With machines with over 1TB memory already commonplace, many OLTP workloads can fit entirely in memory - This creates unencrypted "Data in Memory" risk, how can we encrypt this? - EnclaveDB might be one solution

It brings together the security properties of Intel’s SGX enclaves with the Hekaton SQL Server database engine. The result is a secure database environment with impressive runtime performance.

For traditional databases, the entire query processing pipeline is part of the attack surface. With EnclaveDB however, all queries are first compiled to native code and then packaged along with the query engine and the trusted kernel


EnclaveDB assumes an adversary can control everything in the environment bar the code inside enclaves. They can access and tamper with any server-side state in memory, on-disk, or over the network. They can mount replay attacks by shutting down the database and attempting to recover from a stale state, and they can attempt to fork the database and sending requests from different clients to different instances

Whereas existing system require users to associate and manage encryption keys for each column containing sensitive data, EnclaveDB takes advantage of the encryption and integrity protection provided by the SGX memory encryption engine, which kicks in whenever data is evicted from the processor cache. Thus only a single database encryption key is needed. This key is provisioned to a trusted key management service (KMS) along with a policy specifying the enclave that the key can be provisioned to. When an EnclaveDB instance starts it remotely attests with the KMS and receives the key.

Clients connect to EnclaveDB by creating a secure channel with the enclave and establishing a shared session key. The enclave authenticates clients using embedded certificates. All traffic between clients and EnclaveDB is encrypted using the session key.
Once client requests have been validated, the stored procedure executes entirely within the enclave, on tables hosted in the enclave. Return values are encrypted before being written to buffers allocated by the host.


https://blog.acolyer.org/2018/07/05/enclavedb-a-secure-database-using-sgx/

I am sure you know this - end-to-end encrypted messaging app like WhatsApp is that the messages are unreadable to anyone who intercepts them. Are you aware of this (read below)

 If you keep those messages on your device, or worse, you back them up unencrypted to the cloud—be it iCloud or Google Drive—you open the door for authorities to obtain them with court orders, effectively making the original encryption pointless.


Check this incident:
https://motherboard.vice.com/en_us/article/zm8q43/paul-manafort-icloud-whatsapp-bad-opsec-witness-tampering

Common Sense - Proper implemention any security technology/product will provide the expected results AND more importantly eliminate the "false sense of security".

Here is an example of incorrect implementation that lead to eFail vulnerabilities - These vulnerabilities could allow potential attackers to decrypt the content of your end-to-end encrypted emails in plaintext, even for messages sent in the past. 

The flaw doesn't reside in the email encryption standards itself; instead, it affects a few email clients/plugins that incorrectly implemented the technologies.

https://thehackernews.com/2018/05/efail-pgp-email-encryption.html

ROBOT attack? - Not the Isaac Asimov Kind, its around Encryption

ROBOT - Return of Bleichenbacher’s Oracle Attack

Bleichenbacher’s attack was first discovered in 1998

Studies uncover that probably the most well-known sites on the Internet, including Facebook and Paypal, are influenced by the ROBOT attack.


For More:
http://www.hackersnewsbulletin.com/2017/12/robot-attacks-rediscovered.html

I thought one cannot calculate a private Key from public key. I was wrong

In a nutshell, the bug (in Infineon Technology chipset) makes it possible for an attacker to calculate a private key just by having a target’s public key.


The Infineon flaw is tied to a faulty design of Infineon’s Trusted Platform Module (TPM), a dedicated microcontroller designed to secure hardware by integrating cryptographic keys into devices and used for secured crypto processes.

The currently confirmed number of vulnerable keys found is about 760,000 but possibly up to two to three magnitudes more are vulnerable


For More:
https://threatpost.com/factorization-flaw-in-tpm-chips-makes-attacks-on-rsa-private-keys-feasible/128474/

Encryption is useful (to the bad guys too).

What can be used can also be abused.



From the article:

As more advertisers and ad networks start enabling HTTPS, criminals are beginning to make their activities harder to trace by serving their malicious ads over HTTPS, encrypting their tracks, according to security experts.


