- Prime Factorization
- Prime numbers are important in encryption
- Prime numbers: only have factors of themselves and 1: (e.g., 2, 3, 5, 7, 11, 13...)
- List of primes from 1 to 1000
- Only one even prime: 2
- Only one prime that ends in 5
- Prime factors: any non prime (aka "composite number") may be factored into the prime numbers that, when multiplied, yield that number
- Examples: 22 = 11 x 2; 33 = 3 x 3 x 37
- FYI: I'm a prime number nut. Recall I once thought about outfitting the lacrosse team I ran in grad school only in prime numbers :-). Only two primes below.
- Public and Private Keys (assymmetrical encryption)
- Explains public and private keys, both are mathematically related (usually via prime factorization)
- The public key encrypts the data and anyone can use the public key
- The private key decrypts the data and only the recipient has (or should have) the private key
- Explains public and private keys, both are mathematically related (usually via prime factorization)
- Understanding Public Key and Private Key Concepts
- Uses metaphor of padlock and key. Public key is the padlock and private key is the key that opens it
- You can have as many padlocks as you like
- You can make private key more secure by using a password on top of the private key
- In that case the analogy continues, the private key is "locked" in a combination strongbox
- Primes, Public, and Private Keys (video)
- Explains how prime factors work with public and private keys
- Two large primes, P1 and P2and multiply them and get C (a composite)
- But, going backward, trying to get P1 and P2 from C would take over 1000 years if P1 and P2 were large enough.
- C is the public key
- P1 and P2 are the private key
- Explains how prime factors work with public and private keys
- How encryption works
- http://www.howstuffworks.com/encryption.htm
- Eight pages explain the basics of encryption
- Removable storage is a form of computer security
- In other words a removable hard drive of flash drive
- Scytale (movie) shows how to make one
- Symmetric-key encryption
- Sender and receiver hold the same key
- Public key or asymmetric-key
- Public key is known
- Private key should only be known by receiver
- Secure sockets
- https vs http
- SSL, TLS
- Video on secure sockets
- Uses certificates
- Encodes traffic from website
- https vs http
- Hash values
- Numbers created by a hashing algorithm
- The prime example above is a type of hashing algorithm
- Large numbers are use so that finding the original number is basically impossible in real time
- Definition of hash algorithm
- Authentication
- Answers question: "Is this really you?"
- Passwords
- Password strength meter
- Try a few passwords to see how strong they are. Mixing cases, using number and symbols, and longer length all lead to stronger passwords. Tool tells you the strength of your password and how long it would take to crack
- I typed "GeorgeWashington" and "GeorgeandMarth@" both would be cracked easily
- Password strength meter
- Pass cards
- Credit and debit cards are most common example
- Notice that possession of the card is the main thing
- Very few locations will ask you to prove you own the card
- Digital Signatures
- Another public/private key system
- Video
- Biometrics authentication uses unique physical characteristics such a faces, fingerprints, or retinas to authenticate
- Oops...Hollywood's solution to retinal scan, Demolition Man (video)
- Violence, gross, fyi
- Oops...Hollywood's solution to retinal scan, Demolition Man (video)
- Passwords
- Answers question: "Is this really you?"
- Checksum and Cyclic Redundancy Check (CRC)
- Both check that message has not been corrupted in transit
- Video
- Removable storage is a form of computer security
- Eight pages explain the basics of encryption
- http://www.howstuffworks.com/encryption.htm
- Encryting your e-mail
- https://www.lifewire.com/you-should-encrypt-your-email-2486679
- Argues that you should encrypt your e-mail
- Done with commercial products using public/private key encryption
- Most users do not encrypt their e-mail
- FYI: your SAU e-mail is NOT encrypted
- P = NP?
- P vs NP problems (video)
- P stands for polynomial time
- P problems can be solved given reasonable amounts of time (minutes to years)
- NP stands for nondeterministic polynomial time
- NP problems are difficult or impossible to solve
- They also depend on trial and error
- Are there algorithms that will convert NP problems to P problems?
