Cryptography for dummies
Source: Bruce
To the alarm of some lawmakers, scrambling data becomes easy as encryption turns into the default option on digital devices.
A CAMPAIGN by American and British lawmakers and security officials to get social-media companies to take more responsibility for handing over information about criminals and terrorists using their networks gathered pace this week. It is happening because, following the documents leaked by Edward Snowden, a former American spy, technology companies are beefing up the encryption of data to protect users’ privacy, making it more difficult for law-enforcement agencies to find out what people have been up to online.
In Britain, a report into the jihadi-inspired killing of a soldier in London said websites such as Facebook provide a “safe haven for terrorists” to communicate. Such statements echo similar concerns made in America. James Comey, the director of the FBI, has said the encryption of computers, smartphones and other digital gadgets largely benefits paedophiles, criminals and terrorists.
This is not how technology firms see it. Apple and Google, for instance, say they are making their mobile operating systems more secure because people and businesses want their data to be protected. This encryption is not only robust but often cannot be disabled. Moreover, it may require little or no effort on the part of a user to render data stored on their devices or being sent to another person impossible for all but the most determined governments or criminal organisations to retrieve.
This is a big change. In the past built-in security, if provided, was often easily subverted. Most devices and software came with the doors wide open and only geeks knew how to shut them. Now, although plenty of users may not be aware of it, spying on them is getting harder.
This is not universal. Applications and data that are stored online in the cloud, for instance, might still be accessible by third parties, although the links to and from them have been locked down. Routinely encrypting attachments in e-mails also remains something of a work-in-progress.
Many of the elements used to provide this greater level of privacy have long been available for users of specific systems. Apple, for instance, has encrypted all data passing through its FaceTime and iMessage applications since their inception.
Securing it
Now WhatsApp, an instant-messaging service with more than 600m users, has adapted a highly regarded open-source system called TextSecure for its app running on Android-based devices. WhatsApp, which is owned by Facebook, provides the new security in a routine update which reduces almost to zero the possibility of messages being intercepted or decrypted. Moxie Marlinspike, one of TextSecure’s developers, says the software was designed to be simple to add to apps. WhatsApp now plans to extend it to devices using other operating systems.
Earlier this month, Facebook itself launched what it describes as an experiment to improve access to its service using the Tor network, which makes it possible to surf the internet virtually anonymously. Such connections are already possible but Facebook says it wants to make them more secure. This could appeal to users in countries such as China and Iran where access to Facebook is blocked.
Protecting information stored on a device is also becoming easier. Apple and Microsoft have offered full-disk encryption (FDE) for their desktop operating systems for years, in which a user’s login or other token unlocks an encryption key that is then used for all data read from and written to a disk drive. Destroy the key, and the disk’s data is unreadable for ever. FDEs were fiddly and slow, but now can be turned on during a software upgrade with only a mouse click. Faster processors and custom-made chips also eliminate slowdowns. Android, Apple’s iOS and other mobile platforms adopted similar forms of encryption a few years ago but the protection has only recently become complete.
The new level of security builds on efforts by hardware- and software-makers to divorce themselves from the ability to decipher or recover users’ data from mobile devices. As Tim Cook, Apple’s boss, said recently: “If the government laid a subpoena to get iMessages, we can’t provide it. It’s encrypted and we don’t have a key.”
Apple’s Touch ID fingerprint-recognition on iPhones or iPads is a further example. Rather than having its data reside in the normal memory of those devices, or have it sent to a secure repository in the cloud, Apple developed custom circuitry it calls Secure Enclave. This incorporates into its processors a way to stash scrambled data into a one-way memory cache that neither the operating system (nor Apple) can directly access.
Bruce Schneier, a veteran American cryptographer and security expert, says robust, configuration-free encryption by itself is not new. Rather it is the additive effect of its much broader implementation by more and more people that makes the change powerful. This is being driven, he believes, by people and companies paying more attention to what is happening to their data following Mr Snowden’s revelations about the extent of the surveillance programmes run by America’s National Security Agency. There have also been reports of snooping by firms, invasion of privacy by criminals and lax treatment of payment details and personal data.
This heightened public concern about privacy has overcome stalled efforts in some corners of the internet to deploy encryption, validation and anti-tampering options that had been left idle. Often cost and complexity were cited as reasons by companies not to bother, except for e-commerce, financial transactions and health data. As Mr Schneier notes, the Secure Sockets Layer and Transport Layer Security standards used to protect web-browsing for e-commerce date back to the late 1990s, and have been strengthened continuously since. (Separate and significant flaws in various software implementations of the standard across all major operating systems were found and fixed in 2014, most before being exploited.)
Now secure web-browsing is about to go much further. On November 18th the Electronic Frontier Foundation (EFF), a privacy advocacy group, announced the formation of a new consortium with members including Cisco, which makes networking equipment, Mozilla, producer of the Firefox browser, and Akamai, a leading cloud-computing and content-delivery network. The group has created a standardised process called Let’s Encrypt for websites and other online services to secure their systems automatically and at no cost. The service, planned for release in mid-2015, will offer a simple installation process in which web operators will apply to receive digital certificates that can be used to prevent the interception of information when it is passing between a web browser and an internet server.
Closed by default
Let’s Encrypt will also renew a digital certificate on its expiration without any administrative intervention―a common failing even for large e-commerce and content sites. One of the project’s leaders, Peter Eckersley of EFF, says of Let’s Encrypt and other efforts, that “Within a year or two, if we complete these projects successfully, internet users should have their browsing, their e-mail and their messaging encrypted in most or all cases by default.”
While clamping down on the passage of unencrypted data makes monitoring or intercepting it harder for profit or malicious intent, not all avenues will be closed to the FBI and others. WhatsApp and iMessage offer end-to-end or peer-to-peer encryption, but a secure web interaction still terminates on a server somewhere in a data centre, where the data is decrypted to be acted upon. Apple, for instance, sets up encrypted connections by default to its e-mail servers, but the e-mail itself may be read by those at Apple with access, and turned over if required to authorities armed with the necessary legal niceties. Likewise, data stored in the cloud passes to and from Dropbox, Google Drive and other services with strong encryption and is scrambled when it is stored. But those services encrypt the data on their servers using keys that they control, not their users.
The EFF’s Mr Eckersley says that the various efforts now in place, along with improvements that are coming and those planned for the future, do not prevent interception by authorities or others completely. “Rather, we might have a chance to protect everyone else who isn’t being targeted for surveillance,” he adds.
| }
|