Category Archives: Encryption

Decentralising end-to-end encryption with a new security protocol – The Hindu

Messaging services like WhatsApp and Telegram use end-to-end encryption (E2E) to secure messages sent and received. Their systems uses a single company's server to store encrypted information.

Complete dependence on a single firms server prevents users from being able to control how their private messages are being handled.

(Sign up to our Technology newsletter, Today's Cache, for insights on emerging themes at the intersection of technology, business and policy. Click here to subscribe for free.)

Researchers at Carnegie Mellon University have devised a new security protocol to decentralise E2E, enabling users to store their messages in a more flexible network.

The system is an extension of the steady group key settlement (GKA) a previously developed safety protocol that permits a group of people to send and receive messages without relaying on a message group supervisor. If your message is routed through one server and the company raises the prices or shuts down, you could switch to another server seamlessly, the team noted.

Also Read | Quantum computers pose security threats, report says

If users are using a central server run by a company to communicate, but it gets blocked or shut down, they could switch to a self hosted server that is physically in one of their homes, the team noted.

If thats blocked too, or if the whole Internet is shut down, they could switch to using a mesh network in which nearby devices connect over Bluetooth, the team said in a paper titled Key Agreement for Decentralized Secure Group Messaging with Strong Security Guarantees.

"Right now, messaging app companies are in charge of users, when really it should be the other way around," one of the researchers noted. "Users should have the freedom to choose how their messages are handled.

Link:
Decentralising end-to-end encryption with a new security protocol - The Hindu

How the 5G industrial IoT will change different verticals – IT Brief New Zealand

The industrial Internet of Things, protecting systems during the holiday season, and using encryption to help address cloud misconfiguration, are amongst the most recent insights from global technology firm Thales.

Industrial IoT

The industrial Internet of Things is coming and many believe it will be the catalyst for unprecedented productivity levels.

However, according to Thales Group, it cannot happen without fast and reliable connectivity extending to even the remotest locations.

"5G provides it. And it is already here," the company says.

5G networks are now rolling out across the world. According to the GSA, there were 180 commercial services in 72 countries in September 2021. Meanwhile, 465 operators in 139 markets are planning live deployments.

"So, the conditions are in place for the Industrial IoT to flourish," Thales says. "Indeed, the first pioneering services have been built."

How to protect your systems from unauthorised access this holiday Season

Many retailers and shipping services are planning to hire temporary workers for the upcoming holiday season. Retailers, shipping and logistics companies, and other organisations can take multiple steps to mitigate the risks posed by seasonal workers by ensuring they have the right access security in place.

How encryption can help address Cloud misconfiguration

Cloud service providers (CSPs) try to make it simple and easy for their users to comply with data privacy regulations and mandates. Still, as all of those who work in technology know, you reduce access to granular controls when you simplify a process. On the flip side, if you allow access to granular controls, the person setting the controls needs to be an expert to set them correctly. And, even experts make mistakes.

New partnership between Thales and VNPT to accelerate digital transformation in Vietnam

Thales and the Vietnam Posts and Telecommunications Group have signed a Memorandum of Understanding (MoU) to explore technical collaborations in telecommunications satellites, Smart and Safe cities, Digital Identity and Biometrics, 5G & Internet of Things and cybersecurity.

The MoU was signed between both organisations on 3 November 2021 in Paris, in the presence of Jean Castex, Prime Minister of France, and Pham Minh Chinh, Prime Minister of the Socialist Republic of Vietnam. The joint collaboration on these topics aligns with Vietnam's national digital transformation goals, including establishing a strong digital economy and driving towards a Smart Nation.

Thales is a global technology company investing in digital and "deep tech" innovations, including Big Data, AI, connectivity, cybersecurity and quantum technology.

"Thales's core purpose is to build a future we can all trust. It's the exact transcription of the DNA that has shaped the Group ever since it was founded more than a century ago," the company says.

It has more than 80,000 employees across five continents, and its corporate purpose revolves around three components: autonomy, resilience and sustainability.

The rest is here:
How the 5G industrial IoT will change different verticals - IT Brief New Zealand

How to Enable end-to-end Encryption for one-to-one Calls in Microsoft Teams – BollyInside

This tutorial is about the How to Enable end-to-end Encryption for one-to-one Calls in Microsoft Teams. We will try our best so that you understand this guide. I hope you like this blog How to Enable end-to-end Encryption for one-to-one Calls in Microsoft Teams. If your answer is yes then please do share after reading this.

Earlier this year, end-to-end encryption (E2EE) support for Microsoft Teams Calls was announced. Once you get the latest update, your organizations IT administrators will have the option to make the feature accessible to you. Here is an overview of how E2E encryption works for Teams calls, details on how IT administrators and users can activate it and how it is applied.

IT administrators can add end-to-end encryption for users in their organization just like any other policy. You can make it a global policy (for the entire organization) or create custom policies and assign them to users.