- Not yet, and there's $1,000,000 waiting for anyone who can develop such algorithms
- P vs NP problems (video)
- Quantum Computing and Encryption
- What is a quantum computer? (video)
- Uses qubits (not bits) to solve complex problems using quantum properties of superposition and quantum entanglement
- Bottom line is they are incredibly faster than the fastest supercomputers
- Quantum computers
- Qubits use physical properties such as spin of an electron or the orientation of a photon
- Quantum computers can test problems with many combinations simultaneously (such as the prime factors for any given non-prime number
- That speed could doom NP encryption techniques (see below)
- What is a quantum computer? (video)
- Is encryption doomed?
- Article speculates about whether the NP problem will be solved soon. NP stands for "nondeterministic polynomial" and NP problems are difficult (or impossible) to solve. Code breaking is an NP problem.
- NP problems (non-deterministic polynomial time)
- Analogy with college dormitory: Shows how NP problem cannot be solved
- The traveling salesperson problem for 20 cities is an NP problem that has 2.43x1018 paths
- The algorithm is simple enough, measure all the paths and choose the shortest one, but...
- There is not enough time to find the shortest path
| Bad Solution | Better Solution, but it may not be the shortest path |
|---|---|
 |
 |
- Cryptography FAQ
- Part of a $199 book, the FAQ (frequently asked questions) page gives answers for:
- DES
- Key Parity
- Key Tagging
- Control Vectors
- Proving That Algorithms Are Secure
- Sharing Secret Keys
- How to Store Passwords .
- History of Cryptography
- Gives short history of cryptography
- Includes:
- Ancient Egypt, Julius Caesar, Vigenere's encryption key, the Enigma Machine, DES, and AES
- Includes:
- Gives short history of cryptography
- Five Comnmon Encryption Algorithms and the Unbreakables of the Future
- Page summarizes common encryption algorithms:
- Triple DES
- Replaced DES (which was easily hacked)
- Used three 56 bit keys
- RSA
- Asymmetric algorithm (public key/private key, see above)
- Hard to break (takes a lot of time)
- Blowfish
- Also replaced DES
- Free
- Twofish
- Blowfish's successor
- Symmetric (only one key needed)
- Free
- AES (Advanced Encryption Standard)
- Has 128, 192, and 256 variants
- Impossible to break except via brute force methods
- Includes brief description of the future of encryption
- Triple DES
- Page summarizes common encryption algorithms:
- Quantum Cryptography (video)
- Explains quantum cryptography using photons
- A photon has four spins but filters can change the spin
- The Heisenberg uncertainty principle applies here because if you try to "read" the spin using your own filter you will alter the spin.
- That physical property allows sender and receiver to know whether someone else has tried to read the message and decipher the filters used
- Explains quantum cryptography using photons
- Controversies
- Access by governmental agencies
- Metadata
(video)
- Data about data
- Examples: location, length of phone call, number called, URL accessing Google, etc.
- Typically, metadata are NOT private
- "Chatter" is an interesting type of metadata
- Chatter is an increase or decrease in signals within a group monitored by signals intelligence
- 9/11 was preceded by an increase in communication between the terrorists
- Chatter is an increase or decrease in signals within a group monitored by signals intelligence
- Businesses take advantage of metadata to focus their advertising and personalize shopping experience (see eCommerce page)
- Data about data
- Backdoors
- Definition: "A backdoor in software or a computer system is generally an undocumented portal that allows an administrator to enter the system to troubleshoot or do upkeep. But it also refers to a secret portal that hackers and intelligence agencies use to gain illicit access." (Wired)
- In other words, it is a built in method to defeat encryption
- Chris Wray, the FBI Director, recently (March 2021) testified before Congress and said about backdoors:
- We are not asking for, and do not want, any “backdoor,” that is, for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else.
- Chris Wray, the FBI Director, recently (March 2021) testified before Congress and said about backdoors:
- end-to-end encryption (E2EE)
- Metadata
(video)
- Ransomware
- Ransomware are "type of malware from cryptovirology that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid."
- CISA on Ransomware
- "Ransomware is a type of malicious software, or malware, designed to deny access to a computer system or data until a ransom is paid. Ransomware typically spreads through phishing emails or by unknowingly visiting an infected website."
