Cryptographic Algorithms, Key Sizes and Parameters - ENISA recommendations for 2013

ENISA has just published a report on cryptographic algorithms, key sizes and parameters, written by a team of recognized European cryptographers.

Secure SAML validation to prevent XML signature wrapping attacks

SAML assertions are becoming popular method for passing authentication and authorisation information between identity providers and consumers using various single sign-on protocols. However their practical security strongly depends on correct implementation, especially on the consumer side. Somorovsky and others have demonstrated a number of XML signature related vulnerabilities in SAML assertion validation frameworks. This article demonstrates how bad library documentation and examples can lead to vulnerable consumer code and how this can be avoided.

Practical security of RSA keys over Internet

A very important research paper has been just published on eprint — wide analysis of practical security of RSA keys found in the wild. It shows that implementation or usage issues resulting in weak keys are much more widespread than previously expected.

Pierwszy polski szyfrator na polu walki

Firma Enigma Systemy Ochrony Informacji przedstawia pierwszy polski szyfrator, który spełnia rygorystyczne normy konstrukcyjne charakterystyczne dla pola walki (NO-06-A103).

IETF: Mediated RSA cryptography specification for additive private key splitting (mRSAA)

IETF has just accepted an Internet standard draft proposal for "Mediated RSA cryptography specification for additive private key splitting (mRSAA)" autored by cryptographers from Trusted Information Consulting and Wroclaw University of Technology.

Pragmatic view on European Directive 1999/93/EC on electronic signature

My presentation from European Electronic Signature Forum 2011 that discusses various legal and technical issues of EU Directive 1999/93/EC on electronic signatures that prevented widespread adoption of the signature on the EU market.

Security in the GSM network

Security paper by Marcin Olawski. Abstract: The GSM network is the biggest IT network on the Earth. Most of their users are connected to this network 24h a day but not many knows anything abut GSM security, how it works and how
good it is. Most people blindly trust GSM security and send by the network not only theirs very private conversations and text messages but also their current location. This paper will describe how that information is guarded in 2G networks and how much of it an attacker can access without our permission or knowledge.

JavaScript cryptography

Crypto-js seems to be a nice collection of standard cryptographic algorithms for JavaScript. Implementing PwdHash clones should be now easier than ever :)

Darmowe skrypty z bezpieczeństwa systemów sieciowych

Nakładem Biblioteki Cyfrowej Politechniki Łódzkiej wydane zostały właśnie "Ćwiczenia laboratoryjne z bezpieczeństwa systemów sieciowych: dla studentów studiów I stopnia kierunku informatyka". W wersji elektronicznej skrypty są ogólnodostępne i darmowe.

Warszawa 11 maja: Na PLUG o Bitcoin

Polish Linux Users Group (PLUG) w Warszawie zaprasza na otwarty wykład na temat cyfrowej waluty Bitcoin. Wykład odbędzie się w środę 11 maja w budynku MiMUW.


This is a page that will redirect you to a new location for pam_tacplus project that is still linked here from many sites.

Zagadka kryptograficzna z XVIII wieku

W grudniu ubiegłego roku Archiwum Państwowe w Lublinie opublikowało interesujący dokument z XVIII pisany szyfrem, a dotyczący następstwa na tron polski.

CompCrypt ETA-MIL 10P z certyfikatem SKW

Szyfrator CompCrypt ETA-MIL 10P uzyskał certyfikat służby ochrony państwa dopuszczający do ochrony informacji niejawnych do klauzuli POUFNE / NATO CONFIDENTIAL / CONFIDENTIEL EU.

Aktualne zalecenia co do siły algorytmów kryptograficznych (SP80-131A)

NIST opublikował nowe zalecenia odnośnie siły algorytmów kryptograficznych stosowanych do szyfrowania i ochrony autentyczności danych elektronicznych.

Suricata IDS on OpenBSD 4.8

Suricata is a new open-source intrusion detection product from Open InfoSec Foundation, much like and mostly compatible with well-known Snort. Suricata is still in beta and it didn't compile cleanly on OpenBSD. Now it does.

Syndicate content