Category Archives: Encryption
What Is Zero-Knowledge Encryption, and Why Should I Choose It? – How-To Geek
Thapana_Studio/Shutterstock.com
Keeping your important data safe is an essential part of modern life, and encryption plays a big part in that. Zero-knowledge encryption, if done properly, is just about the best security method you can choose.
Encryption is a security process that alters readable data to make it unreadable. It takes plaintext, data readable by humans, and transforms it into ciphertext, which is unreadable by humans or machines. Only someone with the correct decryption key can convert the data back into plaintext and view it in its unscrambled form. Anyone else, who perhaps managed to intercept the data, would see only gibberish.
There are several different types of encryption methods available, each used for keeping data safe in different situations. The most common encryption type or protocol is Advanced Encryption Standard (AES). AES comes in three increasing security strengths, AES-128, AES-192, and AES-265. All of these are very secure, but AES-265 is considered military-grade encryption.
You likely use encrypted services several times a day, even if you dont realize it. But encryption is only as strong as the password or key used to secure it. So, justbecause something is encrypted, that doesnt mean it is completely safe. This is where zero-knowledge encryption comes into play. But what is zero-knowledge encryption, how does it work, and why should you choose it?
Zero-knowledge encryption is a method of encryption, rather than an encryption protocol such as AES-256. The term most often describes an encryption process where your data is secured at all times, with only you having the key or password needed to access and decrypt it.
For a service to be truly zero-knowledge, your data should be encrypted before it leaves your device, during transfer, and when it is stored on a server. These three stages are known as client-side encryption, encryption in transit, and encryption at rest, respectively. This will normally mean different encryption methods, including TLS and AES or an alternative, are used in combination to provide overall encryption.
Zero-knowledge encryption also requires that your password, which is the key to being able to decrypt the data, is never stored anywhere it could be accessed by a third party.Because only you have the password needed to decrypt the data, neither the service provider nor anyone who infiltrates the service can read it at any stage. Hence, zero-knowledge.
But how can your password be verified as being correct by a service provider if only you know it? That is where zero-knowledge proof comes in.
Zero-knowledge encryption and zero-knowledge proof are different concepts. Although zero-knowledge proof is often part of a service that promises zero-knowledge encryption, that isnt always the case.
Zero-knowledge proof is a cryptographic authentication method between two or more parties. During a standard authentication process, a password might be given as proof of the holders right to access data. The trouble is that the password needs to be known by both parties for it to be verified. This obviously makes it less secure.
In zero-knowledge proof authentication, only proof of knowledge of the password is needed, so the actual password is never revealed. Proving knowledge is achieved by the prover (you) answering a series of interactive or non-interactive challenges from the verifier (the service provider).
A real-world comparison is when you are asked to supply the 3rd, 5th, and 9th letters of your password to verify login to a banking app. Only someone who knows the full password would know which letters to provide, yet the actual password is not revealed.
In most situations, such as logging in to a password manager app, you wont actually need to answer questions or challenges to verify yourself. You will just need to enter your password. The zero-knowledge proof part of the process will be handled in the background by complex mathematical algorithms.
Zero-knowledge encryption has been around for a while, but its use has increased in the last few years. This is particularly true for consumer data storage services.
Any digital service that locks data behind a password login could use zero-knowledge encryption. The two most common services that offer zero-knowledge encryption are cloud storage services and password manager apps.
In fact, zero-knowledge encryption is increasingly being used to secure cloud storage. As mentioned earlier, this encryption method only works properly if the data is encrypted before leaving your computer, during transit, and when in the storage vault. That means true zero-knowledge cloud storage will be accessed through an app or desktop client, rather than through a browser interface.
Password manager apps are another place where zero-knowledge encryption makes perfect sense. When trusting all of your passwords to a single app or service, knowing that not even the service provider can access them unencrypted goes a long way. The best password managers will encrypt your passwords before they are even stored in the app or client, not just when they are stored in the cloud.
Although it is one of the most secure ways to protect your data, zero-knowledge encryption isnt without its downsides.
The most obvious potential problem is that there is often no way for you to retrieve your password if you lose or forget it. Your data will be lost, stuck behind an impenetrable barrier. Some services that use zero-knowledge encryption let you create a recovery key, which will allow you to reset your password once. However, this just moves the problem back one step, and if you lose the recovery key you will be in the same situation.
Zero-knowledge encryption can result in a service being slower than it might be with other security measures in place. The extra security and encryption steps needed can mean that something like cloud storage isnt as fast as it would be without zero knowledge being used. The loss of speed will probably be, for most people, outweighed by the extra security, but it is still worth considering.
Services that use zero-knowledge encryption might also lack some of the features offered by similar services that dont use it. For example, you might be unable to preview images or videos stored in a backup vault because that would require the data to be decrypted. In this case, you have to decide if convenience is more important to you than security.
Many big names in cloud storage offer zero-knowledge services. These include Sync.com, MEGA, pCloud, IDrive, and icedrive. Likewise, some of the best password manager services protect your data with this type of encryption, from NordPass to LastPass. As we spend more and more time in the cloud, entrusting our data security to others, we can only hope that more services get on board with zero-knowledge encryption.
Because, despite the few potential downsides, zero-knowledge encryption is the best choice if you care about the security of your data. By taking complete control of who can access and view your data, be it in a password manager, cloud storage, or another service, you remove the only realistic way it can be compromised.
Best Free Password Manager
Best Paid Password Manager
Best Password Manager and VPN Combo
One of the Best Password Managers
Best Offline Password Manager
Here is the original post:
What Is Zero-Knowledge Encryption, and Why Should I Choose It? - How-To Geek
Bluefin Announces Partnership with Waystar to Deliver Advanced Payment Security Solution in Healthcare Payments – PR Web
Bluefin and Waystar Partner for Advanced Payment Security
ATLANTA and LOUISVILLE, Ky. (PRWEB) July 12, 2022
Bluefin, the recognized integrated payments leader in encryption and tokenization technologies that protect payments and sensitive data, and Waystar, the leading provider of healthcare payments software, have partnered to provide Bluefins PCI-validated point-to-point encryption (P2PE) solution and payment gateway through Waystars software.