Go to admin.teams.microsoft.com and log in with your administrator account. Then navigate to Other Settings from the navigation panel on the left.

Few options will expand below it. Click on Enhanced Encryption Policies in the options.

Then name your policy. Click the drop-down menu next to End-to-end encryption and select Users can enable it. Finally, click on the Save button.

Once youve created the policy, assign it to users, groups, or your entire tenant just like any other policy in Microsoft Teams.

After IT administrators have configured the E2EE policy for the organization, users (depending on the policy) can enable it for their accounts. By default, end-to-end encryption will need to be re-enabled at the account level. Otherwise, it will remain disabled even if administrators have allowed your account to use it.

To enable E2EE from the desktop, open the Microsoft Teams desktop app on your PC or Mac. Then go to the title bar and click on the More options icon (three dots) next to your profile icon.

Select Settings from the menu.

Then go to Privacy in the left navigation menu.

In the privacy settings, enable the option End-to-end encrypted calls.

Deactivate the switch for this setting when you want to use the functions that E2EE restricts on the call.

To enable E2EE from the Teams mobile app, open the latest version of the Teams Mobile app on iPhone or Android.

Tap on your profile icon in the upper left corner.

Then, tap on the Settings option.

From the settings screen, go to Calls.

There you can enable the option of End-to-end encryption in Encryption.

Whether you enable the option from the desktop or mobile app, the app is account-wide. So if you have enabled it from desktop app it will be on when you use mobile phone and vice versa.

I hope you understand this article How to Enable end-to-end Encryption for one-to-one Calls in Microsoft Teams, if your answer is no then you can ask anything via contact forum section related to this article. And if your answer is yes then please share this article with your family and friends.

Read more here:
How to Enable end-to-end Encryption for one-to-one Calls in Microsoft Teams - BollyInside

Boxcryptor protects business data in Microsoft Teams with end-to-end encryption features – Help Net Security

Already since summer 2020, the encryption software Boxcryptor offers additional security for data in Microsoft Teams. Now there is a major update that brings new features.

Among other things, users can send messages in end-to-end encrypted form. Passwords, bank data, any messages with sensitive content: Thanks to encryption by Boxcryptor in Microsoft Teams, it will not end up in the wrong hands and is secured in a GDPR-compliant manner.

Numerous companies, educational institutions, and organizations use Microsoft Teams as a collaboration tool. At the same time, the demand for a solution like Boxcryptor that reliably protects business data in Microsoft Teams also increased last year, especially due to the Corona pandemic.

After all, only consistent end-to-end encryption ensures that authorized people have exclusive access. If you do not want potential hackers or even Microsoft employees to gain insight into confidential data, you have to encrypt data and not let the key out of your hands during the entire process.

So far, Boxcryptor could be used in two ways in Microsoft Teams, as a personal app and in the team channels. Via the personal app, there is the possibility to access encrypted data in the personal OneDrive. In a team, Boxcryptor is available as a channel app. All members of the channel can request access to encrypted files in a channel and collaborate on these documents. Files can also be posted in channels securely encrypted, of course.

Encrypted messages: Anyone who wanted to share confidential information or personal data in Microsoft Teams and was previously unable to do so in a secure way can now easily send the information in a message, encrypted with Boxcryptor. This ensures that only authorized persons have access to sensitive information.

Application for mobile devices as well as in the browser: Apart from Windows and macOS, Boxcryptor for Microsoft Teams is now also available on iOS and Android, and in the browser version. Therefore, encrypted files can now be shared and accessed on all major platforms.

Encrypted files in private channels: Another new feature that many Boxcryptor customers have already been waiting for is the ability to work with encrypted data in private channels and chats as well. The way it works for users is the same as in the public channels.

See the article here:
Boxcryptor protects business data in Microsoft Teams with end-to-end encryption features - Help Net Security

NordLocker goes mobile: Encrypt your files on iOS and Android now with 60% off – GlobeNewswire

LONDON, Nov. 24, 2021 (GLOBE NEWSWIRE) -- NordLocker, an encrypted cloud storage provider, is proud to announce that its bringing end-to-end encryption to files on smartphones by introducing iOS and Android mobile wrapper apps. This is made possible by a major change to NordLocker the Web Access feature which allows using the service while away from a computer.

Its a big step towards data security on the go, says Aiste Araminaite-Pivore, Head of Product at NordLocker. One of our core goals is to ensure that our users privacy does not depend on the device or operating system they use. This is why weve recently introduced Web Access, a feature to make sure your files are always secure and within reach.

NordLockers mobile experience

NordLocker mobile wrapper apps for Android and iOS are available for download now, while native applications are in progress. However, there is still plenty a user can do with the current version. For example:

What else has recently come to NordLocker?

