox-O'Hearn: v Bram Cohen: BitTorrent DigiCash, Zcash v Hal Finney: PGP 2.0, v Philip Zimmermann: PGP 1.0 Reusable PoW v Matt Blaze: Clipper chip, v Tim Hudson: SSLeay, the crypto export control precursor to OpenSSL 3 Cypherpunk와 블록체인 v David Chaum (1980s) – "Security without Identification: Transaction Systems to Make Big Brother Obsolete” – Anonymous Digital Cash, Pseudonymous Reputation System v Adam Back (1997) – Hash cash: Anti-spam mechanism requiring cost to send email v Wei Dai (1998) – B-money: Enforcing contractual agreement between two anons – 1. Every participant maintain separate DB: Bitcoin – 2. deposit some money as potential fines or rewards: PoS v Hal Finney (2004) – Reusable PoW: Double spending detection was centralized v Nick Szabo (2005) – “Bit Gold”: Values based on amount of computational work – Concept of “Smart Contract” 4 What is Bitcoin? v Satoshi Nakamoto, who published the invention in 2008 and released it as open-source software in 2009.
    [Show full text]
  • A Broad Evaluation of the Tor English Content Ecosystem
    A Broad Evaluation of the Tor English Content Ecosystem Mahdieh Zabihimayvan Reza Sadeghi Department of Computer Science and Engineering Department of Computer Science and Engineering Kno.e.sis Research Center, Wright State University Kno.e.sis Research Center, Wright State University Dayton, OH, USA Dayton, OH, USA [email protected] [email protected] Derek Doran Mehdi Allahyari Department of Computer Science and Engineering Department of Computer Science Kno.e.sis Research Center, Wright State University Georgia Southern University Dayton, OH, USA Statesboro, GA, USA [email protected] [email protected] ABSTRACT It is an open question whether the fundamental and oen nec- Tor is among most well-known dark net in the world. It has noble essary protections that Tor provides its users is worth its cost: the uses, including as a platform for free speech and information dis- same features that protect the privacy of virtuous users also make semination under the guise of true anonymity, but may be culturally Tor an eective means to carry out illegal activities and to evade law beer known as a conduit for criminal activity and as a platform enforcement. Various positions on this question have been docu- to market illicit goods and data. Past studies on the content of mented [16, 22, 30], but empirical evidence is limited to studies that Tor support this notion, but were carried out by targeting popular have crawled, extracted, and analyzed specic subsets of Tor based domains likely to contain illicit content. A survey of past studies on the type of hosted information, such as drug tracking [12], may thus not yield a complete evaluation of the content and use of homemade explosives [20], terrorist activities [7], or forums [39].
    [Show full text]
  • Crypto Anarchy, Cyberstates, and Pirate Utopias Edited by Peter Ludlow
    Ludlow cover 7/7/01 2:08 PM Page 1 Crypto Anarchy, Cyberstates, and Pirate Utopias Crypto Anarchy, Crypto Anarchy, Cyberstates, and Pirate Utopias edited by Peter Ludlow In Crypto Anarchy, Cyberstates, and Pirate Utopias, Peter Ludlow extends the approach he used so successfully in High Noon on the Electronic Frontier, offering a collection of writings that reflect the eclectic nature of the online world, as well as its tremendous energy and creativity. This time the subject is the emergence of governance structures within online communities and the visions of political sovereignty shaping some of those communities. Ludlow views virtual communities as laboratories for conducting experiments in the Peter Ludlow construction of new societies and governance structures. While many online experiments will fail, Ludlow argues that given the synergy of the online world, new and superior governance structures may emerge. Indeed, utopian visions are not out of place, provided that we understand the new utopias to edited by be fleeting localized “islands in the Net” and not permanent institutions. The book is organized in five sections. The first section considers the sovereignty of the Internet. The second section asks how widespread access to resources such as Pretty Good Privacy and anonymous remailers allows the possibility of “Crypto Anarchy”—essentially carving out space for activities that lie outside the purview of nation-states and other traditional powers. The Crypto Anarchy, Cyberstates, third section shows how the growth of e-commerce is raising questions of legal jurisdiction and taxation for which the geographic boundaries of nation- states are obsolete. The fourth section looks at specific experimental governance and Pirate Utopias structures evolved by online communities.
    [Show full text]
  • Weaving the Dark Web: Legitimacy on Freenet, Tor, and I2P (Information
    The Information Society Series Laura DeNardis and Michael Zimmer, Series Editors Interfaces on Trial 2.0, Jonathan Band and Masanobu Katoh Opening Standards: The Global Politics of Interoperability, Laura DeNardis, editor The Reputation Society: How Online Opinions Are Reshaping the Offline World, Hassan Masum and Mark Tovey, editors The Digital Rights Movement: The Role of Technology in Subverting Digital Copyright, Hector Postigo Technologies of Choice? ICTs, Development, and the Capabilities Approach, Dorothea Kleine Pirate Politics: The New Information Policy Contests, Patrick Burkart After Access: The Mobile Internet and Inclusion in the Developing World, Jonathan Donner The World Made Meme: Public Conversations and Participatory Media, Ryan Milner The End of Ownership: Personal Property in the Digital Economy, Aaron Perzanowski and Jason Schultz Digital Countercultures and the Struggle for Community, Jessica Lingel Protecting Children Online? Cyberbullying Policies of Social Media Companies, Tijana Milosevic Authors, Users, and Pirates: Copyright Law and Subjectivity, James Meese Weaving the Dark Web: Legitimacy on Freenet, Tor, and I2P, Robert W. Gehl Weaving the Dark Web Legitimacy on Freenet, Tor, and I2P Robert W. Gehl The MIT Press Cambridge, Massachusetts London, England © 2018 Robert W. Gehl All rights reserved. No part of this book may be reproduced in any form by any electronic or mechanical means (including photocopying, recording, or information storage and retrieval) without permission in writing from the publisher. This book was set in ITC Stone Serif Std by Toppan Best-set Premedia Limited. Printed and bound in the United States of America. Library of Congress Cataloging-in-Publication Data is available. ISBN: 978-0-262-03826-3 eISBN 9780262347570 ePub Version 1.0 I wrote parts of this while looking around for my father, who died while I wrote this book.
