• Cryptography.
As
the field of cryptography has advanced, the dividing lines for what is
and what is not cryptography have become blurred. Cryptography today
might be summed up as the study of techniques and applications that
depend on the existence of difficult problems.
Cryptanalysis is the study of how to compromise (defeat) cryptographic
mechanisms, and cryptology (from the Greek kryptós
lógos,
meaning ``hidden word'') is the discipline of cryptography and
cryptanalysis combined.
To most people, cryptography is concerned with keeping communications
private. Indeed, the protection of sensitive communications has been
the emphasis of cryptography throughout much of its history. However,
this is only one part of today's cryptography.
Encryption is the transformation of data into a form that is as close
to impossible as possible to read without the appropriate knowledge.
Its purpose is to ensure privacy by keeping information hidden from
anyone for whom it is not intended, even those who have access to the
encrypted data. Decryption is the reverse of encryption; it is the
transformation of encrypted data back into an intelligible form.
Encryption and decryption generally require the use of some secret
information, referred to as a key. For some encryption mechanisms, the
same key is used for both encryption and decryption; for other
mechanisms, the keys used for encryption and decryption are different
Today's cryptography is more than encryption and decryption.
Authentication is as fundamentally a part of our lives as privacy. We
use authentication throughout our everyday lives - when we sign our
name to some document for instance - and, as we move to a world where
our decisions and agreements are communicated electronically, we need
to have electronic techniques for providing authentication.
Cryptography provides mechanisms for such procedures. A digital
signature binds a document to the possessor of a particular key, while
a digital timestamp binds a document to its creation at a particular
time. These cryptographic mechanisms can be used to control access to a
shared disk drive, a high security installation, or a pay-per-view TV
channel.
The field of cryptography encompasses other uses as well. With just a
few basic cryptographic tools, it is possible to build elaborate
schemes and protocols that allow us to pay using electronic money, to
prove we know certain information without revealing the information
itself, and to share a secret quantity in such a way that a subset of
the shares can reconstruct the secret.
While modern cryptography is growing increasingly diverse, cryptography
is fundamentally based on problems that are difficult to solve. A
problem may be difficult because its solution requires some secret
knowledge, such as decrypting an encrypted message or signing some
digital document. The problem may also be hard because it is
intrinsically difficult to complete, such as finding a message that
produces a given hash value.
(extracted from RSA Security web site, see citation)
• RSA Cryptosystem.
The RSA cryptosystem is a public-key cryptosystem that offers both
encryption and digital signatures (authentication). Ronald Rivest, Adi
Shamir, and Leonard Adleman developed the RSA system in 1977; RSA
stands for the first letter in each of its inventors' last names.
The RSA algorithm works as follows: take two large primes, p and q, and
compute their product n = pq; n is called the modulus. Choose a number,
e, less than n and relatively prime to (p-1)(q-1), which means e and
(p-1)(q-1) have no common factors except 1. Find another number d such
that (ed - 1) is divisible by (p-1)(q-1). The values e and d are called
the public and private exponents, respectively. The public key is the
pair (n, e); the private key is (n, d). The factors p and q may be
destroyed or kept with the private key.
It is currently difficult to obtain the private key d from the public
key (n, e). However if one could factor n into p and q, then one could
obtain the private key d. Thus the security of the RSA system is based
on the assumption that factoring is difficult. The discovery of an easy
method of factoring would "break" RSA.
Here is how the RSA system can be used for encryption and digital
signatures (in practice, the actual use is slightly different:
Encryption
Suppose Alice wants to send a message m to Bob. Alice creates the
ciphertext c by exponentiating: c = me mod n, where e and n are Bob's
public key. She sends c to Bob. To decrypt, Bob also exponentiates: m =
cd mod n; the relationship between e and d ensures that Bob correctly
recovers m. Since only Bob knows d, only Bob can decrypt this message.
Digital Signature
Suppose Alice wants to send a message m to Bob in such a way that Bob
is assured the message is both authentic, has not been tampered with,
and from Alice. Alice creates a digital signature s by exponentiating:
s = md mod n, where d and n are Alice's private key. She sends m and s
to Bob. To verify the signature, Bob exponentiates and checks that the
message m is recovered: m = se mod n, where e and n are Alice's public
key.
