Blog

<p>Very recently we have seen some progress in the cryptanalysis of Elliptic curves. <a href="https://listserv.nodak.edu/cgi-bin/wa.exe?A2=NMBRTHRY;7ac99539.1501" target="_blank">This Austrian group</a> have reportedly broken an elliptic curve at the 113-bit level of security, using 10 FPGAs.</p> <p>Before proceeding lets put a number against “security level”. Consider the Advanced Encryption Standard (AES) with a 128-bit random key. Lets call this AES-128. Now for elliptic curves we need twice as many bits for the same level of security. So a 256-bit curve is roughly comparable with AES-128.</p>…

<p><img src="./miracl-blog-download4.jpg" alt="miracl-blog-download4"></p> <p><strong>We authenticate ourselves multiple times every day. Every time we open a door with a key we are authenticating ourselves to the building we are entering, simply by demonstrating possession of the key. When we buy something with a bankcard we authenticate ourselves via possession of the card and knowledge of the associated PIN. This is known as two factor authentication. We use passports to authenticate ourselves when we travel. Sometimes we authenticate by simply recognising each other, although this is not a very scalable method. Failure to authenticate quickly or accurately can have fatal consequences – in the American Civil War the famous confederate General Stonewall Jackson was killed by his own troops for failing to authenticate himself.</strong></p>…

<p>Cryptography is a lot about trust. And in the real world cryptography depends on standards, as the standardization of cryptographic algorithms is how cryptography is projected into the real world.</p> <p>For years people have trusted the US based NIST – National Institute for Standards in Technology, with headquarters in Gaithersburg just outside Washington DC. I was there once at a conference*.</p> <p>But now thanks to the reckless actions of the NSA (National Security Agency), as exposed by various whistle-blowers, that trust has been blown, with incalculable consequences. Already there is a strong and well founded suspicion that at least one standard was “dumbed-down” to suit the NSA agenda.</p>…

<p>Several super high profile smash and grab attacks on global scale cloud service providers have prompted stronger authentication to be deployed on Google, Twitter, Evernote and many more providers. The balance between user friendliness and credible security is a key issue for these providers or any web site owner needing to increase secure authentication. There is no point in making the service exorbitantly difficult to use of course. When looking at the security they choose, however it raises the question why they would bother at all! In the interest to make things easy for users the secure authentication systems they deploy aren’t actually secure. Perhaps it’s just cost. Adding strong user authentication to any service is naturally a cost issue.</p>…