CCC Event Weblog

After many attacks on X.509 and the internet PKI infrastructure, it became clear, that the current state does not meet the requirements for the upcoming challenges for secure internet communication in the future. CAs have been completely compromised, and weak cryptography used by PKIs has been broken in practice to issue rouge certificates. So there is a need for an alternative how to establish a binding between your public key and your identity. The EFF will present their proposal to improve the security of SSL/TLS connections this evening at the congress.

See the talk, Day 3, 23:00, Saal 3.

Author: Erik Tews

Some of you may remember the Cold Boot Attack. It’s a general method, how almost all disk encryption schemes on PCs and Laptop can be circumvented. Usually, when a harddisk or just a partition is encrypted, the encryption software used, needs to store the keys in memory, as long as the filesystem is mounted. Three years ago, it was shown that this key can be extracted, just by removing the RAM module, and dumping it’s content on a second PC using a custom software. Alternatively, the system can be booted from a CD or USB-stick with a custom software, that dumps the content of the RAM. As long as the RAM has only been off for a few seconds, or cold down to a low temperature, it doesn’t loose the stored data completely, and the encryption keys can be recovered from that dump.

Today, a solution  for this problem will be presented, that prevents the attack by never storing the encryption key in RAM. Instead, CPU registers are used, and because the encryption code runs in kernel space, it can ensure, that they are never stored in RAM.

This sounds like a good solution to me, except that it only prevents the encryption key from leaking. Of course, the actual data, that is decrypted and that applications on that system work with, can still be found in RAM, but I have no idea how this can be fixed easily.

See the talk: Day 3, 14:30, Saal 2

Two Bitcoin related talks will be presented tomorrow. Bitcoin is a decentralized digital currency, and of course uses various cryptographic schemes as building blocks. Because Bitcoins can be exchanged with real money, Bitcoin is more than just an academic playground and real cash could be lost, if an attack on Bitcoin would be found.

The first talk Bitcoin – An Analysis will be presented by Kay Hamacher and Stefan Katzenbeisser. From the abstract:

In this presentation, we show results on network analysis of the money flow, the behavior of individuals, and the overall scalability of P2P-currencies. At the same time we will discuss advanced “financial instruments” that one might find in the transactions.

So I assume that this will be an in-depth analysis of the current state of the Bitcoin network. The second talk Electronic money: The road to Bitcoin and a glimpse forward – How the e-money systems can be made better given by peio will cover the general topic of digital money and what lead to the development of Bitcoin. It will even look beyond Bitcoin and what can be improved in the future. From the abstract:

The proposed talk provides a definition of the problem of creating e-money and after a review of the state of the art points out possible solutions and proposes questions for discussion for the properties of electronic money system.

For me, both talks are interesting. Besides the cryptographic challenges in this research area, this topic also has an heavy political impact. What would you do, if you could exchange money over the internet, untraceable and anonymously?

See the talks, Day 3, 14:00 Saal 1, and Day 3, 17:15, Saal 3.