Healthcare data breaches hit an all-time high in 2021 tripling compared to 2018 and impacting 45 million patients and healthcare organizations are focused more than ever on increasing payment and data security.
To advance the industrys ability to meet growing cybersecurity challenges, the combined solution will provide Bluefins integrated payment processing with PCI-validated P2PE through Waystars HITRUST-certified healthcare payments platform, ensuring complete data security across all points of the patient financial experience, from patient access to key revenue cycle areas, like central business offices.
Bluefins PCI-validated P2PE solutions immediately encrypt payment data upon tap, dip, swipe, or key entry in a P2PE certified device, with encryption being done outside of the healthcare environment by Bluefin. Benefits include reduced PCI compliance scope, cost savings and protection of the healthcare brand.
We have always been committed to safeguarding the privacy of payment information for providers and patients, said Matt Hawkins, CEO, Waystar. When data and payments are secure, providers are able to focus on what matters most caring for their patients and communities.
Named a 2022 Fortress Cyber Security award winner in the data protection category, Bluefin provides their payment and data security technologies as integrated and stand-alone solutions. The companys PayConex payment gateway includes PCI-validated P2PE for point-of-sale payments and their ShieldConex data security platform for the vaultless tokenization of Personally Identifiable Information (PII), Protected Health Information (PHI), financial information, and automatic clearing house (ACH) account data entered online.
In an industry where security breaches and ransomware attacks are rising, payment protection is non-negotiable, said John M. Perry, Bluefin CEO. Our PayConex gateway ensures that all payments across Waystars platforms are backed by the gold standard of payment security, PCI-validated P2PE. We applaud Waystar for leading healthcare payment cybersecurity and implementing this solution to secure the data of providers and their patients.
About Bluefin
Bluefin is the recognized integrated payments leader in encryption and tokenization technologies that protect payments and sensitive data. The companys product suite includes solutions for contactless, face-to-face, call center, mobile, eCommerce and unattended payments and data in the healthcare, higher education, government, and nonprofit industries. The companys 200 global partners serve 20,000 enterprise and software clients operating in 47 countries. For more information, visit http://www.bluefin.com.
About Waystar
Waystar delivers innovative technology that simplifies and unifies healthcare payments via a cloud-based platform to help healthcare providers across all care settings streamline workflows, improve financial performance and bring more transparency to the patient financial experience. Waystar solutions have been named Best in KLAS or Category Leader by KLAS Research 16 times (across multiple product categories) and earned multiple #1 rankings from Black Book Research. The Waystar platform is used by more than 500,000 providers, 1,000 health systems and hospitals, and 5,000 payers and health plansand integrates with all major hospital information and practice management systems. On an annual basis, Waystars AI-powered solutions process $5B in patient payments, generate $4B in out-of-pocket estimates and process claims representing approximately 40% of the U.S. patient population. For more information, visit http://www.waystar.com or follow @Waystar on Twitter.
Share article on social media or email:
Original post:
Bluefin Announces Partnership with Waystar to Deliver Advanced Payment Security Solution in Healthcare Payments - PR Web
This Is the Code the FBI Used to Wiretap the World – VICE
Hacking. Disinformation. Surveillance. CYBER is Motherboard's podcast and reporting on the dark underbelly of the internet.
The FBI operation in which the agency intercepted messages from thousands of encrypted phones around the world was powered by cobbled together code. Motherboard has obtained that code and is now publishing sections of it that show how the FBI was able to create its honeypot. The code shows that the messages were secretly duplicated and sent to a ghost contact that was hidden from the users contact lists. This ghost user, in a way, was the FBI and its law enforcement partners, reading over the shoulder of organized criminals as they talked to each other.
Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. Anom was marketed to criminals, and ended up in the hands of over 300 criminal syndicates worldwide. The landmark operation has led to more than 1,000 arrests including alleged top tier drug traffickers and massive seizures of weapons, cash, narcotics, and luxury cars.
Motherboard has obtained this underlying code of the Anom app and is now publishing sections of it due to the public interest in understanding how law enforcement agencies are tackling the so-called Going Dark problem, where criminals use encryption to keep their communications out of the hands of the authorities. The code provides greater insight into the hurried nature of its development, the freely available online tools that Anoms developers copied for their own purposes, and how the relevant section of code copied the messages as part of one of the largest law enforcement operations ever.
Do you know anything else about Anom? Were you a user? Did you work for the company? Did you work on the investigation? Are you defending an alleged Anom user? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or emailjoseph.cox@vice.com.
The key part of the Anom app is a section called bot.
The app uses XMPP to communicate, a long-established protocol for sending instant messages. On top of that, Anom wrapped messages in a layer of encryption. XMPP works by having each contact use a handle that in some way looks like an email address. For Anom, these included an XMPP account for the customer support channel that Anom users could contact. Another of these was bot.
Unlike the support channel, bot hid itself from Anom users contact lists and operated in the background, according to the code and to photos of active Anom devices obtained by Motherboard. In practice the app scrolled through the users list of contacts, and when it came across the bot account, the app filtered that out and removed it from view.
That finding is corroborated by law enforcement files Motherboard obtained which say that bot was a hidden or ghost contact that made copies of Anom users messages.
Authorities have previously floated the idea of using a ghost contact to penetrate encrypted communications. In a November 2018 piece published on Lawfare, Ian Levy and Crispin Robinson, two senior officials from UK intelligence agency GCHQ, wrote that Its relatively easy for a service provider to silently add a law enforcement participant to a group chat or call, and You end up with everything still being end-to-end encrypted, but theres an extra end on this particular communication.
The code also shows that in the section that handles sending messages, the app attached location information to any message that is sent to bot. On top of that, the AndroidManifest.xml file in the app, which shows what permissions an app accesses, includes the permission for ACCESS_FINE_LOCATION. This confirms what Motherboard previously reported after reviewing thousands of pages of police files in an Anom-related investigation. Many of the intercepted Anom messages in those documents included the precise GPS location of the device at the time the message was sent.