    [Show full text]
  • Cypherpunks, Crypto-Anarchy, and the Future of Privacy
    Cypherpunks, Crypto-Anarchism, and the Future of Privacy: A Primer 1 Introduction Technology is a value-laden discipline integrated with other aspects of social and political life. Technological developments contribute to sustaining certain views of the world, open up new paths for growth, and envision new ways of establishing relations with our surroundings. It is fundamental to acknowledge the political and social character of technology and gain an awareness of the political and social role that technologies such as distributed ledger technology are going to play. For that, it is necessary to reflect both on the political ideas that have triggered the birth of distributed ledger technology (DLT), and also how its design aligns with them. The Ideological Foundations of Bitcoin, DLT, and the Open Web Distributed ledger technology emerged in the manifestation of Bitcoin, from the joint effort of cypherpunks and crypto-anarchists. These people envisioned a different future for society, a future free of the violence perpetrated by the State’s coercive methods. The open-source design crypto-economic protocols reflects these ideals: As adoption and interest increases, the underlying ideals for such ecosystems are positioned to emerge further. Unfortunately, there are many misconceptions surrounding the cypherpunk movement as well as crypto-anarchists. In this paper, we explore the political and philosophical ideas that have nurtured the cypherpunks and crypto-anarchists in order to dispel the misconceptions surrounding them. This endeavour will not only enable us to better understand DLT technology, but also to show how - through Bitcoin and the Open Web - what was once a cypherpunk ideal has found its way into reality.
    [Show full text]
  • Unlocking Encryption: Information Security and the Rule of Law
    Unlocking Encryption: Information Security and the Rule of Law BY DANIEL CASTRO AND ALAN MCQUINN | MARCH 2016 Advancements in the field of information security, particularly in how to Advances in use encryption to protect the confidentiality of information, have vastly information security could lead to tradeoffs improved security for consumers and businesses. But as products and in the effectiveness of services have become more secure, it has become harder for law law enforcement, but enforcement and national security agencies to access some information limiting encryption will that could help them prevent and investigate crimes and terrorism.1 This certainly make the has created one of the most difficult policy dilemmas of the digital age, as average consumer and business less secure. encryption both improves security for consumers and businesses and makes it harder for governments to protect them from other threats. There is no way to square this circle, so any choice will come with tradeoffs. However, ITIF believes that the U.S. government should not restrict or weaken encryption, because any attempts to do so would reduce the overall security of law-abiding citizens and businesses, make it more difficult for U.S. companies to compete in global markets, and limit advancements in information security. Moreover, attempts to restrict or weaken encryption would be ineffective at keeping this technology out of the hands of many criminals and terrorists. Cybersecurity is often portrayed as a never-ending arms race pitting those who wish to secure their computers and networks against attackers intent on breaking into their INFORMATION TECHNOLOGY & INNOVATION FOUNDATION | MARCH 2016 PAGE 1 systems.
    [Show full text]
  • A Tale of the Openssl State Machine: a Large-Scale Black-Box Analysis
    A Tale of the OpenSSL State Machine: a Large-scale Black-box Analysis Joeri de Ruiter Institute for Computing and Information Sciences Radboud University Nijmegen, The Netherlands [email protected] Abstract. State machine inference is a powerful black-box analysis tech- nique that can be used to learn a state machine implemented in a sys- tem, i.e. by only exchanging valid messages with the implementation a state machine can be extracted. In this paper we perform a large scale analysis of the state machines as implemented over the last 14 years in OpenSSL, one of the most widely used implementations of TLS, and in LibreSSL, a fork of OpenSSL. By automating the learning process, the state machines were learned for 145 different versions of both the server- side and the client-side. For the server-side this resulted in 15 unique state machines for OpenSSL and 2 for LibreSSL. For the client-side, 9 unique state machines were learned for OpenSSL and one for LibreSSL. Analysing these state machines provides an interesting insight in the evolution of the state machine of OpenSSL. Security vulnerabilities and other bugs related to their implementation can be observed, together with the point at which these are fixed. We argue that these problems could have been detected and fixed earlier if the developers would have had the tools available to analyse the implemented state machines. 1 Introduction TLS (Transport Layer Security) is one of the most widely used security proto- cols and is used to secure network communications, for example, when browsing the Internet using HTTPS or using email with SMTPS or IMAPS.
    [Show full text]