Thus encryption and authentication take place without any sharing of
private keys: each person uses only another's public key or their own
private key. Anyone can send an encrypted message or verify a signed
message, but only someone in possession of the correct private key can
decrypt or sign a message.
(extracted from RSA Security web site, see citation)
• Algorithm.
In mathematics and computing, an algorithm is a procedure (a finite set
of well-defined instructions) for accomplishing some task which, given
an initial state, will terminate in a defined end-state. The
computational complexity and efficient implementation of the algorithm
are important in computing, and this depends on suitable data
structures.
Informally, the concept of an algorithm is often illustrated by the
example of a recipe, although many algorithms are much more complex;
algorithms often have steps that repeat (iterate) or require decisions
(such as logic or comparison). Algorithms can be composed to create
more complex algorithms.
The concept of an algorithm originated as a means of recording
procedures for solving mathematical problems such as finding the common
divisor of two numbers or multiplying two numbers. The concept was
formalized in 1936 through Alan Turing's Turing machines and Alonzo
Church's lambda calculus, which in turn formed the foundation of
computer science.
Most algorithms can be directly implemented by computer programs; any
other algorithms can at least in theory be simulated by computer
programs. In many programming languages, algorithms are implemented as
functions or procedures.
• Brute Force Attack.
In cryptanalysis, a brute force attack is a method of defeating a
cryptographic scheme by trying a large number of possibilities; for
example, exhaustively working through all possible keys in order to
decrypt a message. In most schemes, the theoretical possibility of a
brute force attack is recognized, but it is set up in such a way that
it would be computationally infeasible to carry out. Accordingly, one
definition of "breaking" a cryptographic scheme is to find a method
faster than a brute force attack.
The selection of an appropriate key length depends on the practical
feasibility of performing a brute force attack. By obfuscating the data
to be encoded, brute force attacks are made less effective as it is
more difficult to determine when one has succeeded in breaking the code.
• GSM:
Global System for Mobile Communications.
The Global System for Mobile Communications, GSM (original acronym:
Groupe Spécial Mobile) is the most popular standard for
mobile
phones in the world. GSM service is used by over 2 billion people
across more than 212 countries and territories. The ubiquity of the GSM
standard makes international roaming very common between mobile phone
operators, enabling subscribers to use their phones in many parts of
the world. GSM differs significantly from its predecessors in that both
signaling and speech channels are Digital call quality, which means
that it is considered a second generation (2G) mobile phone system.
This fact has also meant that data communication was built into the
system from the 3rd Generation Partnership Project (3GPP).
From the point of view of the consumers, the key advantage of
GSM
systems has been higher digital voice quality and low cost alternatives
to making calls such as text messaging. The advantage for network
operators has been the ability to deploy equipment from different
vendors because the open standard allows easy inter-operability. Like
other cellular standards GSM allows network operators to offer roaming
services which mean subscribers can use their phones all over the world.
As the GSM standard continued to develop, it retained backward
compatibility with the original GSM phones; for example, packet data
capabilities were added in the Release '97 version of the standard, by
means of GPRS. Higher speed data transmission has also been introduced
with EDGE in the Release '99 version of the standard.
• Firmware.
Firmware is a software program or set of instructions programmed on a
hardware device. It provides the necessary instructions for how the
device communicates with the other computer hardware. But how can
software be programmed onto hardware? Good question. Firmware is
typically stored in the flash ROM of a hardware device. While ROM is
"read-only memory," flash ROM can be erased and rewritten because it is
actually a type of flash memory.
Firmware can be thought of as "semi-permanent" since it remains the
same unless it is updated by a firmware updater. You may need to update
the firmware of certain devices, such as hard drives and video cards in
order for them to work with a new operating system. CD and DVD drive
manufacturers often make firmware updates available that allow the
drives to read faster media. Sometimes manufacturers release firmware
updates that simply make their devices work more efficiently.
(extracted from Sharpened Computer Glossary, see citation)
• Half Duplex.
