[00:17.310 --> 00:18.270]  Hey, everybody.
[00:18.710 --> 00:20.090]  You want to take your seats?
[00:21.130 --> 00:21.950]  Right now.
[00:23.730 --> 00:24.550]  Bruce Schneider.
[00:25.290 --> 00:32.350]  All right, we're running about 45 minutes late, so there's not much time for mingling.
[01:06.050 --> 01:06.730]  All right.
[01:09.470 --> 01:10.870]  Hello, I'm Bruce Schneider.
[01:11.030 --> 01:18.110]  I'm going to spend about an hour talking about cryptography and how it relates to security and how it affects us.
[01:18.670 --> 01:21.950]  I'm not going to do any math and very little technology.
[01:22.130 --> 01:26.470]  I'm going to spend a lot of time talking about the social issues and the real problems.
[01:27.970 --> 01:36.310]  Often, you know, the promise of cryptography are things like triple DES and MD4, and the reality is more like the stuff you just saw about Microsoft.
[01:36.830 --> 01:41.330]  And I want to talk a lot about that relationship, because that's, you know, really what matters.
[01:43.450 --> 01:45.990]  That's the boring title for the boring types.
[01:48.090 --> 01:51.910]  I'll have a postscript version of this available for anyone who sends me email.
[01:52.230 --> 01:59.750]  So if anyone wants copies of the overheads, there's more in what I send you than I'll do here, since I'll just try to limit this.
[02:00.370 --> 02:02.750]  So my email address is pretty easy to remember.
[02:09.460 --> 02:11.820]  So cryptography is actually a pretty cool thing.
[02:12.020 --> 02:13.880]  It can do a lot of good stuff.
[02:14.520 --> 02:15.000]  Right?
[02:15.700 --> 02:16.520]  It protects you.
[02:16.540 --> 02:17.180]  It protects privacy.
[02:17.400 --> 02:18.380]  It does anonymity.
[02:18.540 --> 02:19.120]  It does authentication.
[02:20.040 --> 02:23.000]  It does trust, credentials, integrity.
[02:23.860 --> 02:26.420]  We can do fairness in electronic commerce.
[02:26.700 --> 02:27.640]  We can do audits.
[02:28.320 --> 02:28.400]  Right?
[02:28.520 --> 02:30.400]  Fundamentally, it stops lying and cheating.
[02:31.080 --> 02:31.640]  Right?
[02:31.720 --> 02:32.760]  That's the promise.
[02:36.760 --> 02:37.320]  Right?
[02:37.440 --> 02:39.040]  None of this is new.
[02:40.200 --> 02:44.120]  Lewis Free likes to talk about the new dangers of cryptography.
[02:44.300 --> 02:45.640]  And you'll talk all about those things.
[02:45.880 --> 02:47.220]  None of this is new.
[02:47.520 --> 02:48.060]  Right?
[02:48.160 --> 02:49.080]  Everybody uses privacy.
[02:49.080 --> 02:49.980]  Everyone used to have privacy.
[02:51.340 --> 02:54.280]  Before electronics, privacy was easy to get.
[02:57.360 --> 02:59.080]  Everyone used to have authentication.
[03:00.000 --> 03:04.520]  Physical recognition, voice authentication, handwriting, signatures.
[03:04.740 --> 03:06.400]  This is all used to provide authentication.
[03:07.320 --> 03:15.520]  All cryptography is doing is allowing us to take all of those constructs from the real world and move them into the world of cyberspace.
[03:15.700 --> 03:16.680]  But that's the big deal.
[03:16.980 --> 03:19.580]  We're starting to see society and cyberspace.
[03:19.840 --> 03:30.520]  So we want to take the same social and business constructs like privacy, like trust, like anonymity, like reputations and move them into this new world.
[03:31.420 --> 03:36.440]  So cryptography is equalizing technology by moving this stuff.
[03:40.750 --> 03:44.190]  And this is all turning out to be a really big deal.
[03:44.470 --> 03:44.990]  Right?
[03:45.090 --> 03:46.390]  It's real important now.
[03:46.730 --> 03:49.730]  We have the net as a real live business tool.
[03:50.010 --> 03:53.850]  Five years ago, you hack into the net and you get some obscure technical manual.
[03:54.130 --> 03:54.610]  So what?
[03:54.890 --> 03:58.810]  Now you hack into the net, you can take down a company, you can steal money.
[03:59.130 --> 03:59.610]  Right?
[03:59.690 --> 04:00.690]  It matters now.
[04:01.730 --> 04:02.210]  Right?
[04:02.390 --> 04:04.950]  Every computer is connected to every other computer.
[04:05.170 --> 04:07.170]  Then there's more good stuff on there.
[04:07.630 --> 04:14.070]  So as a place for a criminal to go, the net is much more attractive than it was a few years ago.
[04:15.150 --> 04:15.630]  Right?
[04:15.750 --> 04:18.430]  I mean content of value, communications of real value.