In some cases, police officers reported that the Anom system failed to record those GPS locations correctly, but that authorities believe the coordinates are generally reliable as they have in some cases been matched with other information such as photos, according to those police files.
A lot of the code for handling communications was apparently copied from an open source messaging app.
The code itself is messy, with large chunks commented out and the app repeatedly logging debug messages to the phone itself.
Cooper Quintin, a senior staff technologist at activist organization the Electronic Frontier Foundation (EFF), didnt think it was unusual for developers to use other modules of code found online. But he did find it bonkers that the FBI used ordinary developers for this law enforcement operation.
This would be like if Raytheon hired the fireworks company down the street to make missile primers, but didnt tell them they were making missile primers, he said in a phone call. I would typically assume the FBI would want to keep tighter control on what theyre working on, such as working with inhouse computer engineers who had security clearance and not bringing in people who are unknowingly taking down criminal organizations, he added. (One reason for the use of third-party developers was that Anom already existed as a company in its own right, with coders hired by the companys creator who worked on an early version of the app, before the FBI became secretly involved in Anoms management).
Recently courts in Europe and Australia have seen the next step of the Anom operation: the prosecution of these alleged criminals with Anom messages making up much of the evidence against them. Defense lawyers in Australia have started legal requests to obtain the code of the Anom app itself, arguing that access to the code is important to determine that the messages being presented in court by the prosecution are accurate. The Australian Federal Police (AFP) has refused to release the code.
Anybody who has been charged with an offence arising from messages that are alleged to have been made on the so called Anom Platform has a clear and obvious interest in understanding how the device worked, how anyone was able to access these messages and most importantly whether the original accessing and subsequent dissemination of these messages to Australian authorities was lawful, Jennifer Stefanac, an Australian solicitor who is defending some of the people arrested as part of Operation Ironside, the Australian authorities side of the Anom operation, told Motherboard in an email.
A second lawyer handling Anom related cases said they didn't think the Anom code would be of much relevance to defendants cases. A third said they saw why defendants may seek access to the code, but that they believed it shouldnt be publicly available.
When asked for comment, the San Diego FBI told Motherboard in a statement that We appreciate the opportunity to provide feedback on potentially publishing portions of the Anom source code. We have significant concerns that releasing the entire source code would result in a number of situations not in the public interest like the exposure of sources and methods, as well as providing a playbook for others, to include criminal elements, to duplicate the application without the substantial time and resource investment necessary to create such an application. We believe producing snippets of the code could produce similar results.
Motherboard is not publishing the full code of Anom. Motherboard believes the code contains identifying information on who worked on the app. Most of the people who worked on the Anom app were not aware it was secretly an FBI tool for surveilling organized crime, and exposing their identities could put them at serious risk. Motherboard will not be releasing the app publicly or distributing it further.
Motherboard previously obtained one of the Anom phones from the secondary market after the law enforcement operation was announced. In that case, the phone had a locked bootloader, meaning it was more difficult to extract files from the device. For this new analysis of the code, a source provided a copy of the Anom APK as a standalone file which Motherboard then decompiled. Motherboard granted multiple sources in this piece anonymity to protect them from retaliation.
Decompiling an app is an everyday process used by reverse engineers to access the code used to construct an app. It can be used to fix problems with the software, find vulnerabilities, or generally to research how an app was put together. Two reverse engineering experts corroborated and elaborated upon Motherboards own analysis of the app.
Operation Trojan Shield has been widely successful. On top of the wave of arrests, authorities were also able to intervene using the messages and stop multiple planned murders. In June to mark the one year anniversary of the operations announcement, the AFP revealed it has shifted some of its focus to investigating thousands of people suspected of being linked to Italian organized crime in Australia and that it is working with international partners.
Subscribe to our cybersecurity podcast,CYBER. Subscribe toour new Twitch channel.
See the article here:
This Is the Code the FBI Used to Wiretap the World - VICE
Quantum Cryptography and Encryption Market Size, Share 2022: Emerging Technologies, Sales Revenue, Key Players Analysis, Development Status, and…
Global Quantum Cryptography and Encryption Market by Types, Application Outlook, Companies, and By Geography (Asia-Pacific, North America, Europe, South America, and the Middle East & Africa), Segments, and Forecasts from 2022-2028
The Quantum Cryptography and Encryption market research combines a thorough examination of current and future potential to forecast future development in the Quantum Cryptography and Encryption industry. This research examines the Quantum Cryptography and Encryption industry from top to bottom, covering enabling technologies, major trends, market dynamics, difficulties, standardization, regulatory environment, potential, future guidance, value network, ecosystem participant profiles, and approaches. This research, which provides industry chain structure, business strategies, and ideas for new project investments, is a significant source of support for organizations and individuals. The Quantum Cryptography and Encryption Market research also examines key market inhibitors and motivators in both quantitative and qualitative ways to provide reliable information to end-users.