A half-duplex system provides for communication in both directions, but
only one direction at a time (not simultaneously). Typically, once a
party begins receiving a signal, it must wait for the transmitter to
stop transmitting, before replying.
An example of a half-duplex system is a two-party system such as a
"walkie-talkie" style two-way radio, wherein one must use "Over" or
another procedure to indicate the end of transmission, and ensure that
only one party transmits at a time, because both parties transmit on
the same frequency. A good analogy for a half-duplex system would be a
one lane road with traffic controllers at each end. Traffic can flow in
both directions, but only one direction at a time with this being
regulated by the controllers.
• Full
Duplex.
A full-duplex system allows communication in both directions, and
unlike half-duplex, allows this to happen simultaneously. Land-line
telephone networks are full-duplex since they allow both callers to
speak and be heard at the same time. A good analogy for a full-duplex
system would be a two lane road with one lane for each direction.
Examples: Telephone, Mobile Phone, etc.
Two way radios can be, for instance, designed as full-duplex systems,
which transmit on one frequency and receive on a different frequency.
This is also called frequency-division duplex.
Frequency-division-duplex systems can be extended to farther distances
using pairs of simple repeater stations, owing to the fact the
communications transmitted on any one frequency always travels in the
same direction.
• Wiretap.
Telephone tapping (or wire tapping/wiretapping in the US) is the
monitoring of telephone and Internet conversations by a third party,
often by covert means. The telephone tap or wire tap received its name
because historically, the monitoring connection was applied to the
wires of the telephone line of the person who was being monitored and
drew off or tapped a small amount of the electrical signal carrying the
conversation. Legalized wiretapping by police or other recognized
governmental authority is otherwise known as lawful interception.
Official
use
The contracts or licenses by which the state controls telephone
companies often require that the companies must provide access for
tapping lines to the security services and the police. In the U.S.,
telecommunications carriers are required by law to cooperate in the
interception of communications for law enforcement purposes under the
terms of CALEA. Taps must be secret and undetectable.
When telephone exchanges were mechanical, a tap had to be installed by
technicians, linking circuits together to route the audio signal from
the call. Now that many exchanges have been converted to digital
technology tapping is far simpler and can be ordered remotely by
computer. Telephone services provided by cable TV companies also use
digital switching technology. If the tap is implemented at a digital
switch, the switching computer simply copies the digitized bits that
represent the phone conversation to a second line and it is impossible
to tell whether a line is being tapped. A well designed tap installed
on a phone wire can be difficult to detect. The noises that some people
believe to be telephone taps are simply crosstalk created by the
coupling of signals from other phone lines.
Data on the calling and called number, time of call and duration, will
generally be collected automatically on all calls and stored for later
use by the billing department of the phone company. This data can be
accessed by security services, often with fewer legal restrictions than
for a tap. This information used to be collected using special
equipment known as pen registers and trap and trace devices and U.S.
law still refers to it under those names. Today, a list of all calls to
a specific number can be obtained by sorting billing records. A
telephone tap during which only the call information is recorded but
not the contents of the phone calls themselves, is called a Pen
Register tap.
For telephone services via digital exchanges, the information collected
may additionally include a log of the type of communications media
being used (some services treat data and voice communications
differently to conserve bandwidth).
Unofficial
use
It is also possible to tap conversations unofficially. There are a
number of ways to monitor telephone conversations:
Recording the conversation - the person making/receiving the call
records the conversation using a coil tap ('telephone pickup coil')
attached to the ear-piece, or they fit an in-line tap with a recording
output. Both of these are easily available through electrical shops. A
more modern alternative is to use telephone recording devices connected
to computers, such as PhoneValet Message Center. Most who record
telephone conversations, such as journalists, will refer to the
recording for their work.
Direct line tap - this is what the state used to do via the telephone
exchange. But unofficial tapping, where the user's line is physically
tapped near the house, is also possible. The tap can either involve a
direct electrical connection to the line, or an induction coil. An
induction coil is usually placed underneath the base of a telephone or
on the back of a telephone handset to pick up the signal inductively.