“HTTPS makes it a lot harder to be able to get this 'creative ID' as it is inside an encrypted session between the victimized client and the publisher giving the advertisement content,” Klijnsma said.


That’s the reason why a recent malvertising campaign that hit eBay and the Drudge Report, among others, was able to go unnoticed for three weeks. As Segura noted in his technical analysis of the campaign, the criminals avoided detection “by encrypting traffic” using HTTPS.

What’s worse, there’s no easy solution to this. One possibility, Klijnsma argued, is to limit ads containing dynamic scripts such as JavaScript, which are the preferred method to deliver malicious code. 

For more info:
http://motherboard.vice.com/en_uk/read/the-downside-of-encrypting-everything-virus-filled-ads-are-harder-to-track

How-To: Phone and laptop encryption guide - For common folks

Remember:
Even if you totally wipe your drive, disk recovery software may still be able to read old files.


Link to the article:
http://arstechnica.com/gadgets/2015/08/phone-and-laptop-encryption-guide-protect-your-stuff-and-yourself/

Document - Implementing SHA-2 in Active Directory

Detailed article from Microsoft


From the article:

Note: Even with appropriate SHA-2 patches applied to Windows Server 2003, Certificate Services on 2003 cannot create SHA-2-signed digital certificates or CRLs. 

Even if Microsoft Windows supports SHA-2 digital certificates, it is still up to individual applications on whether to use Microsoft Windows built-in cryptographic processes for digital certificate inspection and verification. Each application using digital certificates should be tested, end-to-end, to ensure that it supports SHA-2 hashes.

For more information:

http://social.technet.microsoft.com/wiki/contents/articles/31296.implementing-sha-2-in-active-directory-certificate-services.aspx

How to steal encryption keys - Just by touching the computer !!!

I did not know that we are born with embedded hacking tools (I am excluding the Brain here).

From the Article

There are flaws and weaknesses in human flesh and bones that make it easier than it should be to force someone to offer up the key to decrypt something.

This research is a side-channel attack. The metal parts of a laptop, such as the shielding around USB ports, and heat sink fins, are notionally all at a common ground level. However, this level undergoes tiny fluctuations due to the electric fields within the laptop. These variations can be measured, and this can be used to leak information about encryption keys.

the researchers also experimented with using a smartphone connected to Ethernet shielding via its headphone port, and found that this was sufficient to perform some attacks.

Robust protection is hard to do, because 

1. The side-channel is largely a feature of the hardware. 
2. Faraday cages can protect against electromagnetic side channels, 
3. insulation can protect against this kind of "touching metal parts" attack, 
4. optical fibres can protect against measuring fluctuations in Ethernet connections

but all these drive up costs and are of limited practicality.

Follow this link for additional details:

http://arstechnica.com/security/2014/08/stealing-encryption-keys-through-the-power-of-touch/

Google Mail - end-to-end encryption available for Chrome.

Nice to have another additional layer of security

(from the article)

Google is now offering a plug-in called End-to-End for the Chrome browser -- in alpha test -- that lets users encrypt their web email messages.

The new End-to-End Chrome extension encrypts, decrypts, digitally signs, and verifies signed messages within the browser using OpenPGP. 

Both the sender and the recipient would need to be using OpenPGP, says Alex McGeorge, a senior security researcher for Immunity Inc. "You still have to go through the whole process of exchanging keys,"

"Once we feel that the extension is ready for primetime, we'll make it available in the Chrome Web Store,

Just how secure the extension will be also is unclear, McGeorge says. "JavaScript and crypto have typically been incompatible. A lot has to do with getting good randomness. That is super important for PGP."

The link below has more information:-

http://www.darkreading.com/endpoint/privacy/google-adds-chrome-encryption-option-for-webmail/d/d-id/1269434

End of Truecrypt !!! - A new Mystery

The Official site has the following message

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

This page exists only to help migrate existing data encrypted by TrueCrypt.