2TB plan. NordLocker users can choose between three plans: a freemium version of 3 GB and paid 500 GB or 2 TB of private cloud storage for their files.

Award-winning product. NordLocker has won the Consumer Encryption Solution of the Year award by CyberSecurity Breakthrough, an independent organization that recognizes the top companies, technologies, and products in the global information security market.

Increased bug bounty. Together with other Nord brands, NordLocker increased its bug bounty rewards by ten times on the HackerOne platform. Ethical hackers who report unknown critical vulnerabilities now can expect US$50,000 or more.

Future plans

Besides the native iOS and Android apps, two more features are being developed to offer our users more convenience and improve file accessibility, says Aiste Araminaite-Pivore.

Third-party logins. In addition to the traditional login process and one-time codes, users will now be able to use Google and Apple logins to enter their existing Nord Account, the home platform to all Nord products.

Cloud locker sharing. A safe and easy way to share your encrypted cloud lockers. Just enter the receivers email address to make the locker appear in their app. If the receiver isnt a NordLocker user, theyll get an invitation.

Share via link. This will allow users to share their files via a link so that the receiver can open them without NordLocker.

NordLocker for business. Were launching a NordLocker business solution to improve our business users experience with functionalities such as an admin panel, user groups, and advanced security control.

By the way, NordLockers Premium plan is now 60% off. Thats unlimited file encryption and 500 GB of private cloud storage for just $3.19/month or 2 TB for $7.99/month. All plans come with a 30-day money-back guarantee.

ABOUT NORDLOCKER

NordLocker is the worlds first end-to-end file encryption tool with a private cloud. It was created by the cybersecurity experts behind NordVPN one of the most advanced VPN service providers in the world. NordLocker is available for Windows and macOS, supports all file types, offers a fast and intuitive interface, and guarantees secure sync between devices. With NordLocker, files are protected from hacking, surveillance, and data collection. For more information: nordlocker.com.

ContactSkirmante Akinyteskirmante@nordsec.com

Here is the original post:
NordLocker goes mobile: Encrypt your files on iOS and Android now with 60% off - GlobeNewswire

How Does End-To-End Encryption Works In WhatsApp? – Wales247

End-to-end encryption has become a common term while talking about the security of any app. WhatsApp has particularly popularised the term end-to-end encryption with the tagline, Message Privately. WhatsApp has used end-to-end encryption to attract billions of users globally. End to end encryption is used to protect personal data such as messages from any middle man by ensuring the message only stays between the receiver and sender.

The end-to-end encryption of WhatsApp ensures that the message that is sent by the sender, stays between for whom the message is meant. No one, not even WhatsApp can read the message that is being shared between the sender and the receiver. It is because end-to-end encrypted messages come with a special key that can only be unlocked by the recipient. To provide the users with end-to-end encryption, it uses Signal Protocol which is being developed by Open Whisper System.

When a user first installs WhatsApp on their device, one public and the private key are generated and the entire encryption process takes place in the smartphone itself. The private key that is being generated stays with the user and with the help of the centralised WhatsApp service, the public key is transferred to the receiver. When a message is being sent, even before the message reaches the centralised server, the public key encrypts the message that is being sent. Even though WhatsApp messages are encrypted, WhatsApp Status are not as it can be viewed by all the people in the contact. However, the statuses that you upload, like the Attitude Status and your images, can be protected by making changes to who can see the statuses. The WhatsApp server is only used for transferring such encrypted messages and this message can only be unlocked by the receiver.

WhatsApp offers end-to-end encryption and it is because security plays a vital role for the company. Digital security has become very important in the digital world and therefore, WhatsApp has started offering end-to-end encryption in 2016.

The encrypted messages that are being shared through WhatsApp cannot be read by WhatsApp. It is because the entire encryption and decryption of the messages take place only on the device. When a sender sends a message, the message is locked using a cryptographic lock and the key of the lock lies only with the recipient. To make the security more robust, WhatsApp changes the keys after every single message is sent.

End-to-end encryption offered by WhatsApp can be verified manually. For manually verifying the encryption offered by WhatsApp, tap on a contact name present in WhatsApp for the receiver for whom you want to verify the encryption. Now, tap on Encryption. This will allow you to view a QR code along with a 60-digit number. To verify the messages and calls with a particular contact are verified, you can scan the code present in the sender with the receiver. Further, the 60-digit numbers can also be compared.

WhatsApp, by default, offers end-to-end encrypted messages. However, the user can now choose whether they want the same layer of protection for their chat backup that is mostly stored either on iCloud or Google Drive. For enabling end-to-encryption of WhatsApp chat backup, go to Settings and then tap on Chats and then tap on Chat Backup and select End-to-End Encrypted Backup, then simply tap on Turn On. When you turn on end-to-end encryption for WhatsApp chat backup, no one will be able to access the backup of WhatsApp.

