• “Consider the use of smart cards ... for especially critical functions.  Although more costly than software, when properly implemented the assurance gain is great.  The form-factor is not as important as the existence of an isolated processor and address space for assured operations – an ‘Island of Security,’ if you will.  Such devices can communicate with each other through secure protocols and provide a web of security connecting secure nodes located across a sea of insecurity in the global net.”

    Brian Snow, Former Technical Director of the US National Security Agency (NSA), "We need assurance!", 1999-2008

  • “The more complex the threats become, the more you have to do the basics and groundwork really well. Staying aware and on top of new vulnerabilities and ensuring that patches and software updates are rapidly implemented is crucial.”

    Jeff Shipley, Cisco Intelligence Collection Manager, Cisco 2008 Annual Security Report

  • “Business now relies on information infrastructures that are interlinked and interdependent… The way in which these hidden interdependencies pervade our everyday lives is staggering and, in some cases, may go unchecked for many years until an incident occurs that revels the true nature of the interdependences' impact.”

    The British Government’s Technology Strategy Board, 2008
  • "History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It's always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you'll be glad you did."

    Bruce Schneier, "Why Cryptography Is Harder Than It Looks", 1997

  • “We are a cyber nation. The U.S. information infrastructure--including telecommunications and computer networks and systems and the data that reside on them--is critical to virtually every aspect of modern life. This information infrastructure is increasingly vulnerable to exploitation, disruption, and destruction by a growing array of adversaries.”

    The National Coordination Office (NCO) for Networking Information Technology Research and Development (NITRD), Federal Register: December 30, 2008 (Volume 73, Number 250).

  • “Never underestimate the attention, risk, money and time that an opponent will put into reading traffic.”

    Robert Morris, former Chief Scientist of the US National Security Agency (NSA), National Computer Security Center, "Crypto '95 invited talks by R. Morris and A. Shamir", 1995

  • “Briefly and simply, assurance work makes a user or a creditor more confident that the system works as intended without flaws, without surprises, even in the presence of malice.” … “The major shortfall is absence of assurance or safety mechanisms in software.  If my car crashed as often as my computer does, I’d be dead by now.”

    Brian Snow, Former Technical Director of the US National Security Agency (NSA), "We need Assurance", AusCERT 2008

  • “When will we be secure? Nobody knows for sure – but it cannot happen before commercial security products and services possess not only enough functionality to satisfy customers’ stated needs, but also sufficient assurance of quality, reliability, safety, and appropriateness for use. Such assurances are lacking in most of today’s commercial security products and services.”

    Brian Snow, Former Technical Director of the US National Security Agency (NSA), "We need Assurance", 2005

  • "Even a relatively small quantum computer, one that had a few tens of thousands of qubits, could consider so many different values at once that it would be able to break all known [ed: RSA, D&H, ECC, AES-128] codes commonly used for secure Internet communication.”

    Prof Seth Lloyd of MIT, MIT Review 2008

  • "Some physicists predicted that within the next 10 to 20 years quantum computers will be built that are sufficiently powerful to implement Shor’s ideas and to break all existing public key schemes. Thus we need to look ahead to a future of quantum computers, and we need to prepare the cryptographic world for that future.”

    Prof Seth Lloyd of MIT, MIT Review 2008

  • “Build-in Security: Ensure that security is considered and built into the design of new infrastructure, so that our critical assets are protected from the start and more resilient to naturally-occurring and deliberate threats throughout their life-cycle."

    Obama-Biden Plan, Agenda: Homeland Security, December 2008

  • "My colleagues at MIT and I have been building simple quantum computers and executing quantum algorithms since 1996, as have other scientists around the world. Quantum computers work as promised. If they can be scaled up, to thousands or tens of thousands of qubits from their current size of a dozen or so, watch out!”

    Prof Seth Lloyd of MIT, MIT Review 2008

  • “Assurance is best addressed during the initial design and engineering of security systems, NOT as an after market patch. The earlier you include a security architect in your design process, the greater the likely hood of a successful and robust design. As the quip goes, he who gets to the (module) interface first wins.”

