I was asking the nearly 10 year old about secret inks, he confessed he once
read of them and peed on a brush, painted paper, and then developed it on
a lightbulb after drying.
I was amazed to learn this. It has lighted up my whole week.
Showing posts with label Crypto. Show all posts
Showing posts with label Crypto. Show all posts
13 September 2009
Crypto Dad
If you want to hide a whole "disk" work of space, use TrueCrypt
http://www.truecrypt.org/
You create a "volume" which is encrypted by a password. You open the volume
with the password, then it acts just like a regular E: drive (or whatever drive
letter you pick).
Winzip and WinRAR also have encryption options, and can package files together in compressed archives.
BTW, you must always compress before encrypting, because after encrypting, the data looks random and can't be compressed.
http://www.truecrypt.org/
You create a "volume" which is encrypted by a password. You open the volume
with the password, then it acts just like a regular E: drive (or whatever drive
letter you pick).
Winzip and WinRAR also have encryption options, and can package files together in compressed archives.
BTW, you must always compress before encrypting, because after encrypting, the data looks random and can't be compressed.
Crypto Dad: steganography for 10 year olds
This JPG contains a TXT file.
The tool is JPHSWin
The password is "password"
Save the fullsize image, open with JPHSWin, SEEK (and supply the not-so-secret password "password") then save the found file as f.txt.
The threat model is: someone sees an encrypted file, gets suspicious, forces you to reveal a password. In professional circles this is called the "rubber hose attack" but your parents would more likely simply deprive you of TV, car, etc.
The solution: hide one file inside another obvious boring file. Encrypt the hidden file before hiding it, too.
You could publish your picture and only those looking for hidden messages, and who have the secret key, will find them. Flickr, ebay, even 4chan :-)
Crypto Dad: Crypto for 10 year olds
Kids,
By now, you've learned that what you write can be important. For thousands of years people have kept diaries and wanted them to be private. You can still buy blank notebooks
with locks on them.
But those mechanical locks can be picked, or broken.
And you like to use computers to write. (Learn to type, BTW!) Can you control who reads your writing on a computer?
Sure you can. Controlling who reads your stuff is "confidentiality". Here's how we'll do it: You'll give a secret password "key" to a machine called a "cipher" which eats the key, your stuff, and produces a new file. That new file contains your stuff, but you can only read it if you know the key. Enciphering is also called encryption, which means "hiding".
The reverse process is simple: give the cipher the encrypted file and the key, you get your original stuff back.
If you deleted your original stuff, after making the encrypted one, then only someone with the key for that encrypted file can read it.
BTW, Your "stuff" is just a file. That file can mean music (eg mp3) or pictures (eg jpg) or fancy documents (eg doc) or plain text (eg txt) or anything.
BTW, the "cipher machine" is just a computer program.
Search for AxCrypt. Its a little Windows File Explorer plug-in that encrypts and decrypts files. http://www.axantum.com/AxCrypt/
If you share the "key" in person at the play ground you can control who reads
the file. That can be one person, or more, or just you. The "key" is just like a metal key to a door, they're all identical and anyone who has one can
Of course, someone could find the encrypted file and force you to reveal the password. In our next installment we learn about hiding the very fact that you've hidden a file!
(Steganography)
Other topics related to encryption:
authentication (knowing that a message came from your friend)
integrity (no one can change the message without getting caught)
non-repudiation (you can't back out of a signature!)
The "what I know, have, am" triad for identification --tying meatspace to information space. Governments love that stuff.
Anonymity
Traffic analysis
All stuff for the modern 10 year old!
Maybe we'll even dabble in RSA (publishable public keys, web certificates) and DHA (SSL).
By now, you've learned that what you write can be important. For thousands of years people have kept diaries and wanted them to be private. You can still buy blank notebooks
with locks on them.
But those mechanical locks can be picked, or broken.
And you like to use computers to write. (Learn to type, BTW!) Can you control who reads your writing on a computer?
Sure you can. Controlling who reads your stuff is "confidentiality". Here's how we'll do it: You'll give a secret password "key" to a machine called a "cipher" which eats the key, your stuff, and produces a new file. That new file contains your stuff, but you can only read it if you know the key. Enciphering is also called encryption, which means "hiding".
