This article want to clarify and better explain the finding at infosecurityguard.com regaring voice encryption product evaluation.
This article want to tell you a different point of view other than infosecurityguard.com and explaining which are the rational with extensive explaination from security point of view.
Today i read news saying: “PhoneCrypt: Basic Vulnerability Found in 12 out of 15 Voice Encryption Products and went to read the website infosecurityguard .
Initially it appeared to my like a great research activity but then i started reading deeply the read about it.I found that it's not properly a security research but there is are concrete elements that's a marketing campaign well done in order to attract public media and publicize a product.
Imho they was able to cheat journalists and users because the marketing campaign was absolutely well done not to be discovered on 1st read attempt. I personally considered it like a valid one on 1st ready (they cheated me initially!).
But if you go deeply… you will understand that:
- it's a camouflage marketing initiative arranged by SecurStar GmbH and not a independent security research
- they consider a only security context where local device has been compromised (no software can be secured in that case, like saying SSL can be compromised if you have a trojan!)
- they do not consider any basic security and cryptographic security criteria
However a lot of important website reported it:
This article is quite long, if you read it you will understand better what's going on around infosecurityguard.com research and research result.
I want to to tell you why and how (imho) they are wrong.
The research missed to consider Security, Cryptography and Transparency!
Well, all this research sound much like being focused on the marketing goal to say that their PhoneCrypt product is the “super” product best of all the other ones.
Any security expert that would have as duty the “software evaluation” in order to protect the confidentiality of phone calls will evaluate other different characteristics of the product and the technology.
Yes, it's true that most of the product described by SecurStar in their anonymous marketing website called http://infosecurityguard.com have some weakness.
But the relevant weakness are others and PhoneCrypt unfortunately, like most of the described products suffer from this.
Let's review which characteristics are needed basic cryptography and security requirement (the best practice, the foundation and the basics!)
a – Security Trough Obscurity does not work
A basic rule in cryptography cames from 1883 by Auguste Kerckhoffs:
In a well-designed cryptographic system, only the key needs to be secret; there should be no secrecy in the algorithm.
Modern cryptographers have embraced this principle, calling anything else “security by obscurity.”
Read what Bruce Schneir, recognized expert and cryptographer in the world say
about this Any security expert will tell you that's true. Even a novice university student will tell you that's true. Simply because that's the only way to do cryptography.
Almost all product described in the review by SecurStar GmbH, include PhoneCrypt, does not provide precise details about their cryptographic technologies.
Precise details are:
- Detailed specification of cryptographic algorithm (that's not just saying “we use AES “)
- Detailed specification of cryptographic protocol (that's not just saying “we use Diffie Hellman ” )
- Detailed specification of measuring the cryptographic strenght (that's not just saying “we have 10000000 bit key size “)
Providing precise details means having extensive documentation with theoretical and practical implications documenting ANY single way of how the algorithm works, how the protocol works with precise specification to replicate it for interoperability testing.
It means that scientific community should be able to play with the technology, audit it, hack it.
If we don't know anything about the cryptographic system in details, how can we know which are the weakness and strength points?
Mike Fratto, Site editor of Network Computing, made a great article on “Saying NO to proprietary cryptographic systems” .
Cerias Purdue University tell this .
b – NON peer reviewed and NON scientifically approved Cryptography does not work
In any case and in any condition you do cryptography you need to be sure that someone else will check, review, analyze, distruct and reconstract from scratch your technology and provide those information free to the public for open discussion.
That's exactly how AES was born and like US National Institute of Standard make crypto does (with public contest with public peer review where only the best evaluated win).
A public discussion with a public contest where the a lot of review by most famous and expert cryptographer in the world, hackers (with their name,surname and face, not like Notrax) provide their contribution, tell what they thinks.
That's called “peer review”.
If a cryptographic technology has an extended and important peer review, distributed in the world coming from universities, private security companies, military institutions, hackers and all coming from different part of the world (from USA to Europe to Russia to South America to Middle east to China) and all of them agree that a specific technology it's secure…
Well, in that case we can consider the technology secure because a lot of entities with good reputation and authority coming from a lot of different place in the world have publicly reviewed, analyzed and confirmed that a technology it's secure.
