Hot answers tagged

103

The NSA is a composite organization, that comprises several sub-entities called "directorates" with various scopes and goals. The NSA, as a whole, is supposed to have a multitude of roles; its signal intelligence role (often abbreviated as SIGINT, i.e. spying) is the one most people talk about, and is supposed to be handled by the SID (as "Signal ...


99

PGP was considered dangerous because it could have allowed Soviet spies and military officers to plan the nuclear annihilation of the western world without the CIA realizing what's happening before it's too late. Time for some history. During World War II, the importance of cryptography for military use became apparent. Being able to crack enemy ...


21

For a long time, cryptography was something used by spies and armies, and was weak, and a lot of the weakness was tentatively fixed by keeping algorithms and methods as secret as can be. That's security through obscurity, which is BAD, but, to be honest, algorithms from the pre-computer era were so weak that they needed secrecy; security through obscurity ...


10

There are a variety of sources out there for this kind of information, but only for individual services or operating systems. It's rather hard to get exact dates and version information on a lot of this, because people still had old versions of software running, or changes weren't documented at the same time they were made. I've done my best to correlate the ...


10

Unix passwords, with the old DES-based crypt() function, were limited to 8 characters (and the high bit of each byte was ignored). Thus, a lower limit of more than 8 characters would simply not have worked. The driving force for a minimal password size is brute force efficiency: small passwords are unconditionally weak because trying out all combinations ...


9

A quote from SSL and TLS: Theory and Practice - Rolf Oppliger says: Netscape Communications started to develop the SSL protocol soon after the National Center for Supercomputing Applications (NCSA) released Mosaic 1.0--the first popular Web browser--in 1993. Eight months later, in the middle of 1994, Netscape Communications already completed the design ...


9

NSA was undergoing a transformation on the subject question during the timeframe you are questioning. In the previous two decades through the mid 90s NSA advocated for no strong privately controlled public encryption. This position surfaced with their clash with MIT over the work of the famed RSA crew Ron Rivest, Adi Shamir, and Leonard Adleman resulting ...


7

what NSA suggested for use in commercial systems in past times. 90's and early 2000's. NSA did not publicize their involvement in national standards. So, the exact role NSA played in algorithms and documents may be difficult to determine. In 1987 the U.S. Congress passed the "Computer Security Act" which was intended to limit the role of the National ...


6

It is illegal to export 128 bit symmetric encryption or certain levels of asymmetric. PGP exceeded these limits. These export control laws are why some security firms have clean room teams that build strong encryption without any US educated employees working on the team. Technically, if you learned about high strength encryption in the US, you are not ...


5

How bad? Not very. None of the common remote attack vectors existed when the bug was introduced: the "shellshock" parsing bug pre-dates CGI and DHCP by about a year, and pre-dates SSH by two to three years. Remote-access programs such as telnet and rsh don't have the command restriction ability that SSH does, so although a "shellshock" attack could ...


5

Tldr This is what the little research I did was able to find. Most of these dates are as you can read in the longer version, based on the first submitted draft of the respective protocols and not the first time they've been talked about. I hope this might help in your work anyway, and that it might help when doing further research. SSLv1 - ...


4

Back in late 1980s the NSA had a branch called the National Computer Security Center(It may still exist today). The job of this "center" was to help enterprises on the budding forefront of information technology stay secure. Some of the main things they did were: test hardware of major vendors for defects that could leave them vulnerable, test software of ...


4

Phillip Hallam-Baker has written: The actual history of SSL was that SSL 1.0 was so bad that Alan Schiffman and myself broke it in ten minutes when Marc Andressen presented it at the MIT meeting. http://www.metzdowd.com/pipermail/cryptography/2013-October/018041.html No further details on what exactly the flaws were, though.


3

Reformatting is not sufficient, you need to securely wipe the disk. Reformatting is like ripping the cover off a book; it's not pretty but all the info is still there. DBAN is a popular free tool for wiping hard drives. If the drive is SSD, you need other tools. Companies that care will usually not release systems with disks; they'll destroy the disk and ...


2

A big reason for knowing outdated ciphers is so you can decrypt older documents that were made before the advent of modern cryptography methods. As a famous example, we have Kryptos, a sculpture by Jim Sanborn that's found outside the CIA offices in Langley. Kryptos has 4 different encrypted texts, 3 of which have been decrypted already, the 4th being one of ...


2

If you're doing reverse engineering, penetration testing, or generally involved in looking at things someone else has built, for some strange reason, folks always try coming up with their "own" encryption schemes, which are either flawed or embarrassing mis-interpretations of old ciphers, or just vanilla implementations of old algorithms. Beyond that, you ...


2

The IETF has a data tracker for its RFCs. This means that you can flesh out the development timeline by adding the various drafts for each RFC. And you can narrow down dates to the date of the first published draft. What this doesn't tell you when development for the first submitted draft of each RFC started. Also the "SSL" named protocols were not ...


2

After a couple minutes in Google, I find that Leslie Lamport appears to be the first to talk about MitM analysis in terms of communication security. The work was published in 1981, but there is evidence of his thoughts on the matter as early as 1979. First published work describing the ideas: here. Now that I've done your homework for you, will you share ...


2

There were quite a few, but the ones that got a lot of news time over here: 3 on Facebook CIA UK Police FBI


2

When we learned about BLP in class, one of my classmates decided to email Dr. Bell and ask the question. Below is the response we got. Too bad you haven't happened on the couple of talks I've given on old war stories. During the oil embargo of 1972, was it?, I was driving an hour to work every day, from Worcester MA to Bedford. One's mind wanders. ...


2

SMTP is a very, very old protocol, dating from the early days of the Internet when connections weren't reliable and security wasn't a major issue. Many of the issues with SMTP (open relays, unauthenticated senders, etc.) are the result of trying to provide reliable delivery on an unreliable network where everyone knew everyone else (or at least everyone ...


2

It is difficult to define when the word "computer" started getting traction and it is more difficult for the concept of "computer security". To my mind, the first incident in computer security is the process that sparked the invention of the modern computer. That was the work of Alan Turing on the machine that broke the enigma encryption. The Enigma ...


2

According to Wikipedia the Arms Export Control Acts permitted (at the 1990's) only weak crypto to be exported outside the U.S.


1

If you're being really paranoid and you want peace of mind, it's probably best to just remove the disk from the laptop and replace it with a new one (as gowenfawr wrote: they're pretty cheap), or with a wiped disk that never contained any sensitive information. Then sell that, and keep your old disk, or destroy it.


1

12 comes from the current state of the art in brute-force hashing hardware. A wealthy but otherwise ordinary person can buy two dozen graphics cards, mount them in a well-cooled chassis, load up some specialized GPU software, and execute 348 billion hashes per second. That is enough computrons to brute force all possible 10 character passwords in a very ...


1

The chimpanzee's testimony More than 15 years ago I worked as a system admin on Tru64 an operating system developped on top of OSF/1 by Digital Equipment Corporation. This system was built on a 64bit architecture and made many serious advances in fundamental security. One of them was to permit to use DES to manage passwords up to a length of 16 characters. ...


1

SSL 1.0 -> around 1994 with Mosaic, got thrown into trash a year later for ssl 2.0. so ssl 1.0 was the first draft, without any RFCs, very Mosaic-Centric. http://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_1.0.2C_2.0_and_3.0 http://de.wikipedia.org/wiki/Transport_Layer_Security#Geschichte



Only top voted, non community-wiki answers of a minimum length are eligible