Ciphertext-only cryptanalysis of short Hagelin M-209 ciphertexts

The Hagelin M-209 was a mechanical encryption device used by the U.S. Army during World War 2 (WWII) and the Korean War, as well as by other armies and diplomatic services. The Hagelin M-209 has been the focus of extensive research by codebreaking agencies. Several ciphertext-only attacks have been published, but, those attacks are applicable only to the case of long cryptograms. In this article, the authors present a nested hill-climbing and simulated annealing algorithm for recovering the full key settings from ciphertext only, with ciphertexts as short as 500 letters, compared to a minimum of 750 to 1,250 letters with prior methods. With this method, the authors have solved the last problem of a public Hagelin M-209 challenge contest.     

Automated Known-Plaintext Cryptanalysis of Short Hagelin M-209 Messages

The Hagelin M-209 portable encryption device was used by the U.S. Army in World War II and the Korean War, as well as by other armies and in embassy settings. In this article, a fully automated, computerized known-plaintext attack is presented. It is based on hillclimbing and a novel fitness function: the aggregate displacement error. Performance evaluation shows that this attack is able to recover key settings for messages as short as 50 characters. To validate these results, several publicly available challenge messages were solved with this method, including a message with only 40 letters.     

Ciphertext-only cryptanalysis of Hagelin M-209 pins and lugs

The Hagelin M-209 was a mechanical encryption device used by the U.S. Army during World War II and the Korean War, as well as by other armies and in embassy settings. In this article, the authors present a four-stage hillclimbing algorithm for recovering the full key settings from ciphertext only. The first two stages are based on a divide-and-conquer approach developed by Geoff Sullivan. In the current performance evaluation, the authors show that their method is able to recover key settings from messages as short as 750 letters, compared to 2,000 – 2,500 letters with prior methods. With this method, they solved several M-209 ciphertext-only challenges, including the final exercises in W. Barker’s 1977 book, Cryptanalysis of the Hagelin Cryptograph.     

RSA公钥密码的信息论分析

过去对RSA安全性的分析都是从计算复杂度出发,其安全性依赖于分解大整数,最终落在安全素数的选择上。本文利用Shannon有关保密系统的理论,对RSA体制中的明文、密文进行了不变子集的划分,从而可以计算出明文和密文的互信息,同样得到了选择安全素数作为RSA的参数的理论依据。     

Deciphering ADFGVX messages from the Eastern Front of World War I

In the last months of World War I (WW I), the German Army and diplomatic services used the ADFGVX hand-cipher system to encrypt radio messages between Germany and its outposts and stations in the Balkans, the Black Sea, and in the Middle East. Hundreds of cryptograms were intercepted from July to December 1918 by British and U.S. military intelligence, who were able to recover most of the keys and decipher most of the cryptograms using manual cryptanalysis methods. Fortunately, the original cryptograms have been preserved by James Rives Childs, the U.S. officer assigned to G.2 A.6, the SIGINT section of American Expeditionary Forces (AEF) in Paris, and they appear in his book, General Solution of the ADFGVX Cipher System, published by Aegean Press Park in 2000.

In this article, the authors present the results of an effort toward the complete cryptanalysis of the messages, and an analysis of their contents. The authors present a new computerized method for the ciphertext-only cryptanalysis of ADFGVX messages which they developed for that purpose. They also provide details on how all the keys were recovered and almost all the messages decrypted, despite the low quality of significant parts of the intercepted material.

The analysis of the messages in their historical context provides a unique insight into key events, such as the withdrawal of the German troops from Romania, and the impact of the Kiel Mutiny on communications. Both events had major political and military consequences for Germany in the Eastern Front. Cryptanalysis allowed the Entente Powers to closely monitor those events as well as others developments, also highlighting inherent weaknesses in German cryptographic and cryptanalytic capabilities. The authors plan to publish online all the decrypted messages.     

THE HAGELIN CIPHER MACHINE (M-209) Reconstruction of the Internal Settings

It is an Interesting and useful cryptanalytic problem to try to reconstruct the internal settings of the M-209 cipher machine, given the text of a message which has been obtained both in clear and enciphered form. Then it is considerably easier to decipher any further messages encrypted with the same internal settings. It turns out to be possible to do this reconstruction for rather short messages, of the order of 75 characters or so. Partial or incomplete solutions are generally possible with as few as 50 characters.     

Eliminating the Volume of Spam E-Mails Using a Hashcash-Based Solution

Abstract

Spam can be defined as unsolicited e- mail, often of a commercial nature, sent indiscriminately to multiple mailing lists, individuals, or newsgroups. Spoofing (Templeton and Levitt, 2003) is a technique often used by spammers to make them harder to trace. Trojan viruses embedded in e-mail messages also employ spoofing techniques to ensure the source of the message is more difficult to locate (Ishibashi et al., 2003). Spam filters and virus scanners can eliminate only a certain amount of spam and also risk catching legitimate e-mails. As the SoBig virus has demonstrated, virus scanners themselves actually add to the e-mail traffic, through notification and bounceback messages. Simple Mail Transfer Protocol (SMTP) is flawed in that it allows these e-mail headers to be faked and does not allow for the sender to be authenticated as the real sender of the message. If this problem can be solved, it will result in a reduction in spam e-mail messages and more security for existing e-mails, and it will allow e-mail viruses to be tracked down and stopped more effectively (Schwartz and Garfinkel, 1998). This approach is known as “trusted e-mail.”     