How a private company can even think to invent on it's own a secure communication protocol when it's scientifically stated that it's not possible to do it in a “proprietary and closed way” ?
IBM tell you that peer review it's required for cryptography .
Bruce Schneier tell you that “Good cryptographers know that nothing substitutes for extensive peer review and years of analysis.”
Philip Zimmermann will tell you to beware of Snake Oil where the story is: “Every software engineer fancies himself a cryptographer, which has led to the proliferation of really bad crypto software.”
c – Closed source cryptography does not work
As you know any kind of “serious” and with “good reputation” cryptographic technology is implemented in opensource.
There are usually multiple implementation of the same cryptographic algorithm and cryptographic protocol to be able to review all the way it works and certify the interoperability.
Supposing to use a standard with precise and extended details on “how it works”, that has been “peer reviewed” by the scientific community BUT that has been re-implemented from scratch by a not so smart programmer and the implementation it's plenty of bugs.
Well, if the implementation is “opensource” this means that it can be reviewed, improved, tested, audited and the end user will certaintly have in it's own had a piece of technology “that works safely” .
Google release opensource crypto toolkit
Mozilla release opensource crypto toolkit
Bruce Schneier tell you that Cryptography must be opensource .
Another cryptographic point of view
I don't want to convince anyone but just provide facts related to science, related to cryptography and security in order to reduce the effect of misinformation done by security companies whose only goes is to sell you something and not to do something that make the world a better.
When you do secure products, if they are not done following the proper approach people could die.
It's absolutely something irresponsible not to use best practice to do crypto stuff.
To summarize let's review the infosecurityguard.com review from a security best pratice point of view.
| Product name | Security Trough Obscurity | Public peer review | Open Source | Compromise locally? |
| Caspertec | Obscurity | No public review | Closed | हां |
| CellCrypt | Obscurity
| No public review
| Closed
| हां |
| Cryptophone | Transparency | Limited public review | Public | हां |
| Gold-Lock | Obscurity
| No public review
| Closed
| हां |
| Illix | Obscurity
| No public review
| Closed
| हां |
| No1.BC | Obscurity | No public review
| Closed
| हां |
| PhoneCrypt | Obscurity
| No public review
| Closed
| हां |
| Rode&Swarz | Obscurity
| No public review
| Closed
| हां |
| Secure-Voice | Obscurity
| No public review
| Closed
| हां |
| SecuSmart | Obscurity
| No public review
| Closed
| हां |
| SecVoice | Obscurity
| No public review
| Closed
| हां |
| SegureGSM | Obscurity
| No public review
| Closed
| हां |
| SnapCell | Obscurity
| No public review
| Closed
| हां |
| Tripleton | Obscurity
| No public review
| Closed
| हां |
| Zfone | Transparency | Public review
| Open | हां |
| ZRTP | Transparency | Public review
| Open | हां |
*Green means that it match basic requirement for a cryptographic secure system
* लाल / यह एक क्रिप्टोग्राफिक सुरक्षित प्रणाली के लिए बुनियादी आवश्यकता से मेल नहीं खाता है कि टूटी साधन
यही क्रिप्टोग्राफिक और नहीं मैं बेकार पर विचार करें कि स्थानीय समझौता संदर्भ सहित सुरक्षा मानकों के आधार पर एक मूल्यांकन पद्धति का उपयोग करके अपने विश्लेषण है.
हालांकि, स्पष्ट होना करने के लिए, उन एक आवाज एन्क्रिप्शन उत्पाद (बस मैं अन्य उत्पादों को बढ़ावा देने हूँ की तरह प्रतीत होता है कि एक स्थिति में होने से बचने के लिए) पर विचार करते हैं, तो केवल बुनियादी मानकों हैं. तो यह अच्छा क्रिप्टो के साथ एक उत्पाद (पारदर्शिता, की समीक्षा की और opensource सहकर्मी) बिल्कुल की वजह से एक सुरक्षित नहीं उत्पाद है कि पूरी तरह से संभव हो सकता है जो भी कारण (बुरी तरह से आदि, राजनीतिक रूप से समझौता किया है, उसका उपयोग और क्लियर कॉल का उपयोग नहीं करने के लिए उपयोगकर्ता के कारण प्रयोग करने योग्य, नहीं लिखा , आदि).