The reverse process is simple: give the cipher the encrypted file and the key, you get your original stuff back.
If you deleted your original stuff, after making the encrypted one, then only someone with the key for that encrypted file can read it.
BTW, Your "stuff" is just a file. That file can mean music (eg mp3) or pictures (eg jpg) or fancy documents (eg doc) or plain text (eg txt) or anything.
BTW, the "cipher machine" is just a computer program.
Search for AxCrypt. Its a little Windows File Explorer plug-in that encrypts and decrypts files. http://www.axantum.com/AxCrypt/
If you share the "key" in person at the play ground you can control who reads
the file. That can be one person, or more, or just you. The "key" is just like a metal key to a door, they're all identical and anyone who has one can
Of course, someone could find the encrypted file and force you to reveal the password. In our next installment we learn about hiding the very fact that you've hidden a file!
(Steganography)
Other topics related to encryption:
authentication (knowing that a message came from your friend)
integrity (no one can change the message without getting caught)
non-repudiation (you can't back out of a signature!)
The "what I know, have, am" triad for identification --tying meatspace to information space. Governments love that stuff.
Anonymity
Traffic analysis
All stuff for the modern 10 year old!
Maybe we'll even dabble in RSA (publishable public keys, web certificates) and DHA (SSL).
06 September 2009
Crypto Dad
Took the kid on a short neighborhood walk. Along the way, found a 4 disk bike or motorcycle lock hanging loose on a fence. So, I took it walking.
By the time we reached the road I had found its code, 6193, and opened it. Actually
I thought I first found 9193; then the kid found several adjacent codes that worked,
and then eventually only one code worked. I think we might have inadvertently reprogrammed the combination, though I didn't that that was possible in that kind of lock.
We eventually wrapped it around an ornamental post. The kid did this, then ran away. I pointed out his fingerprints were all over it; he said they weren't in the DB yet; I said
they would be eventually; but that he could say he picked it up and dropped it, then
a gloved vandal locked it round the post.
Cover your ass. Plausible deniability. Think like the adversary. Crypto, safety engineering, reliability, availability, etc.
PS: I once brute forced a 3-digit lock I found in an airport, while waiting.
Hilarious.
By the time we reached the road I had found its code, 6193, and opened it. Actually
I thought I first found 9193; then the kid found several adjacent codes that worked,
and then eventually only one code worked. I think we might have inadvertently reprogrammed the combination, though I didn't that that was possible in that kind of lock.
We eventually wrapped it around an ornamental post. The kid did this, then ran away. I pointed out his fingerprints were all over it; he said they weren't in the DB yet; I said
they would be eventually; but that he could say he picked it up and dropped it, then
a gloved vandal locked it round the post.
Cover your ass. Plausible deniability. Think like the adversary. Crypto, safety engineering, reliability, availability, etc.
PS: I once brute forced a 3-digit lock I found in an airport, while waiting.
Hilarious.
24 April 2009
Cryptography
I got into crypto when I realized that IP is sending postcards around, no privacy. So I got curious how block ciphers worked. DES looked complicated, so I studied Blowfish, and put up a paper sketching how it would work in hardware. This got me a job at I. implementing Blowfish and IDEA in Verilog to make a chip. Also studied zener based RNGs and conditioning algorithms (and measuring algorithms viz Marsaglia's Diehard and Maurer's metric). I did implement the algorithms but the chip was cancelled as it was nonstandard and AES was coming up.
Also spent a few days in a Faraday cage measuring noise (for RNG) properties on wafers. That was interesting, although the room was very stuffy.
Later at T. I worked for a few months on a contract to develop secure printing, so that the document would remain encrypted until you were at the printer entering your password. That way if the disk in the printer was taken the document would still be confidential too. Used in banks apparently. That involved Linux & Windows interoperating, using open-source algorithms. I just got a patent for it, something like 5 years later. My third.