For creating a backup that is end-to-end encrypted, you will have to create a password. The encryption can be done either by creating a password or by using a 64-digit encryption key. If by accident, if you ever end up losing the password, WhatsApp will help the user to recover the backup.

Even though end-to-end encryption offered by WhatsApp is highly secure, it is not totally secure because just like any other app, even WhatsApp comes with its anomalies. These anomalies can result in data breaches. The same breach in security is visible through the Pegasus that have successfully explored the vulnerability of WhatsApp to leak important data. Such a cyber attack is possible but in no way, it means that WhatsApp is insecure. WhatsApp has always worked towards improving its security.

Continue reading here:
How Does End-To-End Encryption Works In WhatsApp? - Wales247

Email Encryption Market Research Report by Type, by Component, by Industry, by Deployment, by Region – Global Forecast to 2026 – Cumulative Impact of…

Email Encryption Market Research Report by Type (Boundary Email Encryption, Client Plugins, and End-to-End Email Encryption), by Component (Services and Solution), by Industry, by Deployment, by Region (Americas, Asia-Pacific, and Europe, Middle East & Africa) - Global Forecast to 2026 - Cumulative Impact of COVID-19

New York, Nov. 24, 2021 (GLOBE NEWSWIRE) -- Reportlinker.com announces the release of the report "Email Encryption Market Research Report by Type, by Component, by Industry, by Deployment, by Region - Global Forecast to 2026 - Cumulative Impact of COVID-19" - https://www.reportlinker.com/p06169055/?utm_source=GNW

The Global Email Encryption Market size was estimated at USD 2,696.15 million in 2020 and expected to reach USD 3,055.98 million in 2021, at a CAGR 13.68% to reach USD 5,820.33 million by 2026.

Market Statistics:The report provides market sizing and forecast across five major currencies - USD, EUR GBP, JPY, and AUD. It helps organization leaders make better decisions when currency exchange data is readily available. In this report, the years 2018 and 2019 are considered historical years, 2020 as the base year, 2021 as the estimated year, and years from 2022 to 2026 are considered the forecast period.

Market Segmentation & Coverage:This research report categorizes the Email Encryption to forecast the revenues and analyze the trends in each of the following sub-markets:

Based on Type, the market was studied across Boundary Email Encryption, Client Plugins, End-to-End Email Encryption, Gateway Email Encryption, and Hybrid Email Encryption.

Based on Component, the market was studied across Services and Solution.

Based on Industry, the market was studied across Aerospace & Defense, Automotive & Transportation, Banking, Financial Services & Insurance, Building, Construction & Real Estate, Consumer Goods & Retail, Education, Energy & Utilities, Government & Public Sector, Healthcare & Life Sciences, Information Technology, Manufacturing, Media & Entertainment, Telecommunication, and Travel & Hospitality.

Based on Deployment, the market was studied across On-Cloud and On-Premises.

Based on Region, the market was studied across Americas, Asia-Pacific, and Europe, Middle East & Africa. The Americas is further studied across Argentina, Brazil, Canada, Mexico, and United States. The United States is further studied across California, Florida, Illinois, New York, Ohio, Pennsylvania, and Texas. The Asia-Pacific is further studied across Australia, China, India, Indonesia, Japan, Malaysia, Philippines, Singapore, South Korea, Taiwan, and Thailand. The Europe, Middle East & Africa is further studied across France, Germany, Italy, Netherlands, Qatar, Russia, Saudi Arabia, South Africa, Spain, United Arab Emirates, and United Kingdom.

Cumulative Impact of COVID-19:COVID-19 is an incomparable global public health emergency that has affected almost every industry, and the long-term effects are projected to impact the industry growth during the forecast period. Our ongoing research amplifies our research framework to ensure the inclusion of underlying COVID-19 issues and potential paths forward. The report delivers insights on COVID-19 considering the changes in consumer behavior and demand, purchasing patterns, re-routing of the supply chain, dynamics of current market forces, and the significant interventions of governments. The updated study provides insights, analysis, estimations, and forecasts, considering the COVID-19 impact on the market.

Competitive Strategic Window:The Competitive Strategic Window analyses the competitive landscape in terms of markets, applications, and geographies to help the vendor define an alignment or fit between their capabilities and opportunities for future growth prospects. It describes the optimal or favorable fit for the vendors to adopt successive merger and acquisition strategies, geography expansion, research & development, and new product introduction strategies to execute further business expansion and growth during a forecast period.

FPNV Positioning Matrix:The FPNV Positioning Matrix evaluates and categorizes the vendors in the Email Encryption Market based on Business Strategy (Business Growth, Industry Coverage, Financial Viability, and Channel Support) and Product Satisfaction (Value for Money, Ease of Use, Product Features, and Customer Support) that aids businesses in better decision making and understanding the competitive landscape.