- Phishing Beware of the following characteristics of phishing:
- phishing is the fraudulent attempt to obtain user names, passwords, or other information in order to access a computer
- phishing attempts often come in e-mails, texts, or social networking sites
- Offers to good to be true
- Offers with very limited time windows
- Offers with hyperlinks
- Offers with attachments
- Offers from unusual senders
- Ransomware Explained
- A type of computer malware where a user's files on own computer or server are encrypted
- The encrypter then offers to decrypt those files for a payment
- Ransomware Up in 2021
- Attacks grew by 150% in 2021
- Average ransom demand was $170,000
- Access to hosts
- 52% used Remote Desk Protocol
- Remote Desk Protocol is Microsoft software designed to allow users to interact with a host server
- 29% used phishing
- 17% used public-facing applications
- public-facing applications are access points to networks available to the public and to internal users
- Off-the-shelf ransomware apps are available
- 52% used Remote Desk Protocol
- Colleges and Universities have become a target of ransomware
- The University of Memphis recently reported two attacks in 6 months
- Remote learning has increased attacks on university computer systems
- Average ransomware demand was $447,000
- Student accounts and security more lax than in business makes attacks easier
- phishing attacks exploit e-mail systems with weaker security
- Solutions include:
- multifactor authentication: password + another method of identification
- longer passwords
- monitoring authentication anomalies: very fast computer-generated logon attempts
- screening passwords against lists of commonly used compromised credentials
- SAU and Ransomware
- Recall SAU had a week long incident in the spring 2021 semester where parts of its system were compromised via a ransomware attack
- SAU president Trey Berry, in a public e-mail on February 17, 2021 to the campus community wrote (in part):
We received an update regarding the recent ransomware attack, and want to make you aware of this new information, our ongoing response, and investigation.
While not yet complete, our investigation has revealed that the hacker obtained a small amount of data from our network and published that information to the dark web.
We have analyzed the contents of these files and it appears the information is limited to the names, addresses, phone numbers and email addresses for a limited number of students, faculty, staff and alumni--most of which is already publicly available or in our online directories. Other documents were limited to administrative information, such as standard forms and templates and publicly available reports. At this time, the investigation has found no evidence that any sensitive or financial information was impacted as a result of this incident. Law enforcement has been notified and SAU will fully cooperate with any investigation into this incident.
- Access by governmental agencies
- SolarWinds Hack
- Very large attack on government and private computers
- First reported in December 2020
- Russian hackers suspected
- Affected many United States government systems and those of private companies
- 80% of affected users were nongovernment organizations
- Method
- Hackers added bit of malware code to SolarWind's Orion software
- When users updated their own systems the code entered those and created a backdoor
- The attack went unnoticed for months
- The consequences of the attack are still unfolding
- CyberWar or CyberTerrorism?
- Current issue because of Ukraine and Russia war
- When does cyberespionage become cyberwar?
- Sabotage of essential services: water, gas, electricity
- Propaganda used to change adversary's policies or leaders
- Remote attacks by drones or similar vehicles
- Privacy Issues
- Summarizes privacy issues facing people today including:
- biometrics: fingerprints, facial recognition, iris recognition
- video surveillance: cameras in public and private places
- online privacy: ensuring your browser history is not known
- wireless tracking: using cell towers to locate a phone
- identity theft: assuming someone else's online identity and exploiting it
- medical records: ensuring their privacy
- wiretapping: usually requires warrant, some states (i.e., Georgia) allow phone user to tap own line without permission
- RFID: radio frequency identification can be used to steal encrypted information from credit cards
- and many more
- Summarizes privacy issues facing people today including:
- Electronic Freedom Foundation
- Home page of the Electronic Freedom Foundation, a group interested in protecting individual rights related to electronic technology.
- A recent article focuses on the use of technical means of surveilling college students. Techniques (mostly by campus police) include:
- Body Worn Cameras
- Drones
- Automated License Plate Readers
- Social Media Monitoring
- Biometric Identification
- Gunshot Detection
- Video Analytics
- EFF Border Search Pocket Guide
- Government search power is higher at border. Agents may conduct "routine" searches (including disassembling gas tanks) without a warrant. For "non-routine" searches, such as strip searches, no warrant is required but agents must have "reasonable suspicion."
- Searches of cell phone contents by inspection are legal. Forensic searches with software require "reasonable suspicion."
- Cell phone GPS: Privacy issues
- Short article discusses the implications of E911 calls.
- E911 allows authorities to track cell phones during 911 calls
- The law does not allow GPS tracking in non-emergency situations
- Nearly all smartphones may tracked by GPS (should require a warrant)
- Short article discusses the implications of E911 calls.
