Rambus

At Rambus, we create cutting-edge semiconductor and IP products, providing industry-leading chips and silicon IP to make data faster and safer.

Home > You searched for cryptomanager > Page 39

Search Results for: cryptomanager

Buying Guide

Rambus Icon

Buying Guide

Rambus delivers a variety of offerings and engagement options to provide an enhanced customer experience and to improve our customers’ time-to-market. Focused on bringing invention to market through licenses, solutions and services, Rambus is a collaborative and entrepreneurial company dedicated to the success of its customers.

Contact

Is the Internet held together with Band-Aid fixes?

Earlier this week, the New York Times interviewed Paul Kocher, president and chief scientist of the Rambus Cryptography Research division, about the recent slew of high-profile digital attacks that have targeted numerous corporations and government entities.

“[Kocher] says he thinks the explanation for the world’s dismal state of digital security may lie in two charts,” writes Nicole Perlroth.

internetbandaid

“One shows the number of airplane deaths per miles flown, which decreased to one-thousandth of what it was in 1945 with the advent of the Federal Aviation Administration in 1958 and stricter security and maintenance protocols. The other, which details the number of new computer security threats, shows the opposite.”

Indeed, as Perlroth points out, there has been more than a 10,000-fold increase in the number of new digital threats over the last 12 years.

“The problem, Mr. Kocher and security experts reason, is a lack of liability and urgency. The Internet is still largely held together with Band-Aid fixes,” Perloth continues.

“Computer security is not well regulated, even as enormous amounts of private, medical and financial data and the nation’s computerized critical infrastructure — oil pipelines, railroad tracks, water treatment facilities and the power grid — move online.”

Consequently, ideas that were once confined to research labs are now being evaluated for potential use in future products. As Kocher noted in an October New York Times op-ed, the market is steadily progressing towards safer technologies, with cryptographic algorithms providing the mathematical building blocks for security and privacy. To be sure, dedicated security hardware that once occupied racks of equipment can now be manufactured on the corner of a chip for just a few cents.

As we’ve previously discussed on Rambus Press, legendary cryptographer Paul Kocher discovered timing cryptanalysis – a method of obtaining secret keys from cryptographic devices operating in non-constant time. More specifically, he determined that many RSA and Diffie-Hellman were executing simple operations faster than more complex ones, allowing keys to be found by measuring the variations and applying innovative statistics.

Kocher also co-developed simple power analysis and differential power analysis, contributed to the design of Deep Crack (a DES brute-force key search machine) and co-authored the Secure Sockets Layer (SSL) 3.0 protocol, a cryptographic standard for secure communications over the Internet.

Interested in learning more? You can read the full text of “Hacked vs. Hackers: Game On” by Nicole Perlroth on the New York Times website here and check out Paul Kocher’s October op-ed “Moving to ‘smart’ credit cards will help with security” here.

 

What cryptographers can learn from The Imitation Game

The Imitation Game is a 2014 British-American historical drama film about British mathematician, logician, cryptanalyst and pioneering computer scientist Alan Turing.

[youtube https://www.youtube.com/watch?v=S5CjKEFb-sM]

As Wikipedia notes, Turing was a key figure in cracking Nazi Germany’s Enigma code that helped the Allies win World War II.

For legendary cryptographer Paul Kocher, who serves as President and Chief Scientist of the Cryptography Research Division at Rambus, antiquated Enigma machines epitomize the salient challenges faced by modern-day cryptographers.

Indeed, the early cryptography platform – invented by Arthur Scherbius at the close of World War 1 – was used commercially during the 1920s before being adopted by various militaries for enciphering and deciphering secret messages. However, as The Imitation Game artfully depicts, the Enigma code was famously cracked during World War II.

“Those who cannot remember the past are condemned to repeat it,” Kocher told Rambus Press during an interview in San Francisco earlier this year.

enigma-cryptomanager-connection

“The people who designed Enigma deemed the cipher unbreakable, yet it was ultimately cracked by a combination of Polish, French and British efforts.”

According to Kocher, who was recently inducted into the National Cyber Security Hall of Fame, cryptographers need to constantly question themselves to avoid being lulled into a false state of complacency – as adoption of cryptographic solutions continue to accelerate at a steady pace.

“Attackers have the luxury of being successful if the methods they try fail 99% of the time and succeed 1%,” Kocher explained. “In contrast, for system designers, failing even 1% of the time is unacceptable. We need to secure systems 100% of the time, and a 1% failure rate isn’t good enough, so we’re constantly asking ourselves what we might be missing.”

The Imitation Game hits select U.S. theaters on November 28, 2014.