मैं मैं आवाज क्रिप्टो प्रौद्योगिकियों और आवाज क्रिप्टो उत्पादों के लिए एक व्यापक मापदंड तैयार करेंगे लगता है, तो यह है कि यह मूल्यांकन करने के लिए criterias की एक पूर्ण पारदर्शी सेट करने के लिए बहुत आसान और ज्यादा व्यावहारिक होगा.
लेकिन उन वास्तव में एक अच्छी आवाज एन्क्रिप्शन प्रणाली के लिए मिलान किया जा करने के लिए सुरक्षा का आधार हैं!
पर कुछ उपयोगी अतीत स्लाइड पढ़ें आवाज एन्क्रिप्शन सिस्टम में इस्तेमाल सुरक्षा प्रोटोकॉल (भाग 2).
अब अपने शोध के बारे में कुछ अधिक व्यावहारिक संदेह नीचे पढ़ें.
समीक्षा की सुरक्षा की अवधारणा भ्रामक है: किसी भी काट दिया युक्ति हमेशा रोका जा सकता है!
मैं लोगों को पूरी तरह से बात याद है कि लगता है: एक समझौता ऑपरेटिंग सिस्टम पर चल सॉफ्टवेयर किसी भी तरह रोका जा सकता है
अब वे एक मोबाइल फोन की तरह एक पीसी पर एक ट्रोजन स्थापित है, सिर्फ इसलिए भी फिलिप ज़िम्मरमैन से Zfone (एक पीसी सॉफ्टवेयर) टूट गया है कि बाहर की ओर इशारा करते हैं?
कोई सुरक्षा सॉफ्टवेयर अंतर्निहित ऑपरेटिंग सिस्टम किसी भी तरह विश्वास किया जाता है कि इस बात पर भरोसा करते हैं और सॉफ्टवेयर चलाने जहां पर्यावरण की अखंडता की रक्षा करता है.
- एक ट्रोजन से संक्रमित अगर आप एक डिस्क एन्क्रिप्शन प्रणाली लेकिन अपने पीसी है, तो कंप्यूटर पहले से ही समझौता किया है.
- तुम एक आवाज एन्क्रिप्शन प्रणाली है, लेकिन अपने पीसी एक ट्रोजन से संक्रमित है, तो कंप्यूटर पहले से ही समझौता किया है.
- तुम एक आवाज एन्क्रिप्शन प्रणाली है, लेकिन अपने मोबाइल फोन एक ट्रोजन से संक्रमित है, तो मोबाइल फोन पहले से ही समझौता किया है.
आप चल रहे हैं जो सॉफ्टवेयर कोई बात नहीं, इस तरह के मामले में अपने परिचालन वातावरण की सुरक्षा के साथ समझौता कर रहा है और एक तरह से या किसी अन्य तरीके से सभी जानकारी अखंडता और गोपनीयता समझौता किया है.
मैं PhoneCrypt अवरोधन के लिए कैसे ऊपर बताया गया है की तरह.
इस खतरे से बचाने के लिए कर सकते हैं कि केवल बातें ठीक से इसे लागू करने, ट्रस्ट कंप्यूटिंग क्षमता के साथ एक बंद ऑपरेटिंग सिस्टम में चल रहा है.
किसी भी "ओपन" ऑपरेटिंग सिस्टम ऐसी हमें विंडोज, विंडोज मोबाइल, लिनक्स, iPhone या Android पर सुनिश्चित करने के लिए वास्तव में एक सॉफ्टवेयर की रक्षा के लिए कोई संभावना नहीं है.