Selected Security and Legal Issues in E-Commerce

Abstract

Encryption can be explained as the process of transforming information into an unintelligible form and thus making it extremely hard for others to understand the meaning of the message. Encryption can be used to disguise messages so that even if a message is diverted, it will not be revealed.⁶     

A new high capacity and secure image realization steganography based on ASCII code matching

Digital Steganography is the art of hiding secret messages behind an innocent looking digital media that do not raise suspicions. In this paper, a new proposed image realization steganography method is introduced which is a mapping-based method that hides in an unrevealed manner and without any change in the image cover file. The image cover is only used for referencing. The proposed method generates the cover-secret mapping that will realize the concealed secret message without embedding the real message. A mapping between the American Standard Code of Information Interchange (ASCII) codes of a secret message and an image is performed and the positions of the secret message in the image is noted in a position array. This reference positions are then sent to the receiver after first being compressed by Huffman algorithm and then encrypted using Advanced Encryption Standard with 128 bits key (AES-128). The position array and the cover image are transferred separately, so that the interception of any one file alone will not conceal any information. In addition, it has unlimited capacity as specific matching positions can be used more than once. Furthermore, the proposed method has a reduced size of position key and mapping table, hence having high-speed searching and matching compared to prevailing methods. Furthermore, several experimental tests have been applied to assess the efficiency and performance of the new proposed method to evaluate it according to the widely used metrics: Mean Squared Error (MSE) and Peak Signal to Noise Ratio (PSNR). From the security point of view, Structural Similarity Index Measure (SSIM) together with Histogram have been performed. Moreover, it is critiqued showing its pros and cons and further compared with existing state-of-the-art research. The experimental results verified the efficacy of the new proposed method.

     

Linkable message tagging: solving the key distribution problem of signature schemes

Digital signatures guarantee practical security only if the corresponding verification keys are distributed authentically; however, arguably, satisfying solutions for the latter have not been found yet. This paper introduces a novel approach for cryptographic message authentication where this problem does not arise: A linkable message tagging scheme (LMT) identifies pairs of messages and accompanying authentication tags as related if and only if these tags were created using the same secret key. Importantly, our primitive fully avoids public keys and hence elegantly sidesteps the key distribution problem of signature schemes. As an application of LMT we envision an email authentication system with minimal user interaction. Email clients could routinely equip all outgoing messages with corresponding tags and verify for incoming messages whether they indeed originate from the same entity as previously or subsequently received messages with identical sender address. As technical contributions we formalize the notions of LMT and its (more efficient) variant CMT (classifiable message tagging), including corresponding notions of unforgeability. For both variants we propose a range of provably secure constructions, basing on different hardness assumptions, with and without requiring random oracles. This article extends prior work of the same authors that appeared in the proceedings of ACISP 2015 (Günther and Poettering in 2015).     

Habituation effects in computer security warning

ABSTRACT

Security warning is a form of computer dialog communication that is used to inform the users on the risks of allowing random applications to run on a computer system. Accordingly, it is specifically designed to impersonate a legitimate security alerting function (e.g., notify, warn and advice) to a user about the consequence effect of an action. However, most of the computer users tend to ignore those security warnings conveying the same message over and over again. This eventually leads to habituation. Considering the fact that there is a significant lack of focus been paid to address this issue, the main objective of this paper is to describe and summarize the related studies on users’ habituation to the security warnings. This paper presents a systematic literature review to explore the current key issues, challenges and the possible solutions related to habituation effects in security warnings. It is expected that this paper could contribute to a more complete understanding of the habituation effects in security warnings and eventually bring benefits to the research communities or general publics.     

Oracle Database Security

Abstract

The Oracle database provides the necessary features to configure adequate and granular level security, including strong authentication, authorization, and monitoring controls. This article provides an understanding of key security concepts for the Oracle 8x and 9x environments.     

VoIP Security — Attacks and Solutions

ABSTRACT

Voice over IP (VoIP) technology is being extensively and rapidly deployed. Flexibility and cost efficiency are the key factors luring enterprises to transition to VoIP. Some security problems may surface with the widespread deployment of VoIP. This article presents an overview of VoIP systems and its security issues. First, we briefly describe basic VoIP architecture and its fundamental differences compared to PSTN. Next, basic VoIP protocols used for signaling and media transport, as well as defense mechanisms are described. Finally, current and potential VoIP attacks along with the approaches that have been adopted to counter the attacks are discussed.     

A New Algorithm for Hiding Gray Images Using Blocks

Abstract

As vast channels for communication, such as the Internet, become more popular, the security of digital media becomes a greater concern. Steganography is one of the techniques used to make detecting the transmitted data over channels more difficult, as hiding a message will reduce the probability of detecting this message. In this paper we suggest a new algorithm of steganography for hiding a gray image in one another. The cover is divided into blocks of equal sizes. Each block size equals the size of the embedding image.

