www.amazon.com/author/paulbabicki
====================================================
Happy Holidays and Peace for all throughout the world!
=====================================
Google
Releases Test Set to Check Cryptographic Library Security
By Jaikumar Vijayan
eweek.com Posted 2016-12-19
Google's new Project Wycheproof will
let software engineers look for previously known flaws in their open source
cryptographic libraries.
Google has released a set of tests that developers can use
to check some open source cryptographic libraries for known security
vulnerabilities.
The company has named the set of tests Project Wycheproof,
after a mountain in Australia, which has the distinction of being the world's
smallest registered mountain.
"The main motivation for the project is to have an
achievable goal," Google security engineers Daniel Bleichenbacher and Thai
Duong, explained in a blog announcing Project
Wycheproof. "The smaller the mountain the easier it is to climb it!"
The engineers wrote that Project Wycheproof is designed to
help developers catch subtle mistakes in open source cryptographic libraries
that, if left unaddressed, can have catastrophic consequences. Such mistakes
can be repeated too often and become prevalent wherever the encryption is
implemented they noted.
The collection of unit tests that Project Wycheproof
consists of allows developers to test whether certain cryptographic libraries,
including those associated with popular algorithms such as RSA, authenticated
encryption and elliptic curve cryptography are vulnerable to attack.
The tests include those for so-called invalid curve attacks,
weaknesses in digital signature schemes and a variety of other exploits. In
total, Project Wycheproof currently includes unit tests for 80 different types
of attacks against cryptographic algorithms. To develop each unit test,
Google's cryptographers surveyed available literature and implemented most of
the known attacks against the algorithms.
The tests have already allowed Google to discover a total of
40 security flaws in cryptographic algorithms such as the Digital Signature
Algorithm (DSA), Elliptic Curve Diffie-Hellman Cryptography (ECDHC). Some of
the flaws that Google discovered via the Project Wycheproof tests were serious,
including one that could be used to recover the private keys associated with
ECDHC and DSA implementations.
Unit tests are currently available for several popular open
source algorithms including DSA, ECDH, RSA, AES and Diffie-Hellman.
Google will continue to develop as many new attacks as
possible to test open cryptographic libraries, but the company's effort is by
no means comprehensive and developers should not assume their code is error
free just because they pass Project Wycheproof, the two Google researchers
said.
"Passing the tests does not imply that the library is
secure, it just means that it is not vulnerable to the attacks that Project
Wycheproof tests for," Bleichenbacher and Duong wrote.
Project Wycheproof is the second set of testing tools that
Google has released recently. Earlier this month, the company released OSS-Fuzz, a
continuous testing service for open source software. The service is designed to
uncover security flaws by subjecting software to a continuous stream of attack
data.
Google has said the goal is to help developers and researchers
find critical issues like SQL injection errors and buffer overflows in some of
the largest and most widely-used open source projects and components in the
world.
=============================================== Good Netiquette And A Green Internet To All!
=========================================================================================Tabula Rosa Systems - Tabula Rosa Systems (TRS) is dedicated to providing Best of Breed Technology and Best of Class Professional Services to our Clients. We have a portfolio of products which we have selected for their capabilities, viability and value. TRS provides product, design, implementation and support services on all products that we represent. Additionally, TRS provides expertise in Network Analysis, eBusiness Application Profiling, ePolicy and eBusiness Troubleshooting. We can be contacted at:
===============================================================
In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” has just been published and will be followed by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:
www.amazon.com/author/paulbabicki
Anyone who would like to review the book and have it posted on my blog or website, please contact me paul@netiquetteiq.com.
In addition to this blog, I maintain a radio show on BlogtalkRadio and an online newsletter via paper.li.I have established Netiquette discussion groups with Linkedin and Yahoo. I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and I have been contributing to the blogs Everything Email and emailmonday . My work has appeared in numerous publications and I have presented to groups such as The Breakfast Club of NJ and PSG of Mercer County, NJ.
Additionally, I am the president of Tabula Rosa Systems,
a “best of breed” reseller of products for communications, email,
network management software, security products and professional
services. Also, I am the president of Netiquette IQ. We are currently developing an email IQ rating system, Netiquette IQ, which promotes the fundamentals outlined in my book.
Over the past twenty-five years, I have enjoyed a dynamic and successful career and have attained an extensive background in IT and electronic communications by selling and marketing within the information technology marketplace.
=============================================================
No comments:
Post a Comment