ऐसे सिम्बियन ओएस या RimOS के रूप में मुश्किल ऑपरेटिंग सिस्टम पर शायद चल सॉफ्टवेयर (कम से कम आंशिक रूप से) संरक्षित किया जा सकता है
That's the reason for which the security concept that guys are leveraging to carry on their marketing campaign has no clue.
It's just because they control the environment, they know Flexispy software and so they adjusted their software not to be interceptable when Flexispy is installed.
If you develop a trojan with the other techniques i described above you will 100% intercept PhoneCrypt.
On that subject also Dustin Tamme l, Security researcher of BreakPoint Systems , pointed on on VoIP Security Alliance mailing lists that the security analysis is based on wrong concepts .
The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you!
PhoneCrypt can be intercepted with “on device spyware”.
क्यों?
Because Windows Mobile is an unsecure operating environment and PhoneCrypt runs on Windows Mobile.
Windows Mobile does not use Trusted Computing and so any software can do anything.
The platform choice for a secure telephony system is important.
How?
I quickly discussed with some knowledgeable windows mobile hackers about 2 different way to intercept PhoneCrypt with an on-device spyware (given the unsecure Windows Mobile Platform).
a) Inject a malicious DLL into the software and intercept from within the Phonecrypt itself.
In Windows Mobile any software can be subject to DLL code injection.
What an attacker can do is to inject into the PhoneCrypt software (or any software running on the phone), hooking the Audio related functions acting as a “function proxy” between the PhoneCrypt and the real API to record/play audio.
It's a matter of “hooking” only 2 functions, the one that record and the one that play audio.
That's simple, any programmer will tell you to do so.
They simply decided that's better not to make any notice about this.
b) Create a new audio driver that simply act as a proxy to the real one and intercept PhoneCrypt
In Windows Mobile you can create new Audio Drivers and new Audio Filters.
What an attacker can do is to load a new audio driver that does not do anything else than passing the real audio driver function TO/FROM the realone. In the meantime intercept everything recorded and everything played :-)
They simply decided that's better not to make any notice to that way of intercepting phone call on PhoneCrypt .
Those are just 2 quick ideas, more can be probably done.
Sounds much like a marketing activity – Not a security research.
I have to tell you. I analyzed the issue very carefully and on most aspects. All this things about the voice encryption analisys sounds to me like a marketing campaign of SecurStar GmbH to sell PhoneCrypt and gain reputation. A well articulated and well prepared campaign to attract the media saying, in an indirect way cheating the media, that PhoneCrypt is the only one secure. You see the press releases of SecurStar and of the “Security researcher Notrax telling that PhoneCrypt is the only secure product” . SecurStar PhoneCrypt is the only product the anonymous hacker “Notrax” consider secure of the “software solutions”.
The only “software version” in competition with:
–
SnapCell – No one can buy it. A security company that does not even had anymore a webpage. The company does not almost exist anymore.
Does it sounds strange that only those other products are considered secure along with PhoneCrypt .
Also… let's check the kind of multimedia content in the different reviews available of Gold-Lock, Cellcrypt and Phonecrypt in order to understand how much the marketing guys pressed to make the PhoneCrypt review the most attractive:
| Application | Screenshots of application | Video with demonstration of interception | Network demonstration |
| PhoneCrypt | 5 | 0 | 1 | |
| CellCrypt | 0 | 2 | 0 |
| GoldLock | 1 | 2 | 0 |
It's clear that PhoneCrypt is reviewed showing more features explicitly shown and major security features product description than the other.
Too much difference between them, should we suspect it's a marketing tips?
But again other strange things analyzing the way it was done…
If it was “an impartial and neutral review” we should see good and bad things on all the products right?
Ok, see the table below regarding the opinion indicated in each paragraph of the different reviews available of Gold-Lock, CellCrypt and Phonecrypt (are the only available) to see if are positive or negative.
| Application | Number of paragraphs | Positive paragraphs | Negative paragraphs | Neutral paragraphs |
| PhoneCrypt | 9 | 9 | 0 | 0 |
| CellCrypt | 12 | 0 | 10 | 2 |
| GoldLock | 9 | 0 | 8 | 1 |
Detailed paragraphs opinion analysis of Phonecrypt | Paragraph of review | Opinion expressed |
| From their website | They already used in past Marketing activities like the one about creating a trojan for Windows Mobile and saying that their software is secure from the trojan that they wrote.