Get a Full PDF Sample Copy of the Report: (Including Full TOC, List of Tables and Figures, and Chart) at https://www.eonmarketresearch.com/sample/92399
Quantum Cryptography and Encryption Market Segmentation
Quantum Cryptography and Encryption Market Competitor Outlook, this report covers ID Quantique, Qrypt, Single Quantum, Post-Quantum, Crypto Quantique, CryptoNext Security, Quantum Resistant Ledger, InfiniQuant, Agnostiq, ISARA Corporation, KETS Quantum Security, MagiQ Technologies, PQShield, Qabacus, Qaisec, Qasky Quantum Technology
Product Type Outlook (Revenue, USD Billion; 2022 2028) Code-based, Lattice-based, Others
Application/ End-user Industry Outlook (Revenue, USD Billion; 2022 2028) Financial, Government, Military & Defense, Others
Region Outlook (Revenue, USD Billion; 2022 2028) North Americao USo Canadao Mexico Europeo Germanyo UKo Franceo Italyo Spaino Beneluxo Rest of Europe Asia Pacifico Chinao Indiao Japano South Koreao Rest of Asia Pacific Latin Americao Brazilo Rest of Latin America Middle East and Africao Saudi Arabiao UAEo South Africao Rest of Middle East & Africa
Inquiry Quantum Cryptography and Encryption Market Report at https://www.eonmarketresearch.com/enquiry/92399
A Quantum Cryptography and Encryption Market report includes a thorough market analysis as well as input from industry experts. Quantum Cryptography and Encryption Market type, organization size, on-premises distribution, end-users organization type, and accessibility in locations such as North America, South America, Europe, Asia-Pacific, and the Middle East and Africa are all factors considered when creating this worldwide Quantum Cryptography and Encryption market study. The top-of-the-line market research analysis brings a massive market into sharp focus. Quantum Cryptography and Encryption Market report research works assist in evaluating various crucial aspects such as development in a growing market, the triumph of a current strategy, and share of the Quantum Cryptography and Encryption market development.
The following are some of the reports most important features:1. Detailed market study of the Quantum Cryptography and Encryption market2. Changing industry competitive landscape3. Detailed competitive categorization4. Historical, current, and forecast market size in quantity and value5. Recent industry trends and developments6. The Quantum Cryptography and Encryption Markets Competitive Landscape Key Players Strategies and Product Portfolio7. Segments/Regions Showing Promising Growth a Neutral Perspective on the Quantum Cryptography and Encryptions Performance
Click Here to Download Free Sample Report (Get Detailed Analysis in PDF 151 Pages)
A section from the table of contents is as follows: The market overview covers the research scope, major manufacturers included market segments by type, Quantum Cryptography and Encryption market segments by application, study objectives, and years analyzed. The global Quantum Cryptography and Encryption market competitiveness is assessed in terms of price, revenue, sales, and market share by the organization, market rate, competitive situations, and current developments, expansions, acquisitions, mergers, and sales volumes of top enterprises. The major players in the international Quantum Cryptography and Encryption market are characterized by sales area, key products, operating income, revenues, price, and manufacturing. In this section of the Quantum Cryptography and Encryption market study, the authors focused on manufacturing and supply value predictions, key manufacturer forecasts, and productivity and production cost estimates by category.
Browse Complete Quantum Cryptography and Encryption Market Report Details with Table of contents and list of tables athttps://www.eonmarketresearch.com/quantum-cryptography-and-encryption-market-92399
About: Eon Market Research (EMR) is a specialized market research, analytics, and solutions company, offering strategic and tactical support to clients for making well-informed business decisions. We are a team of dedicated and impassioned individuals, who believe strongly in giving our very best to what we do and we never back down from any challenge. Eon Market Research offers services such as data mining, information management, and revenue enhancement solutions and suggestions. We cater to industries, individuals, and organizations across the globe, and deliver our offerings in the shortest possible turnaround time.
Contact: 8345 NW 66th St Miami, Florida, Zip 33195 United States; Email: [emailprotected]
See the rest here:
Quantum Cryptography and Encryption Market Size, Share 2022: Emerging Technologies, Sales Revenue, Key Players Analysis, Development Status, and...
Hive ransomware group migrates code to Rust, accelerating data encryption – Cybersecurity Dive
Dive Brief:
The original Hive payload was previously used by large ransomware affiliates to attack organizations in healthcare and software.The Department of Health and Human Services in April warned healthcare organizations of the ransomware group and described it as exceptionally aggressive.
The new variant, which Microsoft discovered in multiple samples, has a low-detection rate and is more difficult for enterprises to accurately identify.
This migration is a sign that the gang is maturing, requiring more technical expertise and new skills to create ever more sophisticated ransomware, said Michela Menting, research director at ABI Research.
A complete overhaul, including the use of a new programming language, takes time and resources. This suggests the group behind Hive has a long-term plan that bodes ill for organizations.
It is highly likely that the gang is seeking to entrench itself into the ransomware market and ensure longevity, Menting said.
Rust provides Hive and other ransomware payloads with deep control over low-level resources. The latest Hive variant also introduces a new cryptography mechanism, according to Microsoft.
Instead of embedding an encrypted key in each file it encrypts, it generates two sets of keys in memory, uses them to encrypt files, and then encrypts and writes the sets to the root of the drive it encrypts, both with .key extension, the company wrote on its blog.
Rust is especially effective at processing large amounts of data, a key advantage for ransomware gangs that aim to encrypt as much data as they can in the shortest time possible, Menting said.
The programming language is also more difficult to master, making it harder for security companies and competing ransomware groups to reverse engineer the code.
More here:
Hive ransomware group migrates code to Rust, accelerating data encryption - Cybersecurity Dive
Kingston Digital Announces XTS-AES Encrypted USB Drive with Automatic USBtoCloud Back Up – Business Wire
FOUNTAIN VALLEY, Calif.--(BUSINESS WIRE)--Kingston Digital, Inc., the Flash memory affiliate of Kingston Technology Company, Inc., a world leader in memory products and technology solutions, today announced the release of IronKey Locker+ 50 (LP50) USB Flash drive that provides consumer-grade security with AES hardware-encryption in XTS mode to safeguard against BadUSB with digitally-signed firmware and Brute Force password attacks.
Kingston IronKey Locker+ 50 offers multi-password, Admin and User, option with Complex or Passphrase modes. Complex mode allows for passwords from 6-16 characters using 3 out of 4 character sets, while new passphrase mode allows for a numeric PIN, sentence, or even a list of words from 10 to 64 characters long; along with support for international characters. To reduce failed login attempts during password entry, the eye symbol can be enabled to reveal what has been typed. But should a User password be forgotten; the Admin password can be used to access the data on the drive or reset the User password.
LP50 is designed for convenience with its small metal casing and built-in key loop, along with the optional feature of USBtoCloud (by ClevX), users can take and access their data anywhere. LP50 is easy for anyone to setup whether you use Google Drive, OneDrive (Microsoft), Amazon Cloud Drive, Dropbox or Box for your personal cloud storage. Plus, all the software and security needed is already on the drive so no application installation required, and it works on both Windows and macOS so users can work from multiple systems.