With a direct connection, there will be some drop in signal levels
because of the loss of power from the line, and it may also generate
noise on the line. A well designed induction tap does not drain voltage
or current from the line because it isn't physically connected to the
phone line. Direct taps sometimes require regular maintenance, either
to change tapes or replace batteries, which may give away their
presence.
Radio tap - this is like a bug that fits on the telephone line. The
state does not normally do this because they have access via the
telephone exchange, though certain organizations exempt from the common
framework of law applying to citizens may use devices like this. It can
be fitted to one phone inside the house, or outside on the phone line.
It may produce noise (there might even be signal feedback on the
monitored line on poorly made equipment) to inadvertently alert the
caller. Modern state of the art equipment operates in the 30-300 GHz
range. The unit is powered from the line to be maintenance free, and
only transmits when a call is in progress. These devices tend to be low
powered because the drain on the line would become too great, however a
state of the art receiver could be located as far away as ten
kilometers under ideal conditions, but is usually located within a
radius of 1 to 3 km. Research however has also shown that a satellite
can be used to receive emissions in the range of a few milliwatts.
To guard against unofficial amateur line taps, the phone should be
regularly inspected, and the telephone line should be checked for new
joints, or small wires connected to the line; a time-domain
reflectometer is a worthy tool here. If you have reason to suspect your
phone has been tapped consult a technical surveillance countermeasures
(TSCM) specialist. Never contact a TSCM specialist from a phone you
suspect is tapped or on any other phone on the premises or any other
phone that is linked to you or your organization (home phone, company
cellular, etc.).
• Backdoor.
A backdoor in a computer system (or cryptosystem or algorithm) is a
method of bypassing normal authentication or securing remote access to
a computer, while attempting to remain hidden from casual inspection.
The backdoor may take the form of an installed program (e.g., Back
Orifice or the Sony/BMG rootkit backdoor installed when any of millions
of Sony music CDs were played on a Windows computer), or could be a
modification to a legitimate program.
• IMSI Catcher.
An IMSI catcher
is a device for intercepting GSM mobile phones. It subjects the phones
in its vicinity to a man in the middle attack, acting to them as a
preferred base station in terms of signal strength.
The IMSI catcher logs the
IMSI numbers of all the mobile phones in the area, as they attempt to
attach to the base station, and can determine the phone number of each
individual phone. It also allows forcing the mobile phone connected to
it to revert to A5/0 for call encryption (in other words, no encryption
at all), making the call data easy to intercept and convert to audio.
It can also tap and record the phone calls on its own.
The GSM specification
requires the handset to authenticate to the network, but does NOT
require the network to authenticate to the handset, which is a glaring
and reportedly intentional security hole.
IMSI catchers are used by
law enforcement and intelligence agencies.
Several countermeasures
against IMSI catchers exist. A directional antenna can be used to lock
the telephone to a distant base station, making it not see the nearby
IMSI catcher, or the phone can be forced to a specific base station ID
(if the firmware supports it), sacrificing mobility for security. To
avoid being wiretapped, even if the phone is still seen and recognized,
a GSM compatible secure telephone or cipher unit for end-to-end voice
encryption is required.
• Eavesdropping.
Eavesdropping is the intercepting of conversations by unintended
recipients. One who participates in eavesdropping (i.e. someone who
secretly listens in on the conversations of others) is called an
eavesdropper. The origin of the term comes from situations in which
people would literally hide out in the eavesdrop of a house to listen
in on private conversations.
Citations
Communications security.
(2006, October 26). In
Wikipedia, The Free Encyclopedia.
Retrieved 05:01, October 28, 2006, from
http://en.wikipedia.org/w/index.php?title=Communications_security&oldid=83930448
Technical Surveillance
Counter-Measures. (2006, October 12). In
Wikipedia, The Free
Encyclopedia. Retrieved 05:06, October 28, 2006, from
http://en.wikipedia.org/w/index.php?title=Technical_Surveillance_Counter-Measures&oldid=81111566
Surveillance. (2006,
October 23). In Wikipedia, The Free Encyclopedia.
