Silicon Investor (SI) -- The First Internet Community

STOCKTALK

We've detected that you're using an ad content blocking browser plug-in or feature. Ads provide a critical source of revenue to the continued operation of Silicon Investor. We ask that you disable ad blocking while on Silicon Investor in the best interests of our community. If you are not using an ad blocker but are still receiving this message, make sure your browser's tracking protection is set to the 'standard' level.

Technology Stocks : Identix (IDNX) -- Ignore unavailable to you. Want to Upgrade?

To: David who wrote (10017)	8/21/1998 10:54:00 AM
From: R. Jaynes	Read Replies (1) \| Respond to of 26039

Nice article, David. Now, from the yahoo thread - I have held IDX for a long time and think that you longs might be interested in this news. I just returned from the huge, American Correctional Association conference in Detroit where the US leaders in law enforcement technology set up booths to introduce their product to the field of corrections. IDX was well represented with a huge booth with marketing, and sales reps to talk to clients. I was impressed by seeing them there and hopefully they made some valuable contacts. Rick

To: David who wrote (10017)	8/24/1998 11:13:00 AM
From: David	Respond to of 26039

Technical advance in public key encryption (i.e., good news): ( BW)(IBM-RESEARCH/ENCRYPTION)(IBM) New Encryption System Provides Practical, Unbreakable Protection ZURICH--(BUSINESS WIRE)--Aug. 24, 1998-- Researchers Develop Mathematically Proven Solution to Internet Security Loophole Mathematicians at IBM Research and the Swiss Federal Institute of Technology (ETH) have co-developed a new public-key cryptosystem that provides the first practical and mathematically proven way to secure information from even the most aggressive Internet hacking attempts. The new Cramer-Shoup cryptosystem, revealed today at the Crypto'98 conference at the University of California-Santa Barbara, effectively closes the backdoor on so-called "active" attacks. All current commercially available cryptosystems are potentially vulnerable to active attacks, which are considered to be the most dangerous hacking attempts any cryptosystem might face. "This system delivers a new level of integrity for Internet communications, and is particularly suited for e-commerce applications such as cyber-auctions, credit card purchases, and protecting private information," said Jeff Jaffe, general manager for IBM's security products and services. "Businesses and consumers can have greater confidence in Internet transactions, because we've effectively closed down the only way around a cryptosystem's main line of defense." IBM plans to incorporate the new system into a future version of its Vault Registry software, the IBM SecureWay public-key infrastructure product that allows e-commerce transactions to travel across organizational boundaries in a private, secure manner. "It's important that we nip this type of powerful attack in the bud," said Victor Shoup of IBM's Zurich Research Laboratory, who invented the new cryptosystem with Ronald Cramer for the Swiss Federal Institute of Technology (ETH). "Earlier this year, an active attack decoded information secured by the most widely used encryption system for Web browsers. Our system will prevent this from happening." Finesse vs. Muscle The strength of modern cryptosystems from being based upon really difficult mathematical problems that are thought to be unsolvable. If a cryptosystem's underlying problem could be solved, then the cryptosystem's security could be broken. "Active" attacks bypass the difficulty of solving the underlying mathematical problem by sending a series of cleverly constructed messages to a publicly accessible server. By analyzing the server's pattern of responses to the bogus text, an attacker can decode encrypted messages passing through that network. The Cramer-Shoup method thwarts these attacks by delivering the first non-malleable cryptosystem efficient enough for commercial use. "This is a case of finesse over muscle," said Charles Palmer, head of IBM Research's Network Security and Cryptography Group in New York. "Previous systems left open the possibility of indirect attack. This system elegantly denies that access, shunting attackers back to the imposing mathematical problem at the core of the cryptosystem. In this case, it's the Diffie-Hellman Decision Problem, for which no feasible solution is known." "Non-malleable" Vs. "Malleable" Protection The Cramer-Shoup system extends the research earlier this decade of three computer scientists at IBM's Almaden Research Center, San Jose, CA. In 1991, Danny Dolev, Cynthia Dwork and Moni Naor recognized that all current cryptosystems were potentially "malleable." That is, without knowing the decryption key, an attacker could transform an encryption of one message into an encryption of a related message. This is a serious security flaw because an active attacker could, for example, eavesdrop on a competitor's encrypted transmission of a bid for a contract and then submit an assuredly lower one -- all without knowing the value of the competitor's bid or even his or her own bid. An active attacker can further exploit the cryptosystem's malleability to decrypt targeted messages. "A malleable cryptosystem is like the combination lock on a safe," says Dwork. "It provides good security, but a skilled safecracker can still open it by listening carefully to the lock mechanism as the dial is turned. An absolutely silent lock mechanism that gives no clue to the combination would be non-malleable and clearly more desirable." Non-malleable cryptosystems neutralize active attacks by adding another series of calculations which ensure that the server leaks no information when responding to bogus text. Cramer and Shoup's major achievement is combining mathematical rigor with efficient operation, as their system requires little more than twice the computing time of current malleable systems. A Leader in Cryptography IBM Research has been a leader in encryption research and development since developing the core technology for the Data Encryption Standard in the early 1970s. Other recent contributions in this area by IBM Research include: -- In 1990, Moni Naor and Moti Yung designed the first public-key cryptosystem provably secure against a slightly weaker type of active attack. -- Also in 1991, Dwork, Naor and Dolev developed a non-malleable identification scheme that was the first to be secure against "intruder-in-the-middle" attacks. -- In 1994, Mihir Bellare and Phil Rogaway developed a practical public-key cryptosystem that, while not provably secure against active attacks, has been argued to be, until now, the best available protection. RSA Data Security, Inc. has recently proposed this system to make SSL more secure against active attacks. -- In 1997, Miklos Ajtai and Dwork developed a new cryptosystem with the extremely desirable property that a random instance of it is as hard to break as the hardest instance of the underlying mathematical problem. Thus the Ajtai-Dwork cryptosystem has -- provably -- no "bad" keys, those which are easier to break than others in the same system. The technical paper by Cramer and Shoup that describes their new cryptosystem in detail can be viewed on the World Wide Web at: www.zurich.ibm.com/Technology/Security/publications/1998/CS.pdf Additional information on IBM Research is available on the web at: www.research.ibm.com.