Cloud Hosting

Mega, the New Zealand-based file-sharing biz co-founded a decade ago by Kim Dotcom, promotes its "privacy by design" and user-controlled encryption keys to claim that data stored on Mega's servers can only be accessed by customers, even if its main system is taken over by law enforcement or others.

The design of the service, however, falls short of that promise thanks to poorly implemented encryption. Cryptography experts at ETH Zurich in Switzerland on Tuesday published a paper describing five possible attacks that can compromise the confidentiality of users' files.

The paper [PDF], titled "Mega: Malleable Encryption Goes Awry," by ETH cryptography researchers Matilda Backendal and Miro Haller, and computer science professor Kenneth Paterson, identifies "significant shortcomings in Megas cryptographic architecture" that allow Mega, or those able to mount a TLS MITM attack on Mega's client software, to access user files.

The findings, detailed on a separate website, proved sufficiently severe that Kim Dotcom, no longer affiliated with the file storage company, advised potential users of the service to stay away.

Mega chief architect Mathias Ortmann meanwhile published a blog post announcing a client software update addressing three of the five flaws identified by the researchers, promising further mitigations, and thanked the ETH Zurich boffins for responsibly reporting their findings.

"The first two attacks exploit the lack of integrity protection of ciphertexts containing keys (henceforth referred to as key ciphertexts), and allow full compromise of all user keys encrypted with the master key, leading to a complete break of data confidentiality in the MEGA system," the paper explains. "The next two attacks breach the integrity of file ciphertexts and allow a malicious service provider to insert chosen files into users cloud storage. The last attack is a Bleichenbacher-style attack against MEGAs RSA encryption mechanism."

The major issue here is that Mega's method for deriving the various cryptographic keys used to authenticate and encrypt files fails to check for key integrity. So a malicious server can tamper with the RSA private key and make it leak information.

The first issue is an RSA Key Recovery Attack. It allows an attacker controlling the Mega API or able to mount a TLS MiTM attack on the client, to abuse the authentication protocol to extract the user's private key. This is done by constructing an oracle a mathematical data leak to gather one bit of information per login attempt about a factor of the RSA modulus an integer that's the product of two primes used to generate the cryptographic key pair.

This attack takes at least 512 login attempts to carry out. Mega in its post cites this figure to suggest the attack is difficult to carry out but the ETH researchers note that it's possible to further manipulate Mega's software to force the client to log in repeatedly, allowing the attack to fully reveal a key within a few minutes.

The second is a Plaintext Recovery Attack. "Building on the previous vulnerability, the malicious service provider can recover any plaintext encrypted with AES-ECB under a users master key," the paper explains.

"This includes all node keys used for encrypting files and folders (including unshared ones not affected by the previous attack), as well as the private Ed25519 signature and Curve25519 chat key. As a consequence, the confidentiality of all user data protected by these keys, such as files and chat messages, is lost."

Attacks three and four allow a malicious service provider to "break the integrity of the file encryption scheme and insert arbitrary files into the users file storage which pass the authenticity checks during decryption. This enables framing of the user by inserting controversial, illegal, or compromising material into their file storage."

While this may sound outlandish, framing political opponents with fabricated evidence has been documented and represents a real threat.

The fifth attack is described as "a new Guess-and-Purge variant of Bleichenbachers attack." It relies on a lot of guesses (2^17) to decrypt node and chat keys.

Proof-of-concept code for these attacks has been published on GitHub.

Ortmann said Mega intends to release a client fix for attack number four and to remove the legacy code that allows attack number five.

Paterson, via Twitter said Mega has taken some steps to address these attacks but expressed disappointment that the company hasn't committed to a thorough overhaul of its approach because its cryptography is "pretty fragile."

"On the other hand, to fix everything thoroughly, all of [Mega's] customers would have to download all their files, re-encrypt them, and upload them again," he said. "With 1000 Petabytes of data to deal with, that's going to hurt."

Paterson and his colleagues argue that companies should work to standardize secure cloud storage to avoid repeated ad hoc implementations that repeat the same errors.

"We believe that this would be the easiest path to avoid attacks stemming from the lack of expert knowledge among developers, and that it would enable users to finally have confidence that their data remains just that theirs," the paper concludes.

Read this article:
Mega's unbreakable encryption proves to be anything but - The Register

Read More..

Acla, H. B. & Gerardo, B. D. Security analysis of lightweight encryption based on advanced encryption standard for wireless sensor networks. In 2019 IEEE (6^{th})International conference on engineering technologies and applied sciences (ICETAS), 16 (2019).

Singh, P. & Kumar, S. Study & analysis of cryptography algorithms: RSA, AES, DES, T-DES, blowfish. Int. J. Eng. Technol. 7(15), 221225 (2018).

