IBM Releases Cryptosystem for Internet Traffic
Mathematicians at IBM Research (
www.research.ibm.com) and the Swiss Federal Institute of Technology (Zurich, Switzerland,
www.ethz.ch) announced they have co-developed a public-key cryptosystem that provides a mathematically proven way to secure information from aggressive Internet hacking attempts.
The Cramer-Shoup cryptosystem, named after the two researchers who developed it, reportedly closes the backdoor on active attacks, which are considered the most dangerous hack attempts that commercial cryptosystems face. It works by doubly encoding the information being sent out by Web sites using the system, meaning the cryptosystem encodes the data being sent as well as the server's responses to the messages. That way, hackers will have no response message with which to learn about the system. IBM plans to incorporate the system into a future version of its Vault Registry software.
The new fix, announced at the Crypto ’98 conference at the University of California-Santa Barbara, comes a full 2 months after Daniel Bleichenbacher, a researcher at Lucent Technologies Inc.'s Bell Labs unit (Murray Hill, N.J., www.bell-labs.com), discovered a hole that enables the decoding of Internet sessions under some circumstances. These sessions were protected by the Public Key Cryptography Standard (PKCS), which includes Secure Sockets Layer (SSL), the data encryption scheme from RSA Data Security Inc. (San Mateo, Calif., www.rsa.com) that is used by most Web browsers such as Netscape Navigator and Microsoft Internet Explorer.
IBM and RSA are only two of the 15 companies vying to become the U.S. government’s next encryption standard. The U.S. Commerce Department’s National Institute of Standards and Technology (NIST, Gaithersburg, Md., www.nist.gov) announced they are reviewing 15 encoding algorithms as candidates to replace the 56-bit Data Encryption Scheme (DES) that was recently cracked. NIST is inviting the worldwide cryptographic community to attack the formulas in an attempt to break the codes during the first evaluation period, which will end April 15, 1999. NIST will also be looking at factors such as security and speed.
The winning algorithm, which isn’t expected to be chosen until 2001, will be called the Advanced Encryption Standard (AES). NIST is hoping the new algorithm will last the government for the next 30 years. NIST adopted DES, developed by IBM in 1977, as a Federal Information Processing Standard for use by federal agencies to encrypt sensitive data. Since then, many private computer companies have accepted the algorithm as their own standard. AES, just as its predecessor, will be available to the private sector at no cost of royalty.
This and other security issues were addressed at the first AES Candidate Conference in Ventura, Calif. Another conference will be held March 22 and 23, 1999, in Rome.
DES’ key size, 56 bits, is rather small compared with modern abilities, but the U.S. government restricts the export of encryption stronger than 56 bits. This is the subject of a large controversy between private companies and the U.S. government.
Companies are arguing that the policy hurts them because there is stronger encryption abroad and U.S. companies are losing money as a result. The government contends that strong encryption is dangerous to the country’s national security. The government wants new encryption schemes to include a device that would allow government agencies to decode the data. The private sector is fighting this measure.