When I. laid me off I spent a year helping a friend and former manager to create a startup. It would have used a crypto dongle to decode content that was floating in the cloud. I learned quite about about RSA and bignum implementations. And weird number theory voodoo. I once had Rivest as a TA, actually.
Around late 80's to early 90s I was into the cypherpunk mailing list and learned quite a bit about social and economic effects of crypto, e.g. with Tim May, Robert Hettinga. I've met Ryan Lackey and corresponded with one of the Seastead authors via a social channel. I met Ryan when the group was invited to the SF PD to check out their training simulator. I managed to catch the web of my hand in the pneumatically actuated fake gun, and it really bit. I also got blown away when a traffic stop guy pulled out a shotgun.
More recently I was using Atmel cryptomemory chips for authentication. And expiration, but that doesn't require crypto. It would have been easier to just use a PIC and implement my own protocol, and then lock the PIC down. In the end I used the fresh-off-the-fab cryptocompanion chip to perform some of the handshake, and it also stores the shared secret better, physically.
Mind you, this is with a Microchip PIC 16F processor talking to the cryptocompanion and the disposable cryptomemory. Some of the handshake work was being done by the electrically isolated ARM which talked to the PIC via isolated 2-wire RS485. That was because the PIC didn't have enough memory to compute a required function, so the ARM had to get involved. Crazy complex but it worked.
People often don't understand the difference between confidentiality, authentication, and integrity.
Even worse, because that is simple ignorance, is fools who bandy about "PKI" without a clue as to what it does or requires, or motivation for the choice. Just a buzzword.
Oh, and another peeve: you can't sue Verisign so what good is a cert from them? And since they're in bed with the government, and anyway individual folks can be bought, what's to stop them from issuing false (deceiptful, fraudulent) certs? Zero.
A reputation based system might be better, or an insured, bonded UL type better-business bureau that you can sue.
Also spent a few days in a Faraday cage measuring noise (for RNG) properties on wafers. That was interesting, although the room was very stuffy.
Later at T. I worked for a few months on a contract to develop secure printing, so that the document would remain encrypted until you were at the printer entering your password. That way if the disk in the printer was taken the document would still be confidential too. Used in banks apparently. That involved Linux & Windows interoperating, using open-source algorithms. I just got a patent for it, something like 5 years later. My third.
When I. laid me off I spent a year helping a friend and former manager to create a startup. It would have used a crypto dongle to decode content that was floating in the cloud. I learned quite about about RSA and bignum implementations. And weird number theory voodoo. I once had Rivest as a TA, actually.
Around late 80's to early 90s I was into the cypherpunk mailing list and learned quite a bit about social and economic effects of crypto, e.g. with Tim May, Robert Hettinga. I've met Ryan Lackey and corresponded with one of the Seastead authors via a social channel. I met Ryan when the group was invited to the SF PD to check out their training simulator. I managed to catch the web of my hand in the pneumatically actuated fake gun, and it really bit. I also got blown away when a traffic stop guy pulled out a shotgun.
More recently I was using Atmel cryptomemory chips for authentication. And expiration, but that doesn't require crypto. It would have been easier to just use a PIC and implement my own protocol, and then lock the PIC down. In the end I used the fresh-off-the-fab cryptocompanion chip to perform some of the handshake, and it also stores the shared secret better, physically.
Mind you, this is with a Microchip PIC 16F processor talking to the cryptocompanion and the disposable cryptomemory. Some of the handshake work was being done by the electrically isolated ARM which talked to the PIC via isolated 2-wire RS485. That was because the PIC didn't have enough memory to compute a required function, so the ARM had to get involved. Crazy complex but it worked.
People often don't understand the difference between confidentiality, authentication, and integrity.
Even worse, because that is simple ignorance, is fools who bandy about "PKI" without a clue as to what it does or requires, or motivation for the choice. Just a buzzword.
Oh, and another peeve: you can't sue Verisign so what good is a cert from them? And since they're in bed with the government, and anyway individual folks can be bought, what's to stop them from issuing false (deceiptful, fraudulent) certs? Zero.
A reputation based system might be better, or an insured, bonded UL type better-business bureau that you can sue.
Subscribe to:
Posts (Atom)