Read about their marketing tricks of 2007 They developed a Trojan (RexSpy) for Windows Mobile, made a demonstration capability of the trojan and later on told that they included “Anti-Trojan” capability to their PhoneCrypt software.They never released informations on that trojan, not even proved that it exists. The researcher Collin Mulliner told at that time that it sounds like a marketing tips (also because he was not able to get from SecurStar CEO Hafner any information about that trojan): “This makes you wonder if this is just a marketing thing.” Now, let's try to make some logical reassignment.
It's part of the way they do marketing, an very unfriendly and unpolite approach with customers, journalist and users trying to provide wrong security concepts for a market advantage. Being sure that who read don't have all the skills to do in depth security evaluation and find the truth behind their marketing trips. Who is the hacker notrax?
It sounds like a camouflage of a fake identity required to have an “independent hacker” that make an “independent review” that is more strong on reputation building.
Read about his bio: ¾ Human, ¼ Android (Well that would be cool at least.) I am just an enthusiast of pretty much anything that talks binary and if it has a RS232 port even better. During the day I masquerade as an engineer working on some pretty cool projects at times, but mostly I do the fun stuff at night. I have been thinking of starting an official blog for about 4.5 years to share some of the things I come across, can't figure out, or just cross my mind. Due to my day job and my nighttime meddling, I will update this when I can. I hope some find it useful, if you don't, well you don't. There are no information about this guy on google.
Almost any hacker that get public have articles online, post in mailing archive and/or forum or some result of their activity.
For notrax, nothing is available. Additionally let's look at the domain…
The domain infosecurityguard.com is privacy protected by domainsbyproxy to prevent understanding who is the owner.
The domain has been created 2 months ago on 01-Dec-09 on godaddy.com registrar. What's also very interesting to notice that this “unknown hacker with no trace on google about him that appeared on December 2009 on the net” is referred on SecurStar GmbH Press Release as a “An IT security expert”. Maybe they “know personally” who's this anonymous notrax? :) Am i following my own conspiracy thinking or maybe there's some reasonable doubt that everything was arrange in that funny way just for a marketing activity? Social consideration
If you are a security company you job have also a social aspects, you should also work to make the world a better place (sure to make business but “not being evil”). You cannot cheat the skills of the end users in evaluating security making fake misleading information. You should do awareness on end users, to make them more conscious of security issues, giving them the tools to understand and decide themselves. Hope you had fun reading this article and you made your own consideration about this. Fabio Pietrosanti (naif) ps Those are my personal professional opinion, let's speak about technology and security, not marketing.
pps i am not that smart in web writing, so sorry for how the text is formatted and how the flow of the article is unstructured! 29 January 2010 – 10:12 am
आप इसराइल एक कंपनी वे सरकार द्वारा अधिकृत किया जाना चाहिए एन्क्रिप्शन उत्पाद विकसित करने की जरूरत है जहां एक देश है कि पता होना चाहिए. सरकार क्रिप्टोग्राफी कर रही कंपनियों उन्हें कुछ भी बुरा और क्या वे सरकार के लिए अच्छे से कर सकते हैं कि हो सकता है नहीं करना चाहते हैं, तो वे पहला अधिकृत किया जाना है. क्योंकि अवरोधन और encryptio एनएम उस्त प्रदान कंपनियों के लिए एक लाइसेंस के लिए लागू इसराइल कानून इस पर के समान होने की बहुत सीमित है चीन कानून . प्रौद्योगिकियों की उन तरह इसराइल देश के खुफिया और जासूसी क्षमताओं के लिए मौलिक विचार कर रहे हैं वह है. "रक्षा इसराइल मंत्रालय द्वारा लाइसेंस" कंपनियों के कुछ उदाहरण दे करने के लिए: "रक्षा इसराइल मंत्रालय द्वारा लाइसेंस" जीएसएम एन्क्रिप्शन उत्पादों - सोने का ताला "रक्षा इसराइल मंत्रालय द्वारा लाइसेंस" संचार उत्पादों की अवरोधन - VERINT "रक्षा इसराइल मंत्रालय द्वारा लाइसेंस" एचएफ एन्क्रिप्टेड रेडियो - Kavit निगरानी सेवाओं और "रक्षा इसराइल मंत्रालय द्वारा लाइसेंस" उपकरण - बहु स्तरीय समाधान कैसे आप इसराइल में एन्क्रिप्शन प्रौद्योगिकियों करते हैं एक "रक्षा इसराइल मंत्रालय द्वारा लाइसेंस" के लिए लागू करने के लिए उदाहरण के लिए? एक इजरायली कंपनी होने का यकीन है, क्लिक करें यहाँ और रूपों भरें. किसी encryption-control@mod.gov.il से संपर्क करेंगे और बेचने के लिए लाइसेंस आप दे या नहीं करने के लिए कि क्या आप के साथ चर्चा करेंगे. What does the department of defense will require from an israeli company in order to provide them the authorization to make and sell interception and encryption products? Well, what they want and what they really ask nobody knows. It's a secret dealing of Israel Ministry of Defense with each “licensed” company. What we know for sure is that Verint, a “Licensed by Israel Ministry of Defense”, placed a backdoor to intercept companies and governments in the US and Netherland into the interception systems they was selling. Verint, a Licensed by Israel Ministry of Defense Company, provided to Israel government eavesdropped communications of private and government users in the United States and in the Netherland . CIA officier reported that Israel Ministry of Defense was known to pay Verint a reimbursement of 50% of their costs in order to have from Verint espionage services trough their commercial activity on selling “backdoored” interception equipment to spy foreign users. It can be a legitimate doubt that the cooperation within the Israeli Ministry of Defense may be problematic for an Israeli company that want to sell interception and encryption product abroad. Those companies may be forced to make the interests of Israel Ministry of Defense and not the interests of the customers (like Verint scandal is a real-world example). So, how would a “Licensed by Israel Ministry of Defense” be a good things to promote? It represent the risk that the “Israel Ministry of Defense”, like is publicly known that it has already have done with Verint, will interfere with what the company do. It represent the risk that the “Israel Ministry of Defense” may reasonably provide “reimbursement” of costs paying the company and get what they would likely would like to get. So, what does really “Israel Ministry of Defense” want from Israel companies doing encryption and interception technologies? Should we ask ourself whether Israeli companies doing encryption and interception businesses are more interested to do business or to do “outsourced espionage services” for their always paying customer, the “Israel Ministry of Defense”. For sure, in the age of financial crisis, the Israel Ministry of Defense is a paying customer that does not have budget problem… Strict control, strict rules, strong government strategic and military cooperation. सावधान रहें. If you want to read more about this matters, about how technologies from certain countries is usually polluted with their governments military and secret services strategies stay tuned as i am preparing a post about this . You will much better understand about that subjects on the “Licensed by Israel Ministry of Defense”. 25 November 2009 – 2:56 pm This post is to talk about the “unfair” marketing approach of Gold-Lock, an israeli company doing mobile voice encryption authorized by Israeli Ministry of Defence . Following an announcement seen on Linkedin “Information Security Community” group:
GoldLock is offering US$ 100.000 and a job for an unencryption GoldLock, an israeli encryption and security company is offering US$ 100.000 and a job to anyone capable to decrypt a cellular conversation contained in a file provided in their site ( https://www.gold-lock.com/app/en/?wicket:interface=:8 ::::).
The transcription must be sent back to GoldLock until February 1st, 2010.
The contest is open to all and any tools or technology may be used.
Good luck to all!!! I commented: Not having a public protocol specification is not even scientifically serious to make a marketing tricks like this.
I would say to gold-lock, let's release the source code and let anyone compile the cryptographic engine if you trust not to to have something nasty inside… ;)
Toni Koivunen from F-secure said: So… They will pay $100k if you get through the AES and the hassle with keys.