    Brian Snow, Former Technical Director of the US National Security Agency (NSA), "We need Assurance", AusCERT 2008

  • “In the next five years we will counter many 'hacker' attacks but we will not be safe from Nation States and other large entities”

    Brian Snow, Former Technical Director of the US National Security Agency (NSA), "We need assurance!", 1999-2008

  • "But conventional security is not enough. The complexity of today's operational environment means organisations must embrace a level of business resilience that is normally associated with the protection of critical national infrastructure."

    Detica, a BAE Systems Company

  • “The current way which organisations approach security can be recognised as an underlying market failure which consists of fire fighting security problems, silo'd implementation of technologies, uncontrolled application development practices and a failure to address systemic problems. Organisations tend to deal with one problem at a time that results in the deployment of point solutions to treat singular problems. This failure is typical of an uncontrolled marketplace evolving with little or no co-ordination.”

    The British Government’s Technology Strategy Board, 2008
Resources Security bibliography Asymmetric key exchanges - classical bibliography: Celebrating the 30th anniversary of PKC
bibliography: Celebrating the 30th anniversary of PKC
Authors: Whitfield Diffie, Martin Hellman, Jim Bidzos, Ray Ozzie, Dan Boneh, Brian Snow
Organisation:
Date: Oct 26, 2006
Keywords: asymmetric cryptography, quantum computers, symmetric cryptography
Electronic Publications: http://www.computerhistory.org/events/PKC/
http://www.voltage.com/PKC/
Full video recording of the event
Full audio recording of the event
Abstract:
Quote: Dan: Now Wit, how the heck did you start thinking what led to what we are celebrating here today?

Whitfield: It turns on three things. In 1965 my friend Bill Man mistakenly told me that NSA encrypted the telephones within it's own building. They ran them in shielded conduits. The fact is that I was counter-culter, so anti-establishment, I could not understand the cryptography in which more than two people knew the key [ed: key translation centres, key distribution centres, Kerberos]. I never understood classical key distribution till much later. So I began thinking about that. ...
Quote: Brian Snow: So the threat to cryptography is well understood due to work by Peter Shor and others. A symmetric algorithm like AES or others standard crypto processes is cut key-size in half, which is a dramatic reduction. It reduces AES on 128 to 64 bits, a DES equivalent, we don’t need it. So during the AES competition we put in an insurance policy, it was the right thing to do, because it had not yet been built and you have to take care of what you can think of in the long range future. If quantum computing came to be, they said put in a key size 256. We don’t need it now, its an absurd number, alright, but if quantum computing comes to be, it drops us to 128, a nice healthy number, still quite useable thank you, we can keep going and its no longer a threat. So it was a marvelous response to quantum computing.

Now for key management purposes, against the RSA and the Diffie-Hellman and stuff, they flat-line under a quantum computer. It’s not just a cut the key size in half.

So this becomes an invitation to the research community to get cracking lads. We need new algorithms that are robust at least to the square root factor under a quantum computer attack that can be used for non-repudiation, and public key processes. Open problem. Aching problem – work on it, please!
See:
Citation: Voltage and RSA, “Celebrating the 30th Anniversary of PKC”, Oct 26 2006, http://www.computerhistory.org/events/PKC/ and http://www.voltage.com/PKC/
Related work:

Last Updated on Sunday, 04 January 2009 10:47
 
This website uses cookies to manage authentication, navigation, and to provide you with a better and more personal service. By continuing to use this website, you are consenting to this use. Find out more here.

image Introduction to synaptic Laboratories global cyber safety and Security status 2012 Cyber Security Technical Problems, Drivers and Incentives Video Presentation by Brian Snow

"Synaptic Laboratories is a rare company; they tackle the hard problems! Their basic approach is directly relevant to Governments and/or any commercial companies that deploy products that must function correctly in high-risk environments. They differ from most competitors in that not only do they work hard to get the concepts right, they also work very hard to assure the implementation is correct and robust as well."

Related Items

 

 

 

 

 

 

 

Universal Transaction System