- Cell Phones and Police
- EFF on Digital Rights
- The 4th Amendment protects people from unreasonable governmental search and seizures
- But, if you give consent search is possible
- In nearly all cases, police need a warrant to enter your home
- But, if you give consent search is possible
- Also, if police suspect an electronic device needed for evidence is about to be destroyed, they may enter
- Other EFF advice
- Ask to see the warrant
- If during search, "something illegal" is in "plain view" then police may seize it legally, including computer if screen is displaying something illegal
- Police may seize your computer but you are not required to provide passwords
- Apple and the FBI
- Apple only encrypts some data now on iCloud
- In contrast to its earlier position (see below) Apple decided NOT to offer end-to-end encryption to iCloud
- Apple has responded to official requests for iCloud data on a case by case basis and responds to over 90% of such requests
- Google, in a manner similar to Apple's original stance, offers its users the opportunity for end-to-end encryption by user request
- Apple's Response to Customers
- This was Apple's original stand on providing data to government agency requests. Apple has since changed that position (see above)
- Apple only encrypts some data now on iCloud
- EFF on Digital Rights
- Automotive Black Boxes (Event Data Recorders)
- Consumer Reports on Event Data Recorders
(EVRs)
- All vehicles manufactured since the mid 1990s
- The newest EVRs record:
- The forward and lateral crash force.
- The crash event duration.
- Indicated vehicle speed.
- Accelerator position.
- Engine rpm.
- Brake application and antilock brake activation.
- Steering wheel angle.
- Stability control engagement.
- Vehicle roll angle, in case of a rollover.
- Number of times the vehicle has been started.
- Driver and front-passenger safety belt engagement, and pretensioner or force limiter engagement.
- Air bag deployment, speed, and faults for all air bags.
- Front seat positions.
- Occupant size.
- Number of crashes (one or more impacts during the final crash event).
- Consumer Reports adds:
- According to NHTSA, captured data is the property of the vehicle owner. But even on vehicles where it is accessible, special tools are required to get it. The IIHS says police or investigators can access the data with the owner's consent, or can obtain a court order to gain access if the owner refuses.
- Tiger Wood's Black Box
- Los Angeles County Sheriff executes warrant for Wood's black box
- How do those car insurance tracking devices work?
- Many auto insurance companies offer lower rates if drivers use their electronic tracking devices
- Those devices connect to new vehicle's onboard diagnostics port (OBD)
- The companies may monitor (read the fine print):
- date driven
- distance driven
- trip time
- hard braking
- speed
- location
- Consumer Reports on Event Data Recorders
(EVRs)
- CISA
- Cybersecurity Information Sharing Act (CISA)
- "CISA is responsible for protecting the Nation’s critical infrastructure from physical and cyber threats. This mission requires effective coordination and collaboration among a broad spectrum of government and private sector organizations."
- CISA functions:
- Comprehensive Cyber Protection
- Infrastructure Resilience
- Emergency Communication
- National Risk Management Center
- CISA is heavily involved in the government's response to Covid-19
- Cybersecurity Information Sharing Act (CISA)
- SAU offers a graduate program in Cyber Security (see link above)
- Its focus areas are:
- Information Technology
- Data Science
- Cyber Security and Privacy
- "The Cyber Security and Privacy option focuses on security analytics (such as penetration testing and digital forensics), cyber defense and privacy compliance. Students are expected to have familiarity with computer systems and applications to pursue this option. Key career options include: security/privacy architect, forensic specialist, security/privacy compliance analyst, or pursuing doctoral studies."
- Its focus areas are:
- Wikipedia on Big Brother
- Wikipedia review of the Big Brother character in Orwell's novel 1984.
- Full Video of 1984
- George Orwell Biography
- Using Facial Recognition to identify rioters at Capitol
- Discusses issues around facial recognition:
- There are no federal regulations as yet governing the technology
- Portland, San Francisco, Boston, and Minneapolis have banned its use by police
- Sales of the technology have increased since the riot at the Capitol
- Between 2011 and 2019 law enforcement agencies performed over 390,000 searches
- Black Lives Matter protests in summer 2020 spurred sales
- Customs and Border Protection conducted more than 23 million scans at United States ports of entry in 2020
- The technology is less accurate on nonwhite faces
- Two wrongful arrests have occurred
- The technology is available to individual users too
- Discusses issues around facial recognition: