Category Archives: Encryption
Apricorn Introduces Industry’s First 24TB Hardware Encrypted USB Drive – PR Newswire
Massive 24 TB Aegis Padlock DT and Padlock DT FIPS Desktop Drives Offer Encrypted Storage for Healthcare, Finance, Government and other Industries' Data at Rest
POWAY, Calif., March 21, 2024 /PRNewswire/ -- Apricorn, the leading manufacturer of software-free, 256-bit AES XTS hardware-encrypted USB data storage devices, today announced the release of a 24TB version of its Aegis Padlock DT and Padlock DT FIPS Desktop Drives. Continuing its position as an industry leader, Apricorn is the first to bring a 24TB encrypted drive to market, delivering high performance and mass capacity to industries such as healthcare, financial services, education, and government, while ensuring the security of users' data. This is the third time Apricorn has brought to market the industry's largest capacity hardware encrypted USB drive, having previously done so in 20TB and 22TB sizes.
"Microsoft this month disclosed that the nation state attack it identified in January wasstill not fully contained. Since Microsoft is so deeply entrenched in just about every facet of our workflow, encrypting and storing data offline adds a layer of protection and resilience in the face of potential future attacks that could stem from breaches of this nature," said Kurt Markley, U.S. Managing Director at Apricorn. "The Aegis Padlock DT line is an ideal way for large organizations to protect vast amounts of data at rest in a highly secure and economic way."
Both the Padlock DT and Padlock DT FIPS Desktop Drives come with AegisWare - the proprietary firmware and feature set unique to Apricorn's Aegis Secure Drives and Secure Keys. Consistent with the Apricorn line of secure drives, passwords and commands are entered by way of the device's on-board keypad. All authentication and encryption processes take place within the device itself and never involve software or share critical security parameters (such as passwords) with the host computer. Additionally, all have military grade 256-bit AES XTS encryption so firmware is locked down and can't be updated or modified, defending against malware and ensuring data remains secure and accessible only by the user.
"Across both the public and private-sectors, organizations are creating more data year-over-year, while also dealing with increased rates of breach brought on by ransomware and other cyber threats. It is more critical than ever to create a secure backup and resiliency program that includes encrypting data offline," continued Markley. "The Aegis Padlock DT has proven to be an ideal option for organizations that need to ensure their sensitive data stays secure. Apricorn is the only vendor to offer a hardware encrypted 24TB option, making it easier than ever for our customers to store staggering amounts of data securely."
Featuring the largest encrypted external USB storage capacity in its class, the Aegis Padlock DT and Aegis Padlock DT FIPS Desktop Drives offer 11 capacities ranging from 2TB, up to the new 24TB of secure storage. Fully hardware-based and 256-bit AES XTS encrypted, the Padlock DT series bolsters on-board keypad PIN authentication and ultra-fast USB 3.2 (3.0) data transfer speeds. All data is encrypted on the fly as it's being written to the drive, and the devices' PINs and data remain encrypted when the drives are at rest.
Apricorn devices provide a simple and secure method for transporting sensitive data outside the firewall or storing offline, and help companies in regulated industries adhere to compliance regulations including finance, government, power & energy, legal and healthcare. Visit http://www.apricorn.com for more information on the Aegis Padlock DT FIPS Desktop Drives.
About Apricorn
Apricorn provides secure storage innovations to the most prominent companies in the categories of finance, healthcare, education, and government throughout North America and EMEA. Apricorn products have become the trusted standard for a myriad of data security strategies worldwide. Founded in 1983, numerous award-winning products and patents have been developed under the Apricorn brand as well as for a number of leading computer manufacturers on an OEM basis.
Media ContactSarah Hawley Origin Comms t. +1 480-292-4640 e. [emailprotected]
SOURCE Apricorn
See original here:
Apricorn Introduces Industry's First 24TB Hardware Encrypted USB Drive - PR Newswire
Surviving the quantum apocalypse with fully homomorphic encryption – Help Net Security
In the past few years, an increasing number of tech companies, organizations, and even governments have been working on one of the next big things in the tech world: successfully building quantum computers.
These actors see a lot of potential in the technology. Quantum computing spreads across a wide range of disciplines both on the hardware research and application development fronts, including elements of computer science, physics, and mathematics. The goal is to combine these subjects to create a computer that utilizes quantum mechanics to solve complex problems faster than on classical computers.
Despite this description evoking images and scenarios fit for a sci-fi blockbuster, it is still hard to pinpoint what a quantum computer would do. Indeed, it seems that the only major application which people have identified is that of cryptanalysis.
Quantum computing has the potential to break cryptosystems that are the foundations of the technology protecting the privacy of data and information created and shared every day. When (and if) an applicable quantum computer is created, we will need to upgrade all our digital security protocols.
A traditional (digital) computer processes zeros and ones, so called bits. These, to a first order approximation, are represented as on/off electrical signals. A quantum computer, though, processes quantum states; these are units that can be thought of as being both zero and one at the same time. Such a state is called a quantum bit, or qubit.
If you hold n bits in a traditional computer then these n bits can represent any number between zero and 2^n-1, but a single bit can only represent one number at a time. If you had n qubits, then the quantum computer can represent EVERY number between 0 and 2^n-1 simultaneously.
The physics of quantum phenomena is counter-intuitive. For example, two qubits can be entangled so that even though they can be separated by a large distance, an operation performed on one of the entangled qubits can have an instantaneous effect on the other qubit.
This is where the privacy concern around quantum computers comes from: they not only store data differently, but also process it differently, giving users a very different form of computational model. With this model, quantum computers could be faster than traditional ones with regards to a few known tasks: unluckily, the two main tasks which quantum computers are good at are factoring large numbers and solving so-called discrete logarithm problems. I say unluckily, as it is precisely these two hard mathematical problems which lie at the base of all current security protocols on the internet.
The ability of a quantum system to solve these two mathematical problems will break the internet and all the systems we use day to day. The advent of a quantum computer and its effect on cybersecurity and data privacy is often dubbed the quantum apocalypse.
Thankfully, the advent of a suitably powerful quantum computer capable of breaking current cryptographic solutions does not yet seem to be on the horizon. But organizations and businesses that truly care about the privacy of their users and customers should start preparing for the worst by looking to integrate existing technologies and solutions in their operations and processes.
There are currently two distinct approaches to face an impending quantum apocalypse. The first uses the physics of quantum mechanics itself and is called Quantum Key Distribution (QKD). However, QKD only really solves the problem of key distribution, and it requires dedicated quantum connections between the parties. As such, it is not scalable to solve the problems of internet security; instead, it is most suited to private connections between two fixed government buildings. It is impossible to build internet-scale, end-to-end encrypted systems using QKD.
The second solution is to utilize classical cryptography but base it on mathematical problems for which we do not believe a quantum computer gives any advantage: this is the area of post-quantum cryptography (PQC). PQC algorithms are designed to be essentially drop-in replacements for existing algorithms, which would not require many changes in infrastructure or computing capabilities. NIST (the US standards institute) has recently announced standards for public key encryption and signatures which are post-quantum secure. These new standards are based on different mathematical problems, the most prominent of which is a form of noisy linear algebra, called the Learning-with-Errors problem (LWE).
NISTs standards only consider traditional forms of public key encryption and signatures. Fully homomorphic encryption (FHE) is different from traditional public key encryption in that it allows the processing of the data encrypted within the ciphertexts, without the need to decrypt the ciphertexts first.
As a first approximation, one can view traditional public key encryption as enabling efficient encryption of data in transit, whilst FHE offers efficient encryption of data during usage. Most importantly, with FHE nobody would be able to see your data but you because they wouldnt have your key.
All modern FHE encryption schemes are based on the LWE problem, thus FHE is already able to be post-quantum secure. So, if you deploy an FHE system today, then there is no need to worry about the future creation of a quantum computer.
Read the original:
Surviving the quantum apocalypse with fully homomorphic encryption - Help Net Security
Growing concenrs about quantum computers’ ability to break commonly used encryption – NL Times
There are growing concerns about quantum computers eventual ability to circumvent commonly used encryption. That could still be decades away, but 20 Members of the European Parliament, led by Dutch MEP Bart Groothuis, want organizations to start preparing themselves. The Dutch intelligence service AIVD shares the concerns, NOS reports.
Cryptographic keys are currently the most used way to prevent unauthorized persons from reading communications, from sensitive communications between governments to text messages on WhatsApp. The encryption mathematically scrambles the data. Regular computers cannot crack that key in practice because the number of possible mathematical combinations is so high. But there are growing fears that quantum computers, which work fundamentally differently, will eventually be able to do that.
Quantum computing has not reached that point yet, and Q-Day may still be decades away. But governments and critical organizations must already start protecting themselves. We see an enormous hunger for data in countries like China, the AIVD told the broadcaster. These countries are already intercepting data in the hope that theyll be able to crack the encryption at some point. It is, therefore, important that organizations whose data will still be sensitive in a few decades time to already implement quantum-safe protection. Software developers need to work on that urgently, the AVID said.
We must start this now, MEP Groothuis told the broadcaster. He initiated a public letter by 20 MEPs calling on governments and organizations to implement other ways to protect their data. We cannot take that risk. The most important organizations must start doing this now.
Switching to other algorithms that are more resistant to quantum computers will be a complicated process because both the sender and receiver must use the same technology. With a banking website, for example, both the banks web server and the web browser must support the same new technology.
Visit link:
Growing concenrs about quantum computers' ability to break commonly used encryption - NL Times
Delinea Announces Industry-First Quantum-Safe Encryption to Secure Privileged Accounts in the Post-Quantum … – PR Newswire
SAN FRANCISCO, March 19, 2024 /PRNewswire/ --Delinea,a leading provider of solutions that seamlessly extend Privileged Access Management (PAM),today announced industry-first innovation to protect organizations from threats in the post-quantum computing era with the availability of quantum-safe encryption of secrets and credentials on the Delinea Platform. Aligned to NIST standards, quantum-safe encryption on Secret Server empowers organizations to secure critical credentials from being compromised by quantum computers with one of the four NIST-recommended asymmetric algorithms, CRYSTALS-Kyber.
According to the Cybersecurity & Infrastructure Security Agency (CISA), "Quantum computing opens up exciting new possibilities; however, the consequences of this new technology include threats to the current cryptographic standards that ensure data confidentiality and integrity and support key elements of network security." The increased financial investment into quantum technology reached $2.35 billion in 2022, making the prospect of a usable quantum computermore of a potential reality than a futuristic vision. Organizations are encouraged to start preparing for the implementation of post-quantum cryptography and a quantum-readiness roadmap.
Quantum-safe encryption of secrets and credentials in the company's SaaS vault is the latest forward-thinking innovation available on the Delinea Platformto disrupt the status quo. This innovation is an example of usable security integrated into existing Privileged Access Management workflows, effectively reducing the risks associated with quantum computing.
"As quantum computers advance, we see the potential vulnerabilities with existing encryption methods posing a significant risk to data security," said Phil Calvin, Chief Product Officer at Delinea. "Quantum-safe encryption addresses this concern with NIST-recommended algorithms that can resist attacks from both classical and quantum computers."
Mitigating the Risk of Encryption-Busting Attacks
Quantum computers are predicted to have the capability to break many of the encryption algorithms currently used by organizations to secure sensitive data and communications. Quantum-safe encryption combats this concern by ensuring the long-term security of sensitive data, government communications, financial transactions, healthcare records, and other critical information assets. Incorporating quantum-safe encryption into an organization's privileged account security strategy ensures that data remains secure even when quantum computers are available.
Delinea's quantum-safe encryption leverages one of the four NIST-recommended asymmetric algorithms, CRYSTALS-Kyber, and is designed to protect an organization's most sensitive secrets with the least amount of user impact. The new QuantumLock feature, an upgrade of the current DoubleLock capability, serves as an additional layer of security for secrets to protect access, including privileged access for PAM solution administrators. This encryption will ensure valuable data is protected today and tomorrow, aligning with recommendations by CISA and NIST.
Quantum-safe encryption is available for Secret Server now on the Delinea Platform.
For more information, visit delinea.com/products.
About Delinea Delinea is a leading provider of Privileged Access Management (PAM) solutions for the modern, hybrid enterprise. The Delinea Platform seamlessly extends PAM by providing authorization for all identities, granting access to an organization's most critical hybrid cloud infrastructure and sensitive data to help reduce risk, ensure compliance, and simplify security. Delinea removes complexity and defines the boundaries of access for thousands of customers worldwide. Our customers range from small businesses to the world's largest financial institutions, intelligence agencies, and critical infrastructure companies.Learn more about Delinea onLinkedIn,Twitter, andYouTube.
Delinea Inc. 2024. Delineais a trademark of Delinea Inc. All other trademarks are property of their respective owners.
Contacts: Brad Shewmake Delinea [emailprotected] +1-408-625-4191
John Kreuzer Lumina Communications [emailprotected] +1-408-963-6418
SOURCE Delinea
Nevada’s Attack on End-to-End Encryption is an Attack on Online Safety | TechPolicy.Press – Tech Policy Press
Namrata Maheshwari is Senior Policy Counsel and Encryption Policy Lead at Access Now.
With potential repercussions for protecting privacy worldwide, Nevadas attack on end-to-end encryption (E2EE) should concern us all. The state of Nevadas Attorney General is seeking a court order restricting Meta from offering E2EE to minors using Facebook Messenger. This is, simply put, a bad idea. It is a textbook example of how good intentions, in isolation, can pave the way to bad outcomes that negatively impact civil liberties.
My organization, Access Now, joined a group of other civil society organizations, experts, and tech service providers in filing a friend-of-the-court brief to explain why removing E2EE from services such as Messenger will make children more vulnerable online, not less, while also jeopardizing everyone elses safety.
Making online spaces safer is rightly a priority for governments worldwide; but removing access to E2EE is not the way to do it. E2EE is non-negotiable for security. It ensures that no one other than the sender and intended recipient(s) of a message can access its contents, not even the platform used to send the message. In an online world where more data about each of us is generated, stored, and shared than we could ever verify, this is an incredible strength. E2EE provides individuals, including children, with a way to conduct private, even intimate conversations, to express themselves freely, to exchange sensitive information about their health or current location, or even to report abuse. If children are forced to rely on unencrypted messaging channels, unsafe from prying eyes, it could be far more dangerous for them to share their live location data, credit card or financial information, and passwords to personal accounts, to report experiences of abuse, or to reach out for assistance with sensitive healthcare matters, such as information on abortion or reproductive health.
Childrens rights organizations, such as the Child Rights International Network and Defend Digital Me, have emphasized the importance of encryption in enabling the full range of childrens rights, warning that a generalized ban on encryption would leave children vulnerable to a wide range of exploitation and abuse. They also note that the use of unencrypted messaging services can further harm already disadvantaged or marginalized children such as survivors of abuse.
Depriving minors of E2EE means depriving them of safe spaces online. In the offline world, we have private spaces for conversation. It is possible to ensure that there is no record of such conversation unless one of the parties chooses otherwise. Even when offline conversations are recorded, there are strict limitations on how, when, and why even law enforcement officials can seek access. Encryption is the boon that makes it possible to replicate this online. Without encryption, every word, image, and video recorded on the internet is susceptible to interception and potential abuse, including by law enforcement. As the UN Human Rights Council has noted, the same rights that people have offline must also be protected online, in particular freedom of expression, which is applicable regardless of frontiers and through any media of ones choice, in accordance with articles 19 of the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights.
In seeking to ban encryption and thus infringe on individuals right to communicate privately Nevada is at odds with global best practices, which increasingly recognize that generalized surveillance is anathema to human rights. The office of the UN Special Rapporteur on the Freedom of Expression has long recognized the importance of encryption, urging states not to compel platforms to compromise communications privacy and security by prohibiting encryption. Courts elsewhere are also rejecting mandates for the generalized surveillance enabled by removing encryption. The European Court of Human Rights recently rejected a Russian government request for Telegram and other communication service providers to enable decryption and to store users communication; essentially the same as not providing E2EE at all. And the African Commission on Human and Peoples' Rights has adopted a resolution calling on states to promote privacy-enhancing technologies and desist from prohibiting or weakening encryption.
It is widely accepted that any restrictions on human rights must meet the thresholds of necessity and proportionality. This means that measures imposed to achieve a particular aim must be effective, using the least intrusive methods possible. A blanket ban on E2EE for all Messenger users under the age of 18 fails on all these counts. It will not make children safer, and will rather expose their data to intrusions and misuse.
E2EE should be available by default, rather than users needing to opt-in a long-standing feature in Signal, Apples iMessage, and Metas WhatsApp, and one that Messenger introduced in late 2023. EE2E by default aligns with data protection and privacy-by-design best practices, by removing the burden from users to actively seek out the opt-in setting. This is particularly important when it comes to protecting the data of vulnerable individuals, such as children, who may be even less likely than most people to change their default privacy settings. Opt-out website options are criticized because they make rampant data collection the norm and privacy the exception that a user must actively seek out. Similarly, on messaging platforms, an opt in for encryption disadvantages the user, and merely offers plausible deniability to the platform to scour personal information and place the blame on the user for not opting in.
If the Nevada Attorney General gets his way, it could also set a dangerous precedent in emboldening other governments, within and beyond the US, to ban E2EE in the name of child safety. Nevadas courts must reject the states motion, not only to protect encryption and childrens rights at home, but also to set a strong precedent, in the domestic and international context. This will prevent others elsewhere from making such blatantly rights-harming demands, tone-deaf to global support for encryption, and strikingly at odds with fundamental human rights.
See the original post here:
Nevada's Attack on End-to-End Encryption is an Attack on Online Safety | TechPolicy.Press - Tech Policy Press
Court asked to block Nevadas request to stop encrypted messaging on Facebook Messenger – Identity Week
Nevadas attorney general who escalated a request to the court to ban Metas use of encryption for Facebook Messenger users under 18 has faced opposition from the Electronic Frontier Foundation and other organisations which argue that childrens privacy must be protected by such measures.
The brief, opposing a potential ban, was submitted by the American Civil Liberties Union, the ACLU of Nevada, the Stanford Internet Observatory Research Scholar Riana Pfefferkorn and gained more signatures of support.
After years of lobbying for end-to-end encryption in Facebooks Messenger app, the EFF is concerned that Meta could be influenced into making an ill-advised U-turn on privacy, whilst the pressure on social media companies to do more to protect childrens safety online increases.
More than ever, social media companies are subject to rules imposed by jurisdictions, such as implementing age verification and encrypting communications.
Bizarrely, Nevada wants to take steps back to ignoring the threats towards our data.
Andrew Crocker, EFF Surveillance Litigation Director suggested the proposal was illogical, arguing that encryption is the best tool we have for safeguarding our privacy and security online and privacy and security are especially important for young people.
Nevadas argument that children need to be protected from securely communicating isnt just baffling; its dangerous.
Rather than having ownership of Facebook users data, encryption protects against the threats of third parties intercepting messages whether they are a criminal, domestic abuser, a foreign despot, or law enforcementthey will not be able to decipher or access the message.
Nevada is peddling the argument that ending end-to-end encryption on Messenger is necessary as it can impede on criminal investigations.
Read this article:
Court asked to block Nevadas request to stop encrypted messaging on Facebook Messenger - Identity Week
European MPs sound alarm over quantum computing’s encryption threat – Innovation Origins
European MPs caution against the impending quantum computing revolution, which promises to undermine current encryption safeguards. Experts echo this urgency, warning that existing security measures for sensitive data are on borrowed time. With quantum computers inching closer to breaking mathematical keys and countries like China showing an insatiable appetite for data, the race is on to develop quantum-safe products.
The specter of quantum computing, with its potential to crack the cryptographic keys that protect everything from personal emails to state secrets, casts a long shadow over the digital world. European MPs, led by Dutch MP Bart Groothuis, have sounded a clarion call in a letter they sent to the European Commission: the cryptography underpinning our computer security systems is a ticking time bomb. This alarm is not unfounded. With quantum computings ability to process complex calculations at breakneck speeds, the security protocols we rely on today could be rendered obsolete almost overnight.
Quantum computing is set to disrupt our computing possibilities, fundamentally disrupting computation. However, quantum computing doesnt come without its own risks, as it has the potential to undermine current data encryption safeguards.
Quantum computers differ radically from todays computers. They utilize qubits, which, through superposition, can represent both one and zero simultaneously. This fundamental change in computation allows quantum computers to solve specific problemslike factoring large numbers, the basis of much of our encryptionexponentially faster than classical computers. When a quantum computer with enough stable qubits comes online, it could break the RSA-2048 encryption, a standard for securing web traffic, within a day. The more optimistic estimates give this scenario an 11 percent chance of occurring within the next five years, a figure that rises to a worrying 33 percent over the next fifteen years.
Quantum technology professor Pepijn Pinkse: The best time to get quantum security right was yesterday.
His inaugural lecture took place early last month; in practice, Pepijn Pinkse has been working as a professor of quantum technology at the University of Twente (UT) for several years. His lecture focused on creating awareness around quantum security and the threat posed by quantum technology. The best time to get quantum security right was yesterday, he said.
In a letter that underscores the gravity of the situation, MEPs laid out the stark timeline we face: switching to a new cryptographic standard could take over a decade, paralleling past transitions like the adoption of the SHA2 hashing algorithm and the AES symmetrical algorithm. The letter implores major organizations to begin preparations immediately for a complete post-quantum cryptography (PQC) transition. The National Institute of Standards and Technology (NIST) in the United States has already identified algorithms for this purpose, with choices like CRYSTALS-Kyber for public key encryption and CRYSTALS-Dilithium, FALCON, and SPHINCS+ for digital signatures.
The MEPs letter recommends that the European Commission, alongside bodies such as the European Union Agency for Cybersecurity (ENISA), the European Data Protection Supervisor (EDPS), and the European Data Protection Board (EDPB), offer clear guidance on what constitutes appropriate security measures in anticipation of quantum capabilities. The MEPs suggest this should include inventorying current algorithms, assessing new cryptographic libraries, deploying hybrid encryption systems, and beginning a phased deployment of NIST-approved standards.
Largest investment in Dutch quantum company to date
Dutch quantum company QphoX has raised a 8 million funding round in a major development for the countrys fast-growing quantum industry. It is the largest investment in a quantum company in the Netherlands to date.
Professor Pepijn Pinkse, a quantum technology expert, previouslypep warned about the risks of quantum computing security. Pinkses work underscores the fundamental shift required in our approach to cryptography. Most current cryptography relies on the difficulty of reversing the multiplication of large prime numbers. Quantum computing, particularly using the Shor algorithm, could make that reversal trivial. Pinkse and other experts indicate that Q-Daywhen current cryptographic security systems capitulate to quantum computingis less than a decade away.
Indeed, the quest to build a quantum computer is not just a scientific challengeits a geopolitical one. The past decade has seen a quadrupling in the number of companies actively developing quantum computing hardware. Investment in the field has been substantial, with multiple funding rounds in the quantum computing market exceeding $100 million between 2022 and 2024. National laboratories and supercomputing centres, often driven by government interest, are pouring resources into early-stage machines. The implications for economic and national security are profound.
It remains to be seen how the European Unions institutions and member states will react to the MEPs letter. Will they heed the warnings and start the necessary transitions to safeguard against the quantum threat? The clock is ticking, and as the MEPs letter makes clear, the time to act is nowbefore the quantum revolution undoes the digital security weve come to rely on.
Continue reading here:
European MPs sound alarm over quantum computing's encryption threat - Innovation Origins
1024-bit RSA keys for Windows will soon be no more – TechRadar
Certificates with RSA keys shorter than 2048 will soon no longer be supported by Windows, Microsoft has announced.
This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows, the software giant said in the announcement, part of its latest Deprecated features for Windows client list.
RSA keys are an essential part of the Rivest-Shamir-Adleman (RSA) encryption algorithm, a widely used tool for secure communication over the internet. The longer the keys, the stronger they are.
The older, 1024-bit keys have roughly 80 bits of strength, while the new ones have 112 bits, which makes them four billion times longer, BleepingComputer explains. These keys should be safe until 2030, at least.
Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer, Microsoft explained.
Companies using older software and hardware could run into trouble, as these tools will probably no longer work.
Microsoft did not give a hard date on when the older keys will no longer be valid, but it is safe to assume that the transition will be somewhat slower and will allow organizations to adapt and replace older software and hardware. In an effort to achieve a seamless transition, the company said TLS certificates issued by enterprise or test certification authorities will not be affected.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change," Microsoft said. "However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.
Follow this link:
1024-bit RSA keys for Windows will soon be no more - TechRadar
Hackers can read private AI assistant chats even though they’re encrypted – Ars Technica
Aurich Lawson | Getty Images
AI assistants have been widely available for a little more than a year, and they already have access to our most private thoughts and business secrets. People ask them about becoming pregnant or terminating or preventing pregnancy, consult them when considering a divorce, seek information about drug addiction, or ask for edits in emails containing proprietary trade secrets. The providers of these AI-powered chat services are keenly aware of the sensitivity of these discussions and take active stepsmainly in the form of encrypting themto prevent potential snoops from reading other peoples interactions.
But now, researchers have devised an attack that deciphers AI assistant responses with surprising accuracy. The technique exploits a side channel present in all of the major AI assistants, with the exception of Google Gemini. It then refines the fairly raw results through large language models specially trained for the task. The result: Someone with a passive adversary-in-the-middle positionmeaning an adversary who can monitor the data packets passing between an AI assistant and the usercan infer the specific topic of 55 percent of all captured responses, usually with high word accuracy. The attack can deduce responses with perfect word accuracy 29 percent of the time.
Currently, anybody can read private chats sent from ChatGPT and other services, Yisroel Mirsky, head of the Offensive AI Research Lab at Ben-Gurion University in Israel, wrote in an email. This includes malicious actors on the same Wi-Fi or LAN as a client (e.g., same coffee shop), or even a malicious actor on the Internetanyone who can observe the traffic. The attack is passive and can happen without OpenAI or their client's knowledge. OpenAI encrypts their traffic to prevent these kinds of eavesdropping attacks, but our research shows that the way OpenAI is using encryption is flawed, and thus the content of the messages are exposed.
Mirsky was referring to OpenAI, but with the exception of Google Gemini, all other major chatbots are also affected. As an example, the attack can infer the encrypted ChatGPT response:
as:
and the Microsoft Copilot encrypted response:
is inferred as:
While the underlined words demonstrate that the precise wording isnt perfect, the meaning of the inferred sentence is highly accurate.
Weiss et al.
The following video demonstrates the attack in action against Microsoft Copilot:
Token-length sequence side-channel attack on Bing.
A side channel is a means of obtaining secret information from a system through indirect or unintended sources, such as physical manifestations or behavioral characteristics, such as the power consumed, the time required, or the sound, light, or electromagnetic radiation produced during a given operation. By carefully monitoring these sources, attackers can assemble enough information to recover encrypted keystrokes or encryption keys from CPUs, browser cookies from HTTPS traffic, or secrets from smartcards.The side channel used in this latest attack resides in tokens that AI assistants use when responding to a user query.
Tokens are akin to words that are encoded so they can be understood by LLMs. To enhance the user experience, most AI assistants send tokens on the fly, as soon as theyre generated, so that end users receive the responses continuously, word by word, as theyre generated rather than all at once much later, once the assistant has generated the entire answer. While the token delivery is encrypted, the real-time, token-by-token transmission exposes a previously unknown side channel, which the researchers call the token-length sequence.
Continued here:
Hackers can read private AI assistant chats even though they're encrypted - Ars Technica