We are excited to offer another great option for those looking to store their sensitive personal or business data with our IronKey Locker+ 50, said Richard Kanadjian, encrypted business manager, Kingston. LP50 has our most requested feature, dual passwords, along with a new Passphrase mode that will allow users to pick a password that is easier to remember.
Kingston IronKey Locker+ 50 is available in capacities from 16GB 128GB and is backed by a limited five-year warranty, free technical support and legendary Kingston reliability.
For more information visit kingston.com.
Kingston IronKey Locker+ 50
Part Number
Capacity
IKLP50/16GB
16GB IronKey LP50
IKLP50/32GB
32GB IronKey LP50
IKLP50/64GB
64GB IronKey LP50
IKLP50/128GB
128GB IronKey LP50
Kingston IronKey Locker+ 50 Features and Specifications:
USB 3.2 Gen 116GB 128GB: 145MB/s read, 115MB/s write
USB 2.016GB 128GB: 30MB/s read, 20MB/s write
USBtoCloud by ClevX, LLC1 Some of the listed capacity on a Flash storage device is used for formatting and other functions and thus is not available for data storage. As such, the actual available capacity for data storage is less than what is listed on the products. For more information, go to Kingston's Flash Memory Guide.2 Speed may vary due to host hardware, software and usage.3 First free drive letters after physical devices such as system partition, optical drives, etc.
Kingston can be found on:
About Kingston Digital, Inc.
From big data, to laptops and PCs, to IoT-based devices like smart and wearable technology, to design-in and contract manufacturing, Kingston helps deliver the solutions used to live, work and play. The worlds largest PC makers and cloud-hosting companies depend on Kingston for their manufacturing needs, and our passion fuels the technology the world uses every day. We strive beyond our products to see the bigger picture, to meet the needs of our customers and offer solutions that make a difference. To learn more about how Kingston Is With You, visit Kingston.com.
Editors Note: For additional information, evaluation units or executive interviews, please contact PR Team, Kingston Technology Company, Inc. 17600 Newhope Street, Fountain Valley, CA USA 92708, 714-435-2600 (Voice). Press images can be found in Kingstons press room kingston.com/company/press/
Kingston and the Kingston logo are registered trademarks of Kingston Technology Corporation. IronKey is a registered trademark of Kingston Digital, Inc. Kingston FURY and the Kingston FURY logo are trademarks of Kingston Technology Corporation. All rights reserved. All trademarks are the property of their respective owners.
The rest is here:
Kingston Digital Announces XTS-AES Encrypted USB Drive with Automatic USBtoCloud Back Up - Business Wire
Homomorphic Encryption Market | Amazing Deal with 30% discount | Inclinations and Development Status Highlighted During Forecast Period till 2030 …
The homomorphic encryptionmarketreport contains detailed information on factors influencing demand, growth, opportunities, challenges, and restraints. It provides detailed information about the structure and prospects for global and regional industries. In addition, the report includes data on research & development, new product launches, product responses from the global and local markets by leading players. The structured analysis offers a graphical representation and a diagrammatic breakdown of theHomomorphic encryptionmarketby region.
The global homomorphic encryption market has valued at USD 117.8 million in 2016 and is expected to grow at USD 268.3 million at a 7.55% CAGR by 2027.
The digital economy affects the worlds trajectory and the societal well-being of common citizens. In addition, it influences everything from resource assignment to income allocation and economic growth. The adoption of the Internet of Things is pushing significant market growth. Additionally, in 5-10 years, the latest technologies such as robotics, AI, and augmented reality can illustrate around 27% of ICT spending. Consumer demand for access to content and products at any time and from any location is propelling the ICT market forward. The ICT sector is lucrative for vendors since it has about 7 billion mobile subscribers and 3 billion Internet, users.
Despite just marginal pay growth from US$ 66 per hour in 2005 to US$ 71.8 per hour in 2015, the U.S. economy has maintained its leadership position in the global economy. Prior investments in mobile operating systems and internet infrastructure have also aided China and India in reaping the benefits of prior ICT sector structural expenditures.
The United States has delivered gradual and steady economic growth within and beyond information technology since emerging from the global financial crisis. According to figures from the Bureau of Economic Analysis, the U.S. economy increased by 2.5 percent between 2010 and 2018.
Request To Download Sample of This Strategic Report:-https://reportocean.com/industry-verticals/sample-request?report_id=19310
IntroductionThe homomorphic encryption is a security form of encryption process which facilitates the execution of computations via cipher text to generate an encrypted output. It aids to manage the data to have authorized access without compromising the data. Homomorphic encryption is extensively used for valuable data security. Data encryption transforms data into a form or a code so that it is only accessible to people who have the password.
Homomorphic encryption secures the data and improves the privacy during data transmission. For instance, in the Banking sector, the total account value is encoded for a customer using a private key, and the data can be decoded only by using a password. Similarly, the privacy of data via homomorphic encryption can also implemented in the voting system for a secured transmission of data.The integration of cloud computing with the encryption process has a lot of advantages such as low cost, easy maintenance, and re-provisioning of resources. Also, industries such as banking & finance, healthcare, manufacturing among others are providing a huge amount of investment to secure their data on cloud. Therefore, the growing investment in cloud-based industries is propelling the homomorphic encryption market across the world. On the other hand, exposure to malware is a major risk for the homomorphic encryption, for which additional security is often added on to the encryption. For instance, during elections, in case of e-voting, the data is safeguarded with additive homomorphic encryption. Unfortunately, if one of the voting booths get infected with malware then the votes can be manipulated effortlessly before the process of decryption. Such situations can be a threat to the homomorphic cryptosystem used in the banking and finance sector. Hence, vulnerability to malware could be a challenging factor over the next few years.The global homomorphic encryption market has valued at USD 117.8 million in 2016 and is expected to grow at USD 268.3 million at a 7.55% CAGR by 2027.