Market Share Analysis:The Market Share Analysis offers the analysis of vendors considering their contribution to the overall market. It provides the idea of its revenue generation into the overall market compared to other vendors in the space. It provides insights into how vendors are performing in terms of revenue generation and customer base compared to others. Knowing market share offers an idea of the size and competitiveness of the vendors for the base year. It reveals the market characteristics in terms of accumulation, fragmentation, dominance, and amalgamation traits.

Competitive Scenario:The Competitive Scenario provides an outlook analysis of the various business growth strategies adopted by the vendors. The news covered in this section deliver valuable thoughts at the different stage while keeping up-to-date with the business and engage stakeholders in the economic debate. The competitive scenario represents press releases or news of the companies categorized into Merger & Acquisition, Agreement, Collaboration, & Partnership, New Product Launch & Enhancement, Investment & Funding, and Award, Recognition, & Expansion. All the news collected help vendor to understand the gaps in the marketplace and competitors strength and weakness thereby, providing insights to enhance product and service.

Company Usability Profiles:The report profoundly explores the recent significant developments by the leading vendors and innovation profiles in the Global Email Encryption Market, including BAE Systems, Cryptzone, Echoworx, Egress Software, Entrust Datacard, Intemedia, Lux Sci, Micro Focus International PLC, Mimecast, Proofpoint, Inc., Sophos Group PLC, Symantec Corporation, Trend Micro Incorporated, Virtru, and Zix.

The report provides insights on the following pointers:1. Market Penetration: Provides comprehensive information on the market offered by the key players2. Market Development: Provides in-depth information about lucrative emerging markets and analyze penetration across mature segments of the markets3. Market Diversification: Provides detailed information about new product launches, untapped geographies, recent developments, and investments4. Competitive Assessment & Intelligence: Provides an exhaustive assessment of market shares, strategies, products, certification, regulatory approvals, patent landscape, and manufacturing capabilities of the leading players5. Product Development & Innovation: Provides intelligent insights on future technologies, R&D activities, and breakthrough product developments

The report answers questions such as:1. What is the market size and forecast of the Global Email Encryption Market?2. What are the inhibiting factors and impact of COVID-19 shaping the Global Email Encryption Market during the forecast period?3. Which are the products/segments/applications/areas to invest in over the forecast period in the Global Email Encryption Market?4. What is the competitive strategic window for opportunities in the Global Email Encryption Market?5. What are the technology trends and regulatory frameworks in the Global Email Encryption Market?6. What is the market share of the leading vendors in the Global Email Encryption Market?7. What modes and strategic moves are considered suitable for entering the Global Email Encryption Market?Read the full report: https://www.reportlinker.com/p06169055/?utm_source=GNW

About ReportlinkerReportLinker is an award-winning market research solution. Reportlinker finds and organizes the latest industry data so you get all the market research you need - instantly, in one place.

__________________________

Story continues

Continued here:
Email Encryption Market Research Report by Type, by Component, by Industry, by Deployment, by Region - Global Forecast to 2026 - Cumulative Impact of...

Yes, ransomware is your number one security nightmare. But heres how to sleep easy – The Register

Advertorial It may have escaped your notice, but last month was Cybersecurity Awareness month, and this years theme is Do Your Part. Be #CyberSmart.

That might sound slightly simplistic, but it does remind us that everyone has a role to play in keeping what is arguably the biggest security nightmare at bay. And yes, were talking ransomware.

And, just as over the last year washing our hands became something we do for the common good, the first step to blocking ransomware is some basic cyber hygiene, as detailed by Thales chief product security officer, Robert Burns, here. This runs from acknowledging and preparing for the threat, hardening your systems, segmenting your network, and making sure all your data is encrypted ultimately making the ransomware merchants own encryption, or exfiltration, plans pointless.

Thats a start, but if youd like a deeper dive into the implications of ransomware, check out this whitepaper.

Just in case you hadnt fully grasped the nature of the ransomware threat, it recaps the vital statistics such as a victim every 11 seconds and a $20bn total cost to business this year as well as highlighting some of the most egregious attacks so far.

But it also takes you deep into the anatomy of a ransomware attack, walking you through the seven stage Cyber Kill Chain, and highlighting why traditional baseline security falls woefully short in countering these threats, right along the line.

Which will no doubt leave you asking what, exactly, you can do beyond following basic hygiene and hoping for the best. Thankfully, the whitepaper also delivers you a detailed recipe for blocking ransomware with robust data access policies, and yes, encryption on your part is part of the mix.

You also get a detailed walk through of the sort of rule making process you should expect a data access platform to enable.

Needless to say, the remorseless nature of cyber attacks makes it hard to trust anyone. But you can trust us when we say youll finish up that little lot better informed than when you started. And that is the first step to protecting your systems. This month, next month, and beyond.