Retrieved 05:12, October 28, 2006, from http://en.wikipedia.org/w/index.php?title=Surveillance&oldid=83282391
Business intelligence.
(2006, October 26). In Wikipedia, The Free Encyclopedia.
Retrieved 05:25, October 28, 2006, from http://en.wikipedia.org/w/index.php?title=Business_intelligence&oldid=83862343
Industrial espionage. (2006, October 19). In
Wikipedia, The
Free Encyclopedia. Retrieved 05:31, October 28, 2006, from
http://en.wikipedia.org/w/index.php?title=Industrial_espionage&oldid=82435589
Espionage. (2006,
October 27). In
Wikipedia, The Free Encyclopedia.
Retrieved 05:38, October 28, 2006, from
http://en.wikipedia.org/w/index.php?title=Espionage&oldid=84144756
Cryptography. (2006, October 26). In
Wikipedia, The Free
Encyclopedia. Retrieved 05:41, October 28, 2006, from
http://en.wikipedia.org/w/index.php?title=Cryptography&oldid=83828051
Encryption. (2006, October 27). In
Wikipedia, The Free
Encyclopedia. Retrieved 05:43, October 28, 2006, from
http://en.wikipedia.org/w/index.php?title=Encryption&oldid=84073599
Circuit Switched Data.
(2006, September 14). In
Wikipedia, The Free Encyclopedia.
Retrieved 05:59, October 28, 2006, from
http://en.wikipedia.org/w/index.php?title=Circuit_Switched_Data&oldid=75709471
Covert listening
device. (2006, November 10). In
Wikipedia, The Free
Encyclopedia. Retrieved 04:29, November 12, 2006, from
http://en.wikipedia.org/w/index.php?title=Covert_listening_device&oldid=86955270
What is Crytpography?. From RSA Security. Retrieved
01:59, November 12, 2006, from
http://www.rsasecurity.com/rsalabs/node.asp?id=2157
The RSA
Cryptosystem. From RSA Security. Retrieved 02:08,
November 12, 2006, from
http://www.rsasecurity.com/rsalabs/node.asp?id=2214
Algorithm. (2006, November
12). In Wikipedia, The Free Encyclopedia. Retrieved
07:15, November 12, 2006, from http://en.wikipedia.org/w/index.php?title=Algorithm&oldid=87295986
Brute force attack. (2006, November 7). In
Wikipedia, The
Free Encyclopedia. Retrieved 07:19, November 12, 2006, from
http://en.wikipedia.org/w/index.php?title=Brute_force_attack&oldid=86297776
Global System for
Mobile Communications. (2006, November 9). In
Wikipedia, The
Free Encyclopedia. Retrieved 07:32, November 12, 2006, from
http://en.wikipedia.org/w/index.php?title=Global_System_for_Mobile_Communications&oldid=86740425
Fimware. In
Sharpened
Computer Glossary. Retrieved 02:39, November 12, 2006, from
http://www.sharpened.net/glossary/definition.php?firmware
Duplex
(telecommunications). (2006, November 3). In
Wikipedia, The
Free Encyclopedia. Retrieved 07:45, November 12, 2006, from
http://en.wikipedia.org/w/index.php?title=Duplex_%28telecommunications%29&oldid=85399120
Telephone tapping. (2006, November 17). In Wikipedia, The Free
Encyclopedia. Retrieved 02:49, November 18, 2006, from
http://en.wikipedia.org/w/index.php?title=Telephone_tapping&oldid=88353442
Backdoor. (2006, November 8). In Wikipedia, The Free Encyclopedia.
Retrieved 03:15, November 18, 2006, from
http://en.wikipedia.org/w/index.php?title=Backdoor&oldid=86470970
IMSI-catcher. (2006, September 22). In
Wikipedia, The Free
Encyclopedia. Retrieved 03:28, November 18, 2006, from
http://en.wikipedia.org/w/index.php?title=IMSI-catcher&oldid=77088467
Eavesdropping. (2006, November 15). In Wikipedia, The Free
Encyclopedia. Retrieved 03:39, November 18, 2006, from
http://en.wikipedia.org/w/index.php?title=Eavesdropping&oldid=87989496