Key PlayersThe key players of homomorphic encryption market include Gemalto (The Netherlands), Oracle Corporation (U.S.), Microsoft Corporation (U.S.), IBM Corporation (U.S.), Galois Incorporation (U.S.), CryptoExperts (France.), Netskope (U.S.).
Global Homomorphic Encryption Market Analysis & Forecast, from 2016 to 2027> To provide detailed analysis of the market structure along with forecast of the various segments and sub-segments of the homomorphic encryption market> To provide insights about factors affecting the market growth> To analyze the homomorphic encryption market based on porters five force analysis etc.> To provide historical and forecast revenue of the market segments and sub-segments with respect to four main geographies and their countries- North America, Europe, Asia, and Rest of the World> To provide country level analysis of the market with respect to the current market size and future prospective> To provide country level analysis of the market for segment on the basis of energy sources and application.> To provide strategic profiling of key players in the market, comprehensively analyzing their core competencies, and drawing a competitive landscape for the market> To track and analyze competitive developments such as joint ventures, strategic alliances, mergers and acquisitions, new product developments, and research and developments in the homomorphic encryption market.
Download Free Sample Report, SPECIAL OFFER (Avail an Up-to 30% discount on this report:-https://reportocean.com/industry-verticals/sample-request?report_id=19310
Target Audience> Manufacturing Companies> Software Developers> Technology Providers> Distributors> Research firms> Consultancy firms> Stakeholders> End-use sectors> Technology Investors
Key Findings> The global homomorphic encryption market is expected to reach approximately USD 270 million by 2027.> By type, fully homomorphic encryption segment market accounts for the largest market share and is growing with 8.49% CAGR during forecast period.> By application, banking and finance sub-segment holds the largest market share and is growing with 8.67% CAGR during the forecast period.> Geographically, North America region has been projected to hold the largest market share in global homomorphic encryption market followed by Europe region, while Asia Pacific has emerged as fastest growing market during forecast period.
Regional and Country-level Analysis of Homomorphic Encryption Market- Estimation & ForecastThe homomorphic encryption market is growing with a positive growth in all the regions. Increased adoption and advancements in technology associated with the government support to enhance the security system are driving the market on a global scale. On the basis of region, the market has been segmented into North America, Europe, Asia Pacific, and the Rest of the World. North America is dominating the global Homomorphic Encryption market share, owing to a constant growth rate, improved medical facilities, surging private sector investments, high exports and rising number of small and medium scale enterprises. Europe follows soon after which stands as the second biggest market due to the growing security concerns whereas, Asia Pacific follows as the fastest growing region, this growth is attributed to rapid industrialization and a huge customer base in the emerging economies such as China, India, and South Korea.
The reports also cover country-level analysis:> North Americao U.S.o Canadao Mexico> Europeo U.Ko Germanyo Franceo Rest of the Europe> Asia Pacifico Chinao Indiao Japano Rest of Asia Pacifico South Korea> Rest of the World
Access full Report Description, TOC, Table of Figure, Chart, etc. @:-https://reportocean.com/industry-verticals/sample-request?report_id=19310
What is the goal of the report?
The market report presents the estimated size of the ICT market at the end of the forecast period. The report also examines historical and current market sizes. During the forecast period, the report analyzes the growth rate, market size, and market valuation. The report presents current trends in the industry and the future potential of the North America, Asia Pacific, Europe, Latin America, and the Middle East and Africa markets. The report offers a comprehensive view of the market based on geographic scope, market segmentation, and key player financial performance.
Factors Influencing
The global market is forecast to witness a rapid growth, owing to increasing demand for technological advancements from end-users. Moreover, increasing investments in research and development activities, launches, partnerships, and other strategic initiatives will benefit the market.Furthermore, the growing focus of authorities towards increasing urbanization and industrialization is forecast to drive the market growth.
COVID-19 Impact Analysis
The COVID-19 pandemic has affected almost every industry. The market witnessed a significant decline in investments, mainly in the energy and power sector. According to the estimations by the International Energy Agency, investments in the energy and power domain are projected to decrease by 10% in 2020 as compared to the pre-pandemic statistics. This indicate the condition of global marketplace along with severe challenges faced during pandemic.
Regional Analysis
Asia-Pacific market is forecast to emerge as rapidly growing region in global market, owing to governments initiatives towards increasing urbanization and growing population leading to increasing demand of energy-based products and services. Also, North America is forecast to grow rapidly because of high energy consumption in the region and technological advancements across the sector. Energy consumption has been increasing in the region, mainly in the US; the primary energy consumption is segmented on the basis of nuclear electric power, petroleum, coal, renewable energy, and natural gas. The petroleum and natural gas segment is dominating the overall sector. In the mix of energy sources, petroleum accounts for around 35% of the overall consumption, whereas natural gas accounts for 34%.
Access Full Report, here:-https://reportocean.com/industry-verticals/sample-request?report_id=19310
About Report Ocean:We are the best market research reports provider in the industry. Report Ocean believes in providing quality reports to clients to meet the top line and bottom line goals which will boost your market share in todays competitive environment. Report Ocean is a one-stop solution for individuals, organizations, and industries that are looking for innovative market research reports.
Get in Touch with Us:Report Ocean:Email:sales@reportocean.comAddress: 500 N Michigan Ave, Suite 600, Chicago, Illinois 60611 UNITED STATESTel: +1 888 212 3539 (US TOLL FREE)Website:https://www.reportocean.com/
See the original post:
Homomorphic Encryption Market | Amazing Deal with 30% discount | Inclinations and Development Status Highlighted During Forecast Period till 2030 ...
OpenSSL fixes two one-liner crypto bugs what you need to know – Naked Security
Just over a week ago, the newswires were abuzz with news of a potentially serious bug in the widely-used cryptographic library OpenSSL.
Some headlines went as far as describing the bug as a possibly worse-than-Heartbleed flaw, which was dramatic language indeed.