The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.

It is unfortunate to see my favorite free tool disappear

Below given are a few links that discuss this issue

http://steve.grc.com/2014/05/28/whither-truecrypt/

http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

http://www.reddit.com/r/sysadmin/comments/26pxol/truecrypt_is_dead/

http://www.reddit.com/r/Bitcoin/comments/26px9v/truecrypt_shutting_down_development_of_truecrypt/

Steganography with a new twist - Using Twitter Messages

Another (new) double-edged sword

According to the article:-

Users need only type the text they want others to see in one field and the hidden message in a separate field. The service, created by New Zealand-based developer Matthew Holloway, then spits out a tweetable message that fuses the two together in a way that's not noticeable to the human eye

Check the following link for the example-

http://arstechnica.com/security/2014/05/how-to-stash-secret-messages-in-tweets-using-point-and-click-steganography/

No encryption/decryption , still simple and secure - Unfortunately , used by Chilean Drug Traffickers

We know how spelling is important and how its affect on Boston Bombing

In this case,, the communication excludes  spaces between words so, it will just be a sequence of alphabets. 

According to the article:- 

while criminal methods are constantly evolving, the most basic techniques can still throw authorities off the trail

n 2010, Chile's national police, the Carabineros, arrested Leonardo Yañez Sepulveda with 80 grams of cocaine in Santiago. In his wallet, they found notes that detailed a coded language used by the traffickers to communicate via text messages, reported La Tercera. The notes contained a full explanation of how to use the coded alphabet, and how to decipher incoming coded messages 

Prosecutor Macarena Cañas said that for the authorities who analyzed the note, the find was completely novel. "It's like the Rosetta Stone; you have a complete dictionary," he said.

The link below has more information:-

http://www.insightcrime.org/news-briefs/police-convict-chile-drug-trafficker-after-discovering-secret-code

Can we trust the Cloud providers with Encryption - Yes and No?

Yes - Because they can provide encryption.

No - Because,we have to trust them (bad) and we have no visibility. 

The linked article has some good thoughts.

SNIPPETS from the Article:-

Server-side (Cloud) security requires trying to defend everywhere user data is stored: every disk, every server, every link, every router, and every database. Security is only as good as the weakest link, so it only takes one tiny mistake, vulnerability or mishandling for there to be a data breach; the Snapchat hack earlier this year is an example of what can happen.

Client-side encryption is just like putting data in a tamper-proof box: The contents will remain protected regardless of who handles it, how the box is transported or where it is stored. The data is protected anywhere, everywhere and remains individually encrypted until the user with the key unlocks it.

It’s also important to emphasize document-level encryption, because if a person sends a file of multiple documents and there’s only one layer of client-side encryption, someone may still be able to break the cipher. Think of it as locking every room in the house rather than merely the front door. Document-level encryption and client-side key management gives users both security and privacy.

The links below has more information:

http://www.networkcomputing.com/security/why-client-side-encryption-is-critical-f/240166605

Layered Security - Now , one additional layer in password protection (for $70)

The hardware box has the key that signs the Hash so if someone stole the password database , it will be hard for them to crack as the key is stored elsewhere.

This is not fool proof but an additional layer and the best part is it is cost effective. I am not sure about the performance and scalability nevertheless, a good one.

The links below has more information:

http://arstechnica.com/security/2014/03/can-this-70-dongle-stem-the-epidemic-of-password-breaches/

Quantum Encryption - could solve the "100-year" problem - Tall claims , will it come true?

I am not a Quantum Computing Guru but I know one thing that is repeated again and again.

"To observe something is to change it".

So, this concept is supposed to help encryption. I would like to see this tested by security experts and learn what they have to say.




SNIPPET from the Article:-

If a key should be intercepted en route, it changes as soon as it's "captured" and can no longer be used.



The link below has more information:


http://www.seattlepi.com/technology/businessinsider/article/Quantum-Encryption-Is-On-The-Verge-Of-Solving-The-4920613.php