Google Scholar

Al-Muhammed, M. J. & Abuzitar, R. Mesh-Based Encryption Technique Augmented with Effective Masking and Distortion Operations. In Intelligent Computing (eds Arai, K. et al.) 771796 (Springer, Cham, 2019).

Niu, Y., Zhao, K., Zhang, X. & Cui, G. Review on DNA Cryptography. In Bio-inspired Computing: Theories and Applications (BIC-TA 2019) Vol. 1160 (eds Pan, L. et al.) 134148 (Springer, Singapore, April 2020).

Moe, K. S. M. & Win, T. Enhanced honey encryption algorithm for increasing message space against brute force attack. In 2018 15th international conference on electrical engineering/electronics, computer, telecommunications and information technology (ECTI-CON), pages 8689, (2018).

Juels, A. & Ristenpart, T. Honey Encryption: Security beyond the brute-force bound. In Advances in Cryptology-EUROCRYPT 2014 Vol. 8441 (eds Nguyen, P. Q. & Oswald, E.) 293310 (Springer, Berlin, Heidelberg, May 2014).

Chen, Y. The existence of homoclinic orbits in a 4D Lorenz-type hyperchaotic system. Nonlinear Dyn. 87(3), 14451452 (2017).

MathSciNet Article Google Scholar

Kondrashov, A. V., Grebnev, M. S., Ustinov, A. B. & Perepelovskii, V. V. Application of hyperchaotic Lorenz system for data transmission. J. Phys. 1400(4), 044033 (2019).

Wang, X. et al. A chaotic image encryption algorithm based on perceptron model. Nonlinear Dyn. 62, 615621 (2010).

Article Google Scholar

Zhang, Y., Wang, Z., Liu, X. & Yuan, X. A DNA-based encryption method based on two biological axioms of DNA chip and polymerase chain reaction (PCR) amplification techniques. Chemistry 23, 1338713403 (2017).

CAS Article Google Scholar

Wang, X. & Wang, M. A hyperchaos generated from Lorenz system. Physica A 387, 37513758 (2008).

ADS MathSciNet Article Google Scholar

Zhang, F. & Zhang, G. Dynamical analysis of the hyperchaos Lorenz system. Complexity 21, 440445 (2016).

ADS MathSciNet Article Google Scholar

Yong, Z. A chaotic system based image encryption scheme with identical encryption and decryption algorithm. Chin. J. Electron. 26(5), 10221031 (2017).

Article Google Scholar

Li, W., Wang, C., Feng, K., Huang, X. & Ding, Q. A multidimensional discrete digital chaotic encryption system. Int. J. Distrib. Sens. Netw. 14(9), 18 (2018).

Google Scholar

Marsaglia, G. Xorshift RNGs. J. Stat. Softw., 8(14), (2003).

Stallings, W. Cryptography and network security: Principles and practice. Pearson, (8^{th}) edition, (July 2019).

Thoms, G. R. W., Muresan, R. & Al-Dweik, A. Chaotic encryption algorithm with key controlled neural networks for intelligent transportation systems. IEEE Access 7, 158697158709 (2019).

Article Google Scholar

Al-Muhammed, M. J. A novel key expansion technique augmented with an effective diffusion method. J. Comput. Fraud Secur. 2018(3), 1220 (2018).

Article Google Scholar

Daemen, J. & Rijmen, V. The design of Rijndael: AESthe advanced encryption standard. Springer-Verlag,(2002).

Federal Information Processing Standards Publication 180-3. Secure Hash Standard, (2008). http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.

Gueron, S., Johnson, S. & Walker, J. SHA-512/256. In Proceedings of the eighth international conference on information technology: New generations, pages 354358, Las Vegas, NV, USA, (2011). IEEE.

Anderson, M., Motta, R., Chandrasekar, S. & Stokes, M. Proposal for a standard default color space for the internet-sRGB. In Proceeddings of(4^{th})Color and imaging conference final program 238245 (Scottsdale, Arizona, 1996).

Stokes, M., Anderson, M., Chandrasekar, S. & Motta, R. A Standard default color space for the internetsRGB, version 1.10. Technical report, HewlettPackard, (1996).

Walker, J. ENT: A pseudorandom number sequence test program, Fourmilab: Switzerland, (2008). https://www.fourmilab.ch/random/.

Soto, J. et al. Randomness testing of the AES candidate algorithms, (1999).

Lawrence, E., Andrew, L., Rukhin, J. S, Nechvatal, J. R., Smid, M. E., Leigh, S. D., Levenson, M., Vangel, M., Heckert, N. A. & Banks, D. L. A Statistical test suite for random and pseudorandom number generators for cryptographic applications. Special Publication (NIST SP) - 800-22 Rev 1a, September (2010).

Wang, X. & Gao, S. Image encryption algorithm ased on the matrix semi-tensor product with a compound secret key produced by a Boolean network. Inf. Sci. 539, 195214 (2020).

Article Google Scholar

Khalid, B. K., Guohui, L., Sajid, K. & Sohaib, M. Fast and efficient image encryption algorithm based on modular addition and SPD. Entropy, 22(1), (2020).

Wang, X., Feng, L. & Zhao, H. Fast image encryption algorithm based on parallel computing system. Inf. Sci. 486, 340358 (2019).

Article Google Scholar

Wang, X., Teng, L. & Qin, X. A novel colour image encryption algorithm based on chaos. Signal Process. 92(4), 11011108 (2012).

MathSciNet Article Google Scholar

Patil, P., Narayankar, P., Narayan, D. G. & Meena, S. M. A comprehensive evaluation of cryptographic algorithms: DES, 3DES, AES, RSA and Blowfish. Proc. Comput. Sci. 78, 617624 (2016).

Article Google Scholar

Kumar, M., Saxena, A. & Vuppala, S. S. A survey on chaos based image encryption techniques Vol. 884 (Springer, Cham, 2020).

Su, Z., Zhang, G. & Jiang, J. Multimedia security: A survey of chaosbased encryption technology, pages 99124. Multimedia-A Multidisciplinary Approach to Complex Issues. InTech, (2012).

Wang, X. Y. & Gu, S. X. New chaotic encryption algorithm based on chaotic sequence and plaintext. ET Inform. Secur. 8(3), 213216 (2014).

Article Google Scholar

Nesa, N., Ghosh, T. & Banerjee, I. Design of a chaos-based encryption scheme for sensor data using a novel logarithmic chaotic map. J. Inform. Secur. Appl. 47, 320328 (2019).

Google Scholar

Wu, X., Zhu, B., Hu, Y. & Ran, Y. A novel color image encryption scheme using rectangular transform-enhanced chaotic tent maps. IEEE Access 5, 64296436 (2017).

Google Scholar

Abanda, Y. & Tiedeu, A. Image encryption by chaos mixing. IET Image Process 10(10), 742750 (2016).

Article Google Scholar

Kocarev, L., Makraduli, J. & Amato, P. Public-key encryption based on Chebyshev polynomials. Circ. Syst. Signal Process. 24(5), 497517 (2005).

MathSciNet Article Google Scholar

Amani, H. R. & Yaghoobi, M. A new approach in adaptive encryption algorithm for color images based on DNA sequence operation and hyper-chaotic system. Multimed. Tools Appl. 78, 2153721556 (2019).

Article Google Scholar

Babaei, M. A novel text and image encryption method based on chaos theory and DNA computing. Nat. Comput. 12, 101107 (2013).

MathSciNet CAS Article Google Scholar

Liu, H. & Wang, X. Color image encryption based on one-time keys and robust chaotic maps. Comput. Math. Appl. 59(10), 33203327 (2010).

MathSciNet Article Google Scholar

Wang, X. & Yang, J. A privacy image encryption algorithm based on piecewise coupled map lattice with multi dynamic coupling coefficient. Inf. Sci. 569, 217240 (2021).

MathSciNet Article Google Scholar

Wang, X. & Gao, S. Image encryption algorithm based on the matrix semi-tensor product with a compound secret key produced by a Boolean network. Inf. Sci. 539, 195214 (2020).

MathSciNet Article Google Scholar

Xian, Y. & Wang, X. Fractal sorting matrix and its application on chaotic image encryption. Inf. Sci. 547, 11541169 (2021).

MathSciNet Article Google Scholar

Wang, X., Liu, L. & Zhang, Y. A novel chaotic block image encryption algorithm based on dynamic random growth technique. Opt. Lasers Eng. 66, 1018 (2015).

Article Google Scholar

Belazi, A. et al. Efficient cryptosystem approaches: S-boxes and permutation-substitution-based encryption. Nonlinear Dyn. 87, 337361 (2017).

Article Google Scholar

Ren, W. & Miao, Z. A Hybrid Encryption Algorithm Based on DES and RSA in bluetooth communication. In Proceedings of the(2^{nd})international conference on modeling, simulation and visualization methods, pages 221225, Sanya, China, (May 2010). IEEE.

Schneier, B. Description of a new variable-length key, 64-bit block cipher (Blowfish). In Fast Software encryption, Cambridge security workshop, Cambridge, UK, December 9-11, 1993, Proceedings, volume 809 of Lecture Notes in Computer Science, pages 191204. Springer, (1993).

Modi, B. & Gupta, V. A Novel security mechanism in symmetric cryptography using MRGA. In Progress in intelligent computing techniques: Theory (eds Sa, P. et al.) 195202 (Springer, Singapore, 2018).

Weiping, P., Danhua, C. & Cheng, S. One-time-pad cryptography scheme based on a three-dimensional DNA Self-assembly pyramid structure. PLoS One 13(11), 124 (2018).

Google Scholar

Cui, G., Han, D., Wang, Y. & Wang, Z. An improved method of DNA information encryption. In Bio-inspired computing-theories and applications Vol. 472 (eds Pan, L. et al.) 7377 (Springer, Berlin, Heidelberg, 2014).

Chapter Google Scholar

Kals, S., Kaur, H. & Chang, V. DNA cryptography and deep learning using genetic algorithm with NW algorithm for key generation. J. Med. Syst. 42(1), 17 (2018).

Article Google Scholar

Liu, H., Wang, X. & Kadir, A. Image encryption using DNA complementary rule and chaotic maps. Appl. Soft Comput. 12(5), 14571466 (2012).

Article Google Scholar

Wang, X.-Y., Zhang, Y.-Q. & Bao, X.-M. A novel chaotic image encryption scheme using DNA sequence operations. Opt. Lasers Eng. 73, 5361 (2015).

CAS Article Google Scholar

Man, Z., Li, J., Di, X., Sheng, Y. & Liu, Z. Double image encryption algorithm based on neural network and chaos. Chaos, Solit. & Fract. 152, 111318 (2021).

MathSciNet Article Google Scholar

Shi, J. et al. An approach to cryptography based on continuous-variable quantum neural network. Sci. Rep. 10, 2107 (2020).

ADS CAS Article Google Scholar

Yin, W., Indulska, J. & Zhou, H. Protecting private data by honey encryption. Security and communication networks, 2017:9 pages, (2017).

Yoon, J. W., Kim, H., Jo, H. J., Lee, H. & Lee, K. Visual honey encryption: Application to steganography. In Proceedings of the(3^{rd})ACM workshop on information hiding and multimedia security, pages 6574, Portland, Oregon, USA, (2015). ACM.

Juels, A. & Ristenpart, T. Honey encryption: Security Beyond the BruteForce Bound. In Q. Nguyen Phong and O. Elisabeth, editors, Advances in CryptologyEUROCRYPT, volume 8441 of Lecture Notes in Computer Science, pages 293310. Springer, (2014).

Here is the original post:
Encryption technique based on chaotic neural network space shift and color-theory-induced distortion | Scientific Reports - Nature.com

Read More..

Ar_TH/Shutterstock.com

Windows 10 and 11s BitLocker feature, for Professional and Enterprise editions, encrypts your drive to help keep your data secure. If you dont want this encryption for some reason, its easy to disable BitLocker and decrypt your drive. Well show you how to do that.

If youre concerned about privacy and security, know that removing BitLocker encryption makes your drive data more accessible in certain situations. For example, if you use a dual-boot PC, the other operating system can access the data stored on your drive if youve disabled BitLocker. Also, if your laptop gets stolen or you lose it, whoever has it can access the unencrypted data on your machines drive.

If your concern is with remote hackers and thieves accessing your drives data while youre connected to the internet, keep in mind that BitLocker doesnt protect against that; your data is already decrypted while youre using the machine. Its the job of your firewall, yourantivirus software, and yourself as the user to protect you from online threats. Aperson or another operating system with physical access to your device will be your main concern if you choose to proceed.

RELATED: The Best Antivirus Software of 2022

To disable BitLocker on Windows 10 or Windows 11, youll follow these steps. We used a Windows 11 PC below to demonstrate the steps, but Windows 10 is virtually the same.

To get started, open the Start menu, search for Control Panel, and select Control Panel in the search results.

When Control Panel opens, click System and Security.

On the System and Security page, choose BitLocker Drive Encryption.

Next to the drive where youve enabled BitLocker, click Turn Off BitLocker.

Select the Turn Off BitLocker option.

Windows will now start decrypting the contents of your drive, which can take quite some time, especially if your drive has a lot of content on it. In the meantime, you can continue to work with your files as usual.

Your drive is now decrypted and you can access the data on it however you want.

If youre looking for an alternative to BitLocker, consider using Veracrypt, which is a free and open-source encryption tool.

RELATED: How to Secure Sensitive Files on Your PC with VeraCrypt

See original here:
How to Disable BitLocker Encryption on Windows 10 and 11 - How-To Geek

Read More..