Heartbleed, as you may remember, was an incredibly high-profile data leakage bug that lurked unnoticed in OpenSSL for several years before being outed in a flurry of publicity back in 2014:
In fact, Heartbleed can probably be considered a prime early example of what Naked Security jokingly refer to as the BWAIN process, short for Bug With An Impressive Name.
That happens when the finders of a bug aim to maxmise their media coverage by coming up with a PR-friendly name, a logo, a dedicated website, and even, in one memorable case, a theme tune.
Heartbleed was a bug that exposed very many public-facing websites to malicious traffic that said, greatly simplified, Hey! Tell me youre still there by sending back this message: ROGER. By the way, send the text back in a memory buffer thats 64,000 bytes long.
Unpatched servers would dutifully reply with something like: ROGER [followed by 64000 minus 5 bytes of whatever just happened followed in memory, perhaps including other people's web requests or even passwords and private keys].
As you can imagine, once news of Heartbleed got out, the bug was easily, quickly and widely abused by criminals and show-off researchers alike.
We dont think these latest bugs reach that level of exploitability or immediate danger
but theyre certainly worth patching as soon as you can.
Intriguingly, both bugs fixed in this release are what we referred to in the headline as one-liners, meaning that changing or adding just a single line of code patched each of the holes.
In fact, as well see, one of the patches involves changing a single assembler instruction, ultimately resulting in just a single changed bit in the compiled code.
The bugs are as follows:
The fixes are simple once you know whats needed:
The modular exponentiation code now converts a count of bits to a count of integers, by dividing the bit-count by the number of bytes in an integer multiplied by 8 (the number of bits in a byte).
The AES-OCB encryption code now uses a JBE (jump if below or equal to) test at the end of its loop instead of JB (jump if below), which is the same sort of change as altering a C loop to say for (i = 1; i <= n; i++) {...} instead of for (i = 1; i < n; i++) {...}.
In the compiled code, this changes just a single bit of a single byte, namely by switching the binary opcode value 01110010 (jump if below) for 0111 0100 (jump if below or equal).
Fortunately, were not aware of the special encryption mode AES-OCB being widely used (its modern equivalent is AES-GCM, if youre familiar with the many AES encryption flavours).
Notably, as the OpenSSL team points out, OpenSSL does not support OCB based cipher suites for TLS and DTLS, so the network security of SSL/TLS connections is unaffected by this bug.
OpenSSL version 3.0 is affected by both of these bugs, and gets an update from 3.0.4 to 3.0.5.
OpenSSL version 1.1.1 is affected by the AES-OCB plaintext leakage bug, and gets an update from 1.1.1p to 1.1.1q.
Of the two bugs, the modular exponentiation bug is the more severe.
Thats because the buffer overflow means, in theory, that something as fundamental as checking a websites TLS certificate before accepting a connection could be enough to trigger remote code execution (RCE).
If you are using OpenSSL 3 and you genuinely cant upgrade your source code, but you can recompile the source youre already using, then one possible workaround is to rebuild your current OpenSSL using the no-asm configuration setting.
Note that this isnt recommended by the OpenSSL team, because it removes almost all assembler-accelerated functions from the compiled code, which may therefore end up noticeably slower, but it will eliminate the unwanted AVX512 instructions entirely.
To suppress the offending AES-OCB code alone, you can recompile with the configuration setting no-ocb, which ought to be a harmless intervention if you arent knowingly using OCB mode in your own software.
But the best solution is, as always: Patch early, patch often!
Link:
OpenSSL fixes two one-liner crypto bugs what you need to know - Naked Security
Mega’s unbreakable encryption proves to be anything but – The Register
Mega, the New Zealand-based file-sharing biz co-founded a decade ago by Kim Dotcom, promotes its "privacy by design" and user-controlled encryption keys to claim that data stored on Mega's servers can only be accessed by customers, even if its main system is taken over by law enforcement or others.
The design of the service, however, falls short of that promise thanks to poorly implemented encryption. Cryptography experts at ETH Zurich in Switzerland on Tuesday published a paper describing five possible attacks that can compromise the confidentiality of users' files.
The paper [PDF], titled "Mega: Malleable Encryption Goes Awry," by ETH cryptography researchers Matilda Backendal and Miro Haller, and computer science professor Kenneth Paterson, identifies "significant shortcomings in Megas cryptographic architecture" that allow Mega, or those able to mount a TLS MITM attack on Mega's client software, to access user files.
The findings, detailed on a separate website, proved sufficiently severe that Kim Dotcom, no longer affiliated with the file storage company, advised potential users of the service to stay away.
Mega chief architect Mathias Ortmann meanwhile published a blog post announcing a client software update addressing three of the five flaws identified by the researchers, promising further mitigations, and thanked the ETH Zurich boffins for responsibly reporting their findings.
"The first two attacks exploit the lack of integrity protection of ciphertexts containing keys (henceforth referred to as key ciphertexts), and allow full compromise of all user keys encrypted with the master key, leading to a complete break of data confidentiality in the MEGA system," the paper explains. "The next two attacks breach the integrity of file ciphertexts and allow a malicious service provider to insert chosen files into users cloud storage. The last attack is a Bleichenbacher-style attack against MEGAs RSA encryption mechanism."
The major issue here is that Mega's method for deriving the various cryptographic keys used to authenticate and encrypt files fails to check for key integrity. So a malicious server can tamper with the RSA private key and make it leak information.
The first issue is an RSA Key Recovery Attack. It allows an attacker controlling the Mega API or able to mount a TLS MiTM attack on the client, to abuse the authentication protocol to extract the user's private key. This is done by constructing an oracle a mathematical data leak to gather one bit of information per login attempt about a factor of the RSA modulus an integer that's the product of two primes used to generate the cryptographic key pair.
This attack takes at least 512 login attempts to carry out. Mega in its post cites this figure to suggest the attack is difficult to carry out but the ETH researchers note that it's possible to further manipulate Mega's software to force the client to log in repeatedly, allowing the attack to fully reveal a key within a few minutes.
