Schneier on Post Quantum Crypto

 NIST Draft Document on Post-Quantum Cryptography Guidance

Schneier on Post Quantum 

NIST Draft Document on Post-QuantumCryptography Guidance

NIST has release a draft of Special Publication1800-38A: Migration to Post-Quantum Cryptography: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography.” It’s only four pages long, and it doesn’t have a lot of detail—more “volumes” are coming, with more information—but it’s well worth reading.

We are going to need to migrate to quantum-resistant public-key algorithms, and the sooner we implement key agility the easier it will be to do so.

News article.

Posted on May 2, 2023 at 10:10 AM • 19 Comments

Two Charged with Attacks on Four Power Substations

Related pieces:

 Identifying People Using Cell Phone with Location Data  by Bruce Schneier   ...

Two charged with attacks on four power substations in Washington state  By Holmes Lybrand and Hannah Rabinowitz, CNN

Published 2:20 PM EST, Tue January 3, 2023

according to a crew manager, Sunday, Dec. 25, 2022 in Graham, Washington.

Ken Lambert/The Seattle Times/AP      CNN

Two men were arrested on New Year’s Eve for allegedly shutting down four Washington state power substations in late December that led to power outages for thousands across Pierce County. .... '

Alert! Very Serious LastPass Security Glitch:

Am a week or so late to this, just now exploring implied severity, and if the previous admissions properly provided enough information to LastPass users to minimize the damage involved.

 From Schneier Security: 

LastPass Breach

Last August, LastPass reported a security breach, saying that no customer information—or passwords—were compromised. Turns out the full story is worse:   

While no customer data was accessed during the August 2022 incident, some source code and technical information were stolen from our development environment and used to target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service. To date, we have determined that once the cloud storage access key and dual storage container decryption keys were obtained, the threat actor copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.

That’s bad. It’s not an epic disaster, though.

These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass.  ....   " 

Intro above, see also the comments in the above ... 

--------

Further, see much more in 'Steve Gibson's Security-Now episode 904 at:

https://twit.tv/shows/security-now/episodes/904?autostart=false

 And his further detailed show Notes:  https://www.grc.com/sn/SN-904-Notes.pdf  (may be being updated, check in later) 

Still examining, will provide followups.  ... 

Death Due to Ransomware?

Out of Schneier: 

The Wall Street Journal is reporting on a baby’s death at an Alabama hospital in 2019, which they argue was a direct result of the ransomware attack the hospital was undergoing. ... '

Discussion of where the negligence was, in part for allowing the malware intrusion?

Hardening your VPN

 Just posted, as usual these often get interesting comments.

Via Schneier:     Hardening Your VPN    

The NSA and CISA have released a document on how to harden your VPN .... 

Apple to Detect Child Abuse Crimes in Photos, iCloud, Messages

Bruce Schneier article on the inclusion of a backdoor is interesting.   He makes the case, as he often does that any backdoor type of inclusion might readily be abused by police or government.   The case of the use of locked Iphones in a crime, where Apple made a point of not cracking the log-in, has been much discussed.  Schneier and other security pundits come down on trusting law enforcement less.   Now Apple seems to be taking an opposite view for some crimes that they think they can reliably detect.

" .. Apple Adds a Backdoor to iMesssage and iCloud Storage  (For child abuse detection )

Apple’s announcement that it’s going to start scanning photos for child abuse material is a big deal. ...I have been following the details, and discussing it in several different email lists. I don’t have time right now to delve into the details, but wanted to post something .... ' 

This article is under development and as usual has a growing number of interesting comments. ... 

UPDATE:  A more technical review of Apples proposal from Steve Gibson, which better characterizes what Apple is doing.    Softens the backdoor hysteria being promoted above.  - FAD

Steve Gibson in TWIT

https://www.grc.com/sn/SN-831-Notes.pdf

'Apples CSAM Mistake'   Page 11-13  ...