If someone would pull it off they would certainly make a truckload more money elsewhere. Plus they would retain the rights to the code/technology that they created, which isn't the case if they go for the $100k since the License pretty clearly says that:
# An assignment letter to Gold Line, in a form satisfactory to Gold Line of your technology and the Work Plan (the “Technology”). Such assignment form shall enable Gold Line to transfer the rights on the Technology to Gold Line, including the right to register patents and all other rights.
# A release and waiver form, in a form satisfactory to Gold Line, duly executed by you and any other participant of any rights to the Technology.
Plus of course Gold Line retains the right to change the rules of the game with prior notice. Or needing to notify afterwards either.
Sounds fair :)
Michel Scovetta from Computer Associates said: It sounds like the purpose of this is to get some cheap testing out of it, and to be able to say something like, “The best crypto experts in the world tried to break it, and were unable to.” According to some of the docs on Gold Lock's website, they use ECC-256 and a “modified DH key exchange” (which tingles my spidey senses), SHA-256, and then XOR for the actual data encryption. They use practically blasphemous language like, “Each component of the Gold Lock Enterprise solution is tested and proven secure against any conceivable attack.” *Proven* secure? *Any conceivable* attack? Yikes! In another doc on their site, they talk about their first layer relying on 1024-bit RSA. GoDaddy doesn't even allow 1024-bit keys to be used anymore when generating $20 SSL certificates. They quote 300 billion MIPS-years to break, but if my math is correct, that comes down to about 52 days on the top supercomputer right now. Not trivial, but this is an offline attack, so time is on the side of the attacker. The description then talks about the device generating 16k keys when you register the device. If the protocol is “secure”, then it should be “secure” with only a single key. If it's not secure with a single key, then generating 16k keys could only make it 16k times more secure, which is far off from a proof of security. I agree with Fabio – a fair contest would be to include source code and the cryptographic specification. Also, as other contests have proven (eg SecureWebMail), the weakest point isn't usually the cryptography. It's all of the other stuff, and it doesn't look like any of it is being disclosed for the contest. http://xkcd.com/538/ Mike
I would say that all those considerations from security experts from well known and established security companies bring us to consider that: - Gold-lock is not transparent on their encryption at all and they work trough bad practice of Security Trough Obscurity (no one know what's inside the product)
- Gold-lock is not playing a fair game by proposing this 'security contest'
- Gold-lock being certified by Israeli ministry of defence may raise doubt related to possible relationship with the intelligence… Read by post Certified by Israeli MInistry of Defense .
Voice security is a sensible matters and lacks of transparency and governmental relationship for cryptographic choices usually does not provide anything good… Think about it… 7 November 2009 – 3:38 pm It seems that in Turkey the Telecommunication Directorate (TIB), in charge of managing the wiretapping, intercepted the president of the Judge and Prosecutors Associations. Prosecutors and Judge usually does not like being tapped, and so the 1st High Criminal Court ordered an audit of all the recording done by the TIB since 2006. और पढ़ें यहाँ . I will make some in depth articles about how voice encryption really works in government environments. The open standards and open source still have to reach the military and government environments for what's related to secure speech. To give you an idea of the complexity and kind of particular issues that exists, look at the USA 3G Wireless Security: A Government Perspective and the A Waveform Architecture to Support Security and Interoperability in Multi-National Wireless Networks for Tactical Communication . They are using so-custom protocols like Secure Communications Interoperability Protocol that require the use of patented MELPe ultra-narrowband codec that there's not a real market of application and equipment using this. Only a small elite of government controlled companies from few countries manage this de-facto lobby. Should we change this bringing open standards also to government sectors? You know, we would not be able to use VoIP and have cheap international phone calls without audio compression codecs. It's plenty of them, some royalty free, some patented by telco's lobby (think that some patented and royalty-based codec it's also a standard, where all market player have to pay the most aggressive one that acquired the patent while defining the standards). However, there is a nice collection from vocal , to understand how they sounds. |