Securing the IoT starts at the core

Writing for NewElectronics, Ben Jun of the Cryptography Research division of Rambus says securing the Internet of Things (IoT) starts at the core.

“The risks associated with a rapidly growing IoT include privacy, unauthorized access, malicious control and denial of service,” he explains.

securing-the-iot-starts-at-the-core

“[Multiple] companies are developing solutions to address a diverse set of security requirements across multiple platforms and chips. The most robust security approaches bake security into the initial design and manufacturing of a SoC.”

According to Jun, numerous deployment scenarios require that IoT devices be provisioned with credentials and keys before they leave the device vendor’s facility.

“In today’s systems, the process of key injection during fabrication and test operations could potentially expose vulnerable key data,” he continues.

“In addition, test and debug capabilities are often fully enabled on chips by default – a relatively common practice that inadvertently creates additional security challenges.”

To be sure, embracing a hardware-first strategy and implementing the necessary functionality on the SoC level is a key element of fully securing devices and platforms such as FPGAs, wearables, smartphones, tablets and intelligent appliances.

“Although many continue to take security for granted, the importance of adopting a hardware-based approach at the most basic core level cannot be overemphasized,” he concludes.

“Aside from ensuring fundamental chip security during manufacturing, embedding the right security IP core into a SoC can help manufacturers design devices, platforms and systems that remain secure throughout their respective lifecycles.”

Interested in learning more? The full text of “Outlook 2015: Securing the IoT starts at the core” can be read on NewElectronics here.

 

Paul Kocher talks smart credit cards with the New York Times

Paul Kocher, the president and chief scientist of Rambus Cryptography Research division, recently penned an article for the New York Times about the long-overdue U.S. upgrade to “smart” credit cards equipped with security chips.

The cards – which employ a protocol known as E.M.V. – are currently widely used throughout Europe and the rest of the world. However, most American cards today are only equipped with a magnetic strip to verify authorized customer activity.

paul-kocher-talks-smart-credit-cards-with-the-new-york-times

“With a magnetic stripe, payment terminals access all the information required to produce a clone of the card,” writes Kocher. “In contrast, the E.M.V. cards give merchants nonreusable authentication codes, drastically reducing the potential for fraudulent use of information that can be hacked from retailers.”

According to Kocher, the upgrade will deny cyber criminals one of their most lucrative strategies, although they certainly won’t be throwing in the digital towel anytime soon.

“Instead they’ll shift to other lucrative (though somewhat less attractive) ways to profit from stolen data and credentials, such as stealing from brokerage accounts, forging checks, filing bogus tax refunds and engaging in insider trading and medical billing schemes,” Kocher attests. “More systems will get attacked and then upgraded, technical advances will create new and greater opportunities for abuse, and the cycle will continue.”

Nevertheless, says Kocher, the market is steadily progressing towards safer technologies, with cryptographic algorithms providing the mathematical building blocks for security and privacy. Indeed, dedicated security hardware that once occupied racks of equipment can now be manufactured on the corner of a chip for just a few cents.

“The E.M.V. roll-out is a critical first step, but it will take a long time to shift our critical security tasks away from complex microprocessors and their software to simpler, well-isolated circuits and chips built for security,” he concludes.

As we’ve previously discussed on Rambus Press, legendary cryptographer Paul Kocher discovered timing cryptanalysis – a method of obtaining secret keys from cryptographic devices operating in non-constant time. More specifically, he determined that many RSA and Diffie-Hellman were executing simple operations faster than more complex ones, allowing keys to be found by measuring the variations and applying innovative statistics.

Kocher also co-developed simple power analysis and differential power analysis, contributed to the design of Deep Crack (a DES brute-force key search machine) and co-authored the Secure Sockets Layer (SSL) 3.0 protocol, a cryptographic standard for secure communications over the Internet.

Understanding the IoT’s evolving requirements

A new report published by Beecham Research confirms that a successful attack against cyber-physical systems connected to the Internet of Things (IoT) has the potential to cause significant damage to individuals, businesses and national critical infrastructure.

“While we may have some visibility of potential attacks over a few months, we need to protect IoT devices in the field for 10 years or longer,” explained Professor Jon Howes, one of the authors of the report and Technology Director at Beecham Research.

“Devices must be securely managed over their entire lifecycle, to be reset if needed and to enable remote remediation to rebuild and extend security capabilities over time.”

According to Howes, the answer to these security challenges lies at the architectural level for both device and systems – stretching from semiconductors to network operators and systems integrators. This approach, he says, illustrates the need for common security objectives across the industry, as well as interoperability within broad systems.