Sponsored by Thales

Excerpt from:
Yes, ransomware is your number one security nightmare. But heres how to sleep easy - The Register

How To Talk to Strangers Where No One Can See You – The Phoenix – Swarthmore College The Phoenix Online

Today, Im writing about something that was first used by the Ancient Mesopotamians. It used to be illegal to export under weapons trafficking treaties, and it is frequently bemoaned by law enforcement. Its also a critical component of almost every electronic device, and without it, the global economy would come to a screeching halt. Im talking, of course, about encryption algorithms.

Encryption is technically a subset of cryptography, which is the study of how to communicate securely in the presence of an adversary (who might try to eavesdrop, edit, or disrupt said communication). To encrypt something is to take some information, like my password is 1234, and combine it with a key (a chunk of hopefully random data) via some encryption algorithm such that it becomes unreadable gibberish. Said gibberish is only decipherable by providing an identical key, or a key thats mathematically related to the original key in a complicated way.

The kind of encryption youre most likely familiar with is symmetric encryption: encrypt a message with one key, and decrypt it with the same key. Symmetric encryption dates back to ancient times; Julius Caesar invented (or popularized) a cipher where the letters of the alphabet were simply shifted some number of places down (e.g. A becomes C, B becomes D, and so on). But cryptography didnt really take off until the early 20th century, with the advent of technologies like radio, which enabled longer-range communication at the cost of being trivially easy to eavesdrop on. World War II saw use of the Enigma Machine, a fascinatingly complicated electromechanical device that was only decoded by the Allies after a Herculean effort. These days, though, encryption generally refers to modern computerized algorithms like AES.

AES is short for Advanced Encryption Standard and has been the standardized encryption method for the U.S. governments classified information since 2002. Its also used for most web traffic, disk encryption on iOS and macOS, password managers, end-to-end encrypted chat applications, and a zillion other things. In fact, most modern processors have specific hardware components just to encrypt and decrypt AES data. But symmetric encryption still has a flaw: you need both parties to have the same key for them to talk to each other. How does that happen when theres no secure communication channel, like when accessing a website over the Internet? It would obviously be impractical for every computer to come pre-programmed with what would be millions or billions of different encryption keys for everything. So, we need a way for two parties, communicating solely over an insecure communication channel, to have a conversation thats impervious to eavesdropping. It sounds impossible, but as it turns out, its perfectly achievable with a bit of sorcery known broadly as asymmetric-key encryption.

Its not particularly an exaggeration to say that without asymmetric-key encryption, the Internet wouldnt exist anywhere near its current form. It would be impossible to transmit any sensitive information like credit cards, passwords, or private email, unless you obtained an encryption key offline (which kind of obviates the entire point). Its hard to speculate on exactly what an Internet in this world would look like, or whether it would exist at all, but I can safely say that it would be a lot worse than it is now.

So how does asymmetric-key encryption work? The first hint is in a more common name for it: public-key cryptography. Instead of one key that encrypts and decrypts (symmetric encryption), asymmetric encryption uses a pair of keys: a public key and a private key. If you encrypt a message with the public key, it can only be decrypted with the corresponding private key, and theres no way you can figure out the private key from just the public key. So, you can make the public key as public as you want: transmit it over a public WiFi network, give it to your friends, even post it on social media. Meanwhile, the private key is private only to you. If someone wants to send you a message, all they have to do is encrypt it with your freely available public key and transmit it to you through any channel, even an insecure one. You can think of public-key cryptography as like a safe with two separate keys one key can only lock, and the other one can only unlock. You can duplicate the locking key as much as you want, and anyone can use it to put stuff in the safe and then lock it. But to access whats inside after the safe has been locked, youd need your secret unlocking key.

But the lock analogy breaks down at a certain point, because theres no difference in principle between the public and private key. If I encrypt something with my private key, it can only be decrypted with the corresponding public key. This is useful for identity verification through something called a digital signature. If I take a message, encrypt it (or sign it) with my private key, and publish the encrypted and original messages together, then you can verify the encrypted message decrypts successfully to the original. If they match, then you know I am who I say I am. (This concept, by the way, is key to the security of blockchain-based cryptocurrency: transfers out of a specific account are only accepted by the rest of the network if they have a valid digital signature proving that whoever submitted the transfer possesses the private key for said account.)

The specific mathematical underpinning behind public-key cryptography is sort of complicated and varies based on the specific algorithm. For many algorithms, we rely on the fact that multiplying very large numbers together is relatively easy, while finding the factors of a very large number is very, very hard. (For performance reasons, some modern algorithms use things that are kind of similar to large numbers like elliptic curves, but we can safely ignore that.) Either way, though, the mathematical details of public-key cryptography are somewhat less interesting than the fact that it exists and you can do things with it.

Almost everything you do on the Internet nowadays relies on public-key cryptography. If youre reading this on a computer, the webpage was transmitted via the HTTPS protocol, which (to simplify things) means your computer transmitted an encrypted request using The Phoenix websites public key, which lets your computer talk to the server through a private channel. If youre reading this in the print edition, then public-key cryptography was still involved I send in these articles via email, which involves my computer making a secure connection to my mail server using its public key via the same method. (Technically, asymmetric encryption is generally used just to secretly transmit a key for symmetric encryption, since symmetric encryption is considerably faster.)

But why does any of this matter, aside from it being really cool and interesting? Well, Ive previously written about why HTTPS makes paying for a VPN somewhat unhelpful for a lot of people. Today, though, Im going to cover end-to-end encryption, which is a fascinating application of cryptography and an interesting thing to be aware of in your own life.

When you send an email, its (usually) encrypted in transit via the methods I talked about above: if someone is eavesdropping on your Internet traffic, they cant read your mail. But once it reaches your mail server, its decrypted and is readable by your mail provider (e.g. Gmail). Its important to note that readable doesnt mean someone at Google is regularly snooping through your mail to learn all your secrets, it just means that Googles systems can process the plain contents of messages. This can be for innocuous reasons: checking whether messages are spam, for instance, or automatically adding a booking to your calendar based on a confirmation email. But theres nothing technically stopping Google from scanning your email to target advertisements. (Google explicitly says that they dont do this. Sometimes it might seem like they do, but those are often cases where, e.g., you search for winter coats, spend an hour browsing winter-coat-related websites, and then see an ad for winter coats next to an email you sent to a friend asking about coat recommendations.)

But the fact that Google could read your email if they wanted to is more important in a different way: if Google can theoretically do it, then the government can too. If youre worried about government surveillance (from any government), then you dont care what a company says they will or wont look at, you want a cryptographic guarantee that they cant provide data to anyone even if they were made to by a court order, subpoena, or police raid. This is where end-to-end encryption comes in.

End-to-end encryption is when your data stays encrypted all the way from you to the person or people youre talking to. Most commonly, this is in the context of chat applications like WhatsApp or iMessage. To secure your messages, instead of the server publishing its public key, everyone on the service publishes a public key. The private keys never leave each persons device. If you want to send a message to your friend, you ask the server for your friends public key and use it to encrypt the message. The server here just passes encrypted messages back and forth, so all it can possibly know is when you send messages and who you send them to. (Through a little bit more cryptography, its actually also possible to also obscure the fact that youre sending the messages kind of like dropping a letter in a mailbox without writing a return address.) Actual end-to-end encryption as implemented also uses a bit more stuff on top of the public/private key business, via something called a double ratchet: the two parties constantly change their public and private keys via an agreed-upon method. This means that if a private key is compromised, an attacker can only view a few messages before the keys are regenerated.

Full end-to-end encryption (or at least, end-to-end encryption that didnt suck) was pioneered in 2013 by what would eventually become Signal. Signal was the first end-to-end encrypted messaging app that tried to be usable by non-computer-nerds while still being secure, and as a result has seen extensive use among whistleblowers, journalists, and any social movement you care to name. But whats had an even bigger impact is the Signal Protocol that the Signal app was built on. The protocol defines a standardized and secure method for sending text and other communication completely securely between two or more parties. In 2016, WhatsApp, the most popular messaging application in the world, switched over to the Signal Protocol for all of its messages and data. This means that every text sent on WhatsApp is unreadable to WhatsApp, its parent company Facebook, or anyone else, except the intended recipients. (Unlike Signal, however, WhatsApp does collect and use data about when and to whom messages were sent, and might use that information to target advertisements.)

So, if end-to-end encryption is so easy to use, why isnt it used for everything? Mostly because it turns out that not having a usable copy of your data stored on a companys servers is annoying from a usability standpoint for anything more complicated than simple text chat. You may have experienced this yourself if youve ever been added to a WhatsApp group chat in progress: since previous messages were only encrypted with the previous participants keys, you cant read them and miss any context that happened before you got there. End-to-end encryption also means that mirroring messages or conversations between multiple devices is difficult: since only your phone holds the keys to decrypt the messages, keeping chat records consistent between your laptop and phone requires awkward relay setups. Finally, its sort of pointless for public-facing things like social media where everyone is supposed to be able to read it anyway.Notice that in this article I havent really talked about any possibility of breaking a key. Thats because modern encryption algorithms are, for all intents and purposes, unbreakable: cracking a single 256-bit AES key with every computer on the planet would take about 14 thousand trillion trillion trillion trillion, or 14,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, years.

Its impossible to even begin to give a perspective on how big that number is. If you try to express it in terms of multiples of the age of the universe, another mind-bogglingly big number, you get another number thats still too big to properly express. (About 900 thousand trillion trillion trillion times the age of the universe, if youre wondering.) But the fact that properly implemented AES encryption is effectively impossible to break via computational brute force doesnt mean that your secrets are necessarily safe from, say, regular brute force (as a classic xkcd comic illustrates). One of the fundamental lessons of encryption (and indeed of all computer security) is that the humans that use encryption algorithms are almost always more vulnerable to deception, persuasion, or blunt force trauma than the algorithms themselves. It doesnt matter how big your encryption key is if the password used to generate said key is just the word password.

Read the original post:
How To Talk to Strangers Where No One Can See You - The Phoenix - Swarthmore College The Phoenix Online

Vaultree’s Executive Team and Advisors Drive Innovation in the Cybersecurity Industry – Yahoo Finance

Encryption Startup Assembles Expert Security Advocates to Guide Company Growth

CORK, Ireland, Nov. 18, 2021 /PRNewswire/ -- Vaultree, provider of Encryption-as-a-Service, announced today that it has assembled a highly qualified roster of executives and advisors comprising some of the cybersecurity industry's most experienced luminaries. This team brings together engineering know-how and business-savvy entrepreneurship to steer Vaultree's direction and growth.

(PRNewsfoto/Vaultree)

The executive team is made up of five co-founders who bring a wealth of varied experience:

Dr. Kevin Curran is a professor of cybersecurity, executive co-director of the Legal Innovation Centre and group leader of the Cyber Security and Web Technologies Research Group at Ulster University. He sits on the Advisory Group of the UK Cyber Security Council and the Northern Ireland Civil Service Cyber Leadership Board (FBBA).

Maxim Dressler is a project and sales leader with international experience in the software and fintech industry in leading commercial and strategic roles. His drive to make his clients' lives easier has contributed to his track record of establishing new brands, opening markets and implementing processes.

Ryan Lasmaili is a commercial and strategic leader with international experience in leading complex projects across different verticals. With 12 years of startup experience, he is an expert in technical product development, market growth strategy and business operations. In the last five years, Ryan's core focus has been on complex cybersecurity and encryption development.

Shaun McBrearty is a software security engineer with over 10 years of experience in designing, implementing, testing and deploying cryptographic solutions. His expertise is developing solutions that overcome the shortcomings of traditional cryptographic algorithms.

Tilo Weigandt is a program manager, strategic tech marketer and business developer with a "nothing is impossible" attitude and more than a decade of experience in starting things from scratch, developing highly scalable tech products, business segments and brands in global markets. Data protection lies at the heart of everything he has been implementing.

These experts comprise Vaultree's Board of Advisors:

Story continues

John N. Stewart Former Cisco chief security & trust officer and "Startup Whisperer," using his 30 years of cybersecurity experience to provide guidance to startups.

Sarah Armstrong-Smith Microsoft's chief security advisor and a keynote speaker on cybersecurity and information protection.

Stav Pischits Co-founder at Cynance and Cyber Club London, and a director of ISACA.

Rik Ferguson Vice president of security research at Trend Micro, special advisor to Europol's Cybercrime Centre, and co-founder of Respect in Security.

David Currie Nubank's chief information security officer with a history of IT leadership roles, including cryptography.

Leticia Gammil Cisco Security channels leader and the founder and president at WOMCY, a non-profit focused on the development of cybersecurity.

Andreas Bittner Managing director at Vanguard and a co-founder and COO of Solaris Bank.

Rik Ferguson, Vaultree advisor and vice president of security research at Trend Micro, said: "The world of cybercrime and the lack of accessible and affordable data encryption continues to be a threat to businesses around the globe. During my 27 years of experience in information security, I have yet to see a solution that offers a fully encrypted, searchable and scalable solution like Vaultree's, which is why I am working with this team of experts."

Shaun McBrearty, co-founder, Vaultree, said: "Cybercrime rates are climbing every year, proving a need for a new generation of data protection. This is why we made it our mission to create an encryption-as-a-service software that provides a scalable, easy-to-use solution to protect business data and make data protection attainable for enterprises of any size. We are grateful to be working with a seasoned team of experts as we chart our growth course."

About VaultreeVaultree's Encryption-as-a-Service solution enables businesses of all sizes to process fully end-to-end encrypted data. Easy to use and integrate, Vaultree delivers peak performance without compromising security, neutralizing the weak spots of traditional encryption. Follow Vaultree on Twitter @Vaultree or LinkedIn. Visit http://www.vaultree.com and join our waitlist to stay up to date on product development and company news.

Media Contact Madison DailyNadel Phelan, Inc. madison.daily@nadelphelan.com

Cision

View original content to download multimedia:https://www.prnewswire.com/news-releases/vaultrees-executive-team-and-advisors-drive-innovation-in-the-cybersecurity-industry-301427750.html

SOURCE Vaultree

Read more:
Vaultree's Executive Team and Advisors Drive Innovation in the Cybersecurity Industry - Yahoo Finance