The second is a Plaintext Recovery Attack. "Building on the previous vulnerability, the malicious service provider can recover any plaintext encrypted with AES-ECB under a users master key," the paper explains.
"This includes all node keys used for encrypting files and folders (including unshared ones not affected by the previous attack), as well as the private Ed25519 signature and Curve25519 chat key. As a consequence, the confidentiality of all user data protected by these keys, such as files and chat messages, is lost."
Attacks three and four allow a malicious service provider to "break the integrity of the file encryption scheme and insert arbitrary files into the users file storage which pass the authenticity checks during decryption. This enables framing of the user by inserting controversial, illegal, or compromising material into their file storage."
While this may sound outlandish, framing political opponents with fabricated evidence has been documented and represents a real threat.
The fifth attack is described as "a new Guess-and-Purge variant of Bleichenbachers attack." It relies on a lot of guesses (2^17) to decrypt node and chat keys.
Proof-of-concept code for these attacks has been published on GitHub.
Ortmann said Mega intends to release a client fix for attack number four and to remove the legacy code that allows attack number five.
Paterson, via Twitter said Mega has taken some steps to address these attacks but expressed disappointment that the company hasn't committed to a thorough overhaul of its approach because its cryptography is "pretty fragile."
"On the other hand, to fix everything thoroughly, all of [Mega's] customers would have to download all their files, re-encrypt them, and upload them again," he said. "With 1000 Petabytes of data to deal with, that's going to hurt."
Paterson and his colleagues argue that companies should work to standardize secure cloud storage to avoid repeated ad hoc implementations that repeat the same errors.
"We believe that this would be the easiest path to avoid attacks stemming from the lack of expert knowledge among developers, and that it would enable users to finally have confidence that their data remains just that theirs," the paper concludes.
Read this article:
Mega's unbreakable encryption proves to be anything but - The Register
Another Issue With Internet Antitrust Bills: Sloppy Drafting Could Lead To Problems For Encryption – Techdirt
from the not-good,-not-good-at-all dept
As the big push is on to approve two internet-focused antitrust bills, the American Innovation and Choice Online Act (AICOA) and the Open App Markets Act, weve been calling out that while the overall intentions of both may be good, there are real concerns with the language of both and how it could impact content moderation debates. Indeed, it seems pretty clear that the only reason these bills have strong support from Republicans is because they know the bills can be abused to attack editorial discretion.
There have been some other claims made about problems with these bills, though some of them seem overblown to me (for example, the claims that the Open App Markets bill would magically undermine security on mobile phones). However, Bruce Schneier now points out another potential issue with both bills that seems like a legitimate concern. They both could be backdoors to pressuring companies into blocking encryption apps. He starts by highlighting how it might work with AICOA:
Lets start with S. 2992. Sec. 3(c)(7)(A)(iii) would allow a company to deny access to apps installed by users, where those app makers have been identified [by the Federal Government] as national security, intelligence, or law enforcement risks. That language is far too broad. It would allow Apple to deny access to an encryption service provider that provides encrypted cloud backups to the cloud (which Apple does not currently offer). All Apple would need to do is point to any number of FBI materials decrying the security risks with warrant proof encryption.
Sec. 3(c)(7)(A)(vi) states that there shall be no liability for a platform solely because it offers end-to-end encryption. This language is too narrow. The word solely suggests that offering end-to-end encryption could be a factor in determining liability, provided that it is not the only reason. This is very similar to one of the problems with the encryption carve-out in the EARN IT Act. The section also doesnt mention any other important privacy-protective features and policies, which also shouldnt be the basis for creating liability for a covered platform under Sec. 3(a).
It gets worse:
In Sec. 2(a)(2), the definition of business user excludes any person who is a clear national security risk. This term is undefined, and as such far too broad. It can easily be interpreted to cover any company that offers an end-to-end encrypted alternative, or a service offered in a country whose privacy laws forbid disclosing data in response to US court-ordered surveillance. Again, the FBIs repeated statements about end-to-end encryption could serve as support.
Finally, under Sec. 3(b)(2)(B), platforms have an affirmative defense for conduct that would otherwise violate the Act if they do so in order to protect safety, user privacy, the security of nonpublic data, or the security of the covered platform. This language is too vague, and could be used to deny users the ability to use competing services that offer better security/privacy than the incumbent platformparticularly where the platform offers subpar security in the name of public safety. For example, today Apple only offers unencrypted iCloud backups, which it can then turn over governments who claim this is necessary for public safety. Apple can raise this defense to justify its blocking third-party services from offering competing, end-to-end encrypted backups of iMessage and other sensitive data stored on an iPhone.
And the Open App Markets bill has similar issues:
S. 2710 has similar problems. Sec 7. (6)(B) contains language specifying that the bill does not require a covered company to interoperate or share data with persons or business users thathave been identified by the Federal Government as national security, intelligence, or law enforcement risks. This would mean that Apple could ignore the prohibition against private APIs, and deny access to otherwise private APIs, for developers of encryption products that have been publicly identified by the FBI. That is, end-to-end encryption products.
Some might push back on this by pointing out that Apple has strongly supported encryption over the years, but these bills open up some potential problems, and, at the very least, might allow companies like Apple to block third party encryption apps even as the stated purpose of the bill is the opposite.
As Schneier notes, he likes both bills in general, but this sloppy drafting is a problem.
The same is true of the language that could impact content moderation. In both cases, it seems that this is messy drafting (though in the content moderation case, it seems that Republicans have jumped on it and have now made it the main reason they support these bills, beyond general anger towards big tech for populist reasons).
Once again, the underlying thinking behind both bills seems mostly sound, but these problems again suggest that these bills are, at best, half-baked, and could do with some careful revisions. Unfortunately, the only revisions weve seen so far are those that carved out a few powerful industries.
Filed Under: aicoa, amy klobuchar, antitrust, bruce schneier, encryption, open app markets
Read more here:
Another Issue With Internet Antitrust Bills: Sloppy Drafting Could Lead To Problems For Encryption - Techdirt