“The attack surface of an Internet of Things system may be substantially larger than traditional PCs, as the complexity of ensuring multiple vendors’ systems working together will lead to a greater probability of exploits being available,” Howes continued.

“We have all become familiar with computer malware but the impact of equivalent IoT attacks could be to turn off a heating system in the middle of winter or take control of other critical IoT systems, which could be potentially life threatening.”

Rambus Fellow and futurist Rich Page concurs with Howes’ assessment.

“Ensuring the security of the rapidly emerging IoT is undeniably complex. This is why the current design approach to connected devices is undergoing a paradigm shift, with security being treated as a first design goal, rather than a tertiary priority,” Page told Rambus Press during a recent interview in Sunnyvale.

“It is also important to understand that cyber criminals may be motivated to compromise IoT systems for a wide variety of reasons, including fame, financial gain (theft/blackmail), the desire to cause temporary trouble (criminal mischief), or an ideological intent to inflict permanent damage (terrorism).”

For example, says Page, an attacker intent on criminal mischief may be content with simply hijacking Bluetooth-enabled deadbolt locks for kicks.

“Seizing control of deadbolts could be used to lock people out of their homes or open doors, leaving residents vulnerable to theft. It is not all that difficult to imagine the risks associated with IoT deadbolt locks managed by cloud-based servers. Similarly, hacking into a celebrity’s smartwatch and stealing workout data would be somewhat embarrassing for the victim, although the act isn’t likely to lead to injury or death,” he said.

“In contrast, disrupting a smart grid, an act that affects millions, if not tens of millions, would almost certainly be far more dangerous with immediate effects. It is a definite possibility that successful cyber attacks could very well leave us just 9 meals from anarchy. Of course, there are also seasonal variables to consider. Imagine Las Vegas in the summertime without air conditioning, or downed power plants in Boston during wintertime. To be sure, a series of documented digital intrusions over the past 15 years indicate the electric grid and related industrial controls remain vulnerable.”

As Page points out, various analysts and journalists have also voiced concern over the security of IoT-connected cars in recent months.

“The auto industry seems to be making rapid progress with self-driving vehicles. In general, this should be perceived as a positive development, although security protocols and standards will have to be ironed out before fleets of autonomous cars and trucks hit the road en masse,” he noted.

“Adopting a hardware-first approach to security – specifically on the SoC level – is a critical element of protecting all embedded technology – whether for wearables, smartphones, tablets or vehicles. Remember, a software-centric security strategy for vehicles, as well as other IoT platforms and devices, will inevitably require frequent updates. However, it is likely that most companies, automotive or otherwise, will stop pushing out new patches after a decade or so.”

Haydn Povey, Technical Associate and former Director of Secure Products at ARM expressed similar sentiments in the abstract introducing Beecham’s IoT security report.

“While many technologies such as advanced cryptography are being introduced in current IoT devices, governments around the world are concerned about the acceleration of IoT and agree that there is significantly more work needed to meet the demands of future threats as outlined in the ‘20 Critical Security Controls,’ originally developed by the Council for Cybersecurity for mainstream IT security,” Povey added.

“There is an urgent need to deliver cost effective solutions that enable robust security but also to retain the flexibility to deliver real benefits in the face of expected threats. This requires well-architected and interoperable frameworks across vendors and technologies, integrated at an IP and silicon level to enable the evolution of security services the whole industry can leverage.”

In a broader sense, says Page, security serves as the very foundation of a dynamic IoT, effectively facilitating the safe transfer of immense amounts of data across global networks.

“As the era of The Internet of Things evolves, the data being generated and moved across networks will continue to push the performance of the communication infrastructure well into the future,” he explained. “It is therefore essential to address the key needs for storing and transporting data in mobile clients and datacenters with low-power, high-performance memory and serial link interfaces.”

Indeed, datacenter power challenges arise from the sheer scale of aggregating tens of thousands of servers into a single facility. Moving data from one place to another – whether across a chip, between chips in the same system, or longer distances between servers and racks of servers – consumes a significant amount of the power budget in datacenter systems.

According to Page, reducing power consumption and improving data bandwidth rates is just as critical to meet the demands of next-gen mobile devices and wearables, the latter of which is increasingly being used for tasks such as health monitoring, augmented reality and video/image capture.

“Petabytes of data are continuously generated from a wide range of devices and platforms, including PCs, servers, smartphones, tablets, smart grids, connected cars, Maker boards, thermostats, intelligent appliances and wearables,” he concluded. “This never-ending flow of information requires a corresponding increase in bandwidth capacity, as well as hardware-based solutions that offer a solid foundation upon which secure software and services can be designed and built.”

Rambus logo