Today's cryptographic algorithms won't last forever
Share on Twitter.
Get the most reliable SMTP service for your business. You wished you got it sooner!
September 10, 2013
One could say that it's possible the NSA has devoted some efforts to key capture and side-channel attacks rather than brute-forcing
its way through ciphertext on a very large scale, but it's also true that our cryptographic algorithms won't last forever.
And now this is present on the minds of many system admins, not just the NSA, which draws some attention to the topic of internet
security, which is looking at protection of multi-party computation (MPC) activities.
According to science and physics website Phys.org-- “The idea behind Multi-Party Computation is that it should enable two or more
people to compute any function of their choosing on their secret inputs, without revealing their inputs to either party. One example
of this is an election. Voters want their vote to be counted but they don't want their vote to made public.”
This might also be useful in cloud-based collaboration projects, since it would protect anyone's data against the rest of the world,
including your own boss, if it so happened that his or her machine was compromised.
The goal of the work by a British/Danish collaboration team is to strap the supercharger onto a protocol called SPDZ to give it real-world
With SPDZ, two machines working on a multi-party computation problem can do so without revealing their data to each other. They describe
SPDZ as-- “secure against active static adversaries in the standard model, is actively secure, and tolerates corruption of n-1 of the n
"The SPDZ protocol follows the preprocessing model. In an offline phase, some shared randomness is generated, but neither the
function to be computed nor the inputs need be known. In an online phase, the actual secure computation is performed,” explains Phys.org.
But let's clarify this a bit. The claims of security aren't remarkable, and the protocol is designed so that your data will remain
secure even if everybody else is compromised (“n-1 of the n parties”).
The protocol simply relies on a message authentication code (MAC, just to make sure there's no confusion with Media Access Control) and
this made it computationally demanding. The MAC is partly shared between the parties, and parties had to reveal their shares of the
code to effectively communicate.
The issue with this is that revealing the code meant for every communication it had to be renegotiated, hence its slow performance.
Other problems were that the key generation was also demanding, covert security was considered weak, and the proposed new system is
more secure in the offline phase.
The system as a whole is described in this manner-- “MPC is similar in concept to the “zero knowledge proof” or ZKP. It's simply a set
of rules that would allow parties on one end of a transaction to verify that they know a piece of information such as a password by offering
a different piece of information that could be known only to the other party."
The technique could allow secure password-enabled login without requiring users to type in a password or send it across the internet. Like
many other attempts at MPC, however, SPDZ was too slow and cumbersome to be practical.
If the paper – which will be presented at this week's ESORICS 2013 conference – holds up, it will eventually add a new string to
the bow of those that want to protect information, rather than snoop on it.
In other IT news
China's own crackdown on Bo Xilai and other scandal-hit Communist Party outcasts may be making Unix systems less popular
behind the country's Great Firewall.
At least that's the opinion of EMC's president for Greater China, Denis Yip, who last week told attendees at an EMC Forum event
in Hong Kong that the political environment across the border had made IT buyers more careful about where and how they spend their
budget. And virtualisation on x86, he said, is the big winner for now.
Overall, China has in recent weeks been gripped by the trial of ex-Chongqing party leader Bo Xilai, in part thanks to the trial
court's decision to shared details of the trial on Sina Weibo (often described as China's Twitter).
Yet another high profile trial, of former railways minister Liu Zhijun, saw a suspended death sentence handed out last July.
Both trials have been mentioned by new president Xi Jinping as part of a major crackdown on political corruption and bribery.
EMC's Yip told the Forum that the corruption crackdown means that purchasers of IT are becoming more cautious in China, merely because
spending big now attracts a lot of scrutiny.
Buying servers with lots of unused capacity therefore looks suspicious. “The trend is that people are putting new applications on
virtualised environments,” Yip added. “Chinese customers are spending less money. People are not willing to spend big money on mainframes,
but they are definetely switching to x86 environments.”
Of course, this trend benefits EMC, which is itself transitioning from a traditional storage company to one which can support
the cloud and big data era, so a bit of salt seems appropriate here.
Yip added that business in China looks great because the central government has already invested heavily in over 80 City Cloud projects
all over the country, with the help of EMC.
Often located in relatively remote areas with no existing IT infrastructure, these projects usually require the building of new
cutting edge datacentres from scratch, with EMC aiming to contribute to 1,000 of these over the next five years, Yip explained.
APAC was the fastest growing region for the storage giant last year, growing fourteen percent year-on-year, compared to single digit
numbers in other regions, while China grew 20 percent as a whole.
The company wants the PRC as its biggest base outside the U.S. and Yip has set an ambitious five-year target of growing its big data
business more than 10-fold and enjoying more than a 50 percent market share of the enterprise class datacentre market.
It won’t all be plain sailing though, with local hero Huawei mentioned several times as a competitor. “In China we’ll be partnering a
lot more with local companies, otherwise competing with Huawei will be more difficult,” Yip noted.
EMC’s enterprise storage division president Brian Gallagher says that Huawei mainly competes at the low end, in the block storage
“They’re going after the big fish, Cisco on the networking side and the storage players in the industry,” he added. “We’ll continue
to invest in R&D and M&A, however they’re seeing decent growth rates these days, and that's what really counts.”
In other IT news
Some ISPs and many hosting companies have been given a heads-up about some
double-digit price hikes due at the start of 2014 and 2015, and the cost increases aren't going down too well for some. And while Microsoft
has been slashing the price of its Surface hardware amid a $900 million write-down, the price of its software is going up. Way up.
The Services Provider Licensing Agreement (SPLA) is the latest area to get the special treatment, with hosting companies warned
that from January next year, Windows Server Datacenter will rise by a whopping 38 percent under the per-processor licensing model,
and by another 13 percent by January 2015.
However, there could be a bit of logic in Microsoft's move here, as the licence will accommodate unlimited virtual machines whereas
it used to be restricted to four.
The price of the Windows Server Standard edition won't change in January, but will go up by twenty percent from January 2015 on.
And the Core Infrastructure Suite Datacenter is set to increase by 23 percent from 2014 and another nine percent the following year,
and the Standard version will edge up another nine percent from 2015.
The Remote Desktop Services Subscriber Access License (SAL) will also become 20 percent more expensive from January 2014.
The Cloud Platform Suite and the Platform Guest will not be impacted by a price surge, we were told by Microsoft.
Hosting firms that buy Microsoft's wares under the SPLA model already had to deal with a 33.4 percent price rise at the start of
this year, and one observer said that the latest change would be a "hard sell" to customers.
"We can't constructively work with Microsoft if it keeps putting up its prices," bemoaned one, who added that in markets where Microsoft
has more competition, as it does with Azure in the cloud-hosting game, price cuts were common in the past year, and continue to be the
same this year.
Get the most dependable SMTP server for your company. You will congratulate yourself!
Share on Twitter.
Need to know more about the cloud? Sign up for your free Cloud Hosting White Paper.