The results drawn in this paper with the similarity equals 0.9717 are more improved and give the clear picture of the object.     

交叉树:一种用于安全协议分析的数据结构

提出用一种特殊的数据结构交叉树来描述安全协议中的消息。交叉树有一些交叉结点，拥有交叉结点的几棵交叉树形成交叉森林。一棵交叉树唯一对应于一个消息，一个交叉森林表示那些在协议执行过程中采用相同机制发送或接收的消息。一个或几个消息中相同的原子消息在交叉树或交叉森林中用交叉结点来表示，这样易于保证原子消息的一致性，以及公钥和它所有者之间的一致性。另外，交叉树还可用于为消息模板建立可接受消息，这时于建立在模型检验基础上的安全协议分析是非常必要的。     

发送方可否认图像隐写

目的 图像隐写是指将秘密信息隐藏到载体图像中,生成含密图像并在公共信道中传输。隐写分析旨在识别图像中是否隐藏秘密信息。不论何种隐写方案,都会在一定程度上被隐写分析识破,从而导致胁迫攻击,即攻击者找到发送方或接收方,胁迫其提交经过验证的秘密信息。为了保护秘密信息的隐蔽通信,对抗胁迫攻击的可否认方案亟待研究。在密码学领域,为了对抗胁迫攻击,已经提出了可否认加密的概念及相关方案并受到关注与研究。而在隐写领域,有研究提出可否认隐写的概念并设计了接收方可否认隐写的框架,但没有发送方可否认隐写的相关研究。对此,本文讨论发送方可否认隐写。方法 设计方案的通用框架,并构造两个方案:基于可逆网络的发送方可否认图像隐藏方案和基于可否认加密的发送方可否认图像隐写方案。在发送方可否认隐写的框架下,发送方可使用虚假的秘密信息生成与攻击者手中相同的含密图像,以欺骗攻击者,逃脱胁迫攻击,保护真实的秘密信息。结果 实验结果表明,两个方案都是可行且有效的,与原始隐写方案相比,可否认方案达到了发送方可否认功能的同时,均不会显著降低含密图像的视觉质量(峰值信噪比(peak signal-to-noise ratio,PSN...     

Information Security Policy Development and Implementation

ABSTRACT

Development of the information security policy is a critical activity. Credibility of the entire information security program of an organization depends upon a well-drafted information security policy. Most of the stakeholders do not have time or inclination to wade through a lengthy policy document. This article tries to formulate an approach to the information security policy development that will make the policy document capture the essentials of information security as applicable to a business. The document will also convey the urgency and importance of implementing the policy, not only in letter but also in spirit.     

FORMAL CONSIDERATIONS OF RULE-BASED MESSAGING FOR BUSINESS PROCESS INTEGRATION

ABSTRACT

In the last decade, with the expansion of organizational scope and the tendency for outsourcing, there has been an increasing need for Business Process Integration (BPI), understood as the sharing of data and applications among business processes. The research efforts and development paths in BPI pursued by many academic groups and system vendors, targeting heterogeneous system integration, continue to face several conceptual and technological challenges.

This article begins with a brief review of major approaches and emerging standards to address BPI. Further, we introduce a rule-driven messaging approach to BPI, which is based on the harmonization of messages in order to compose a new, often cross-organizational process.

We will then introduce the design of a temporal first order language (Harmonized Messaging Calculus) that provides the formal foundation for general rules governing the business process execution. Definitions of the language terms, formulae, safety, and expressiveness are introduced and considered in detail.     

FROM THE ARCHIVES EXAMPLES OF INTELLIGENCE OBTAINED FROM CRYPTANALYSIS 1 AUGUST 1946

Abstract

Articles discussing strip and cylinder devices inevitably discuss the role of Parker Hitt in the evolution of the U.S. Army's M-94 cylinder device. Hitt's development of a cylinder has long been attributed to work he did in 1913, based on letters he wrote to William Friedman in 1947. Newly discovered papers reveal that Hitt's first cylinder device was actually built in 1912 in collaboration with other students at the Army Signal School, and uncovers a previously unknown photograph of this early device.     

Cryptanalysis of a sessional blind signature based on quantum cryptography

A digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or document. A blind signature is a form of digital signature in which the content of a message is disguised (blinded) before it is signed to protect the privacy of the message from the signatory. For signing quantum messages, some quantum blind signature protocols have been proposed. Recently, Khodambashi et al. (Quantum Inf Process 13:121, 2014) proposed a sessional blind signature based on quantum cryptography. It was claimed that these protocol could guarantee unconditional security. However, after our analysis, we find that the signature protocol will cause the key information leakage in the view of information theory. Taking advantage of loophole, the message sender can succeed in forging the signature without the knowledge of the whole exact key between the verifier and him. To conquer this shortcoming, we construct an improved protocol based on it and the new protocol can resist the key information leakage attacks.