[04:19.450 --> 04:25.090]  We're starting to see legal proceedings, trials using closed circuit video links.
[04:25.670 --> 04:27.510]  We're seeing mail-in elections.
[04:28.010 --> 04:31.570]  A lot of the things we used to do face to face, we're now doing remotely.
[04:31.870 --> 04:33.690]  And these things will move on to the net.
[04:34.310 --> 04:34.490]  Right?
[04:34.690 --> 04:39.130]  Real commerce and relationships forming and existing in cyberspace.
[04:39.330 --> 04:41.930]  Another new thing that we didn't have a decade ago.
[04:47.630 --> 04:51.890]  Unfortunately, most of the security products out there really aren't secure at all.
[04:53.210 --> 04:55.190]  Most of them don't use cryptography.
[04:55.610 --> 04:57.850]  Those that do stick it at the last minute.
[04:59.190 --> 05:04.690]  Those that do don't hire real cryptographic engineers and do the kind of thing that Microsoft did.
[05:04.970 --> 05:08.990]  And I could walk in and fix that problem with a couple of XORs here and there.
[05:09.210 --> 05:11.570]  It's not a complicated issue to solve.
[05:12.690 --> 05:15.390]  So companies continue to get it wrong again and again.
[05:16.610 --> 05:20.110]  The products out there are usually pretty bad.
[05:20.350 --> 05:21.290]  They're not flexible.
[05:21.470 --> 05:22.270]  They're hard to use.
[05:22.390 --> 05:22.970]  They're buggy.
[05:23.430 --> 05:25.390]  The solutions often don't scale.
[05:25.690 --> 05:30.630]  They'll work for one user or ten users but won't work on a network of a thousand users.
[05:32.590 --> 05:35.270]  Often products don't solve the correct problem.
[05:36.250 --> 05:40.970]  Fundamentally, the first thing you want to do when looking at a security problem is figure out what the problem is.
[05:41.130 --> 05:45.610]  Figure out what the trust relationships are that you want to move into cyberspace.
[05:45.950 --> 05:55.930]  Very often, existing products don't take that approach and they end up making incorrect fundamental assumptions and solving a different problem than the problem they think they're solving.
[05:56.670 --> 05:59.270]  And sometimes it actually will create new problems.
[05:59.730 --> 06:03.570]  The resulting system will be more insecure after the security software has been installed.
[06:05.310 --> 06:10.330]  And sort of on top of that, generic operating systems are buggy.
[06:10.550 --> 06:14.730]  Which makes any security solution on top of that, all that more problematic.
[06:16.630 --> 06:19.730]  But that's actually okay because people buy the stuff anyway.
[06:20.250 --> 06:20.690]  Right?
[06:20.710 --> 06:23.150]  You can make a lot of money selling a bad firewall.
[06:23.810 --> 06:27.210]  You just get NCSA approval which isn't hard to get and you sell it.
[06:28.870 --> 06:31.070]  And, you know, we have a problem here.
[06:31.390 --> 06:34.570]  The public, the consumers, are not educated.
[06:35.130 --> 06:38.790]  They can't tell the difference between a good security product and a bad security product.
[06:39.670 --> 06:41.850]  Products are what I call buzzword compliant.
[06:42.170 --> 06:44.010]  We use DES, we use triple DES.
[06:44.330 --> 06:48.590]  Which is pretty much meaningless but, you know, it meets some corporate checklist.
[06:54.100 --> 06:56.920]  And unfortunately in the near term I see this getting worse.
[06:58.500 --> 06:59.020]  Right?
[06:59.100 --> 07:01.020]  More and more stuff is going online.
[07:01.500 --> 07:03.400]  The important stuff is electronic.
[07:03.780 --> 07:06.360]  Ten years ago the electronic stuff was unimportant.
[07:06.520 --> 07:08.540]  And the important stuff was handled manually.
[07:08.940 --> 07:10.220]  That's being swapped.
[07:10.860 --> 07:11.300]  Right?
[07:11.480 --> 07:14.220]  Financial processing, medical information.
[07:14.680 --> 07:20.160]  There's been a number of good newspaper articles on dangers of medical privacy.
[07:21.920 --> 07:23.640]  Judicial and law databases.
[07:24.240 --> 07:28.080]  Companies that are depending very heavily on networks.
[07:28.680 --> 07:32.160]  Not just to do business efficiently but to do business at all.
[07:33.700 --> 07:36.720]  And the newer technologies end up being less secure.
[07:37.780 --> 07:38.260]  Right?
[07:38.320 --> 07:39.500]  The newer stuff is different.
[07:39.740 --> 07:41.100]  We are not sure how it works.
[07:41.560 --> 07:43.840]  We don't understand the security properties.
[07:45.100 --> 07:46.640]  And we push them to market.
[07:46.900 --> 07:56.980]  If I walk to a company and say, look, you have a good product but let's wait six months before we field it to fix the security, the president will throw me out of his office.
[07:57.140 --> 07:57.780]  We can't do that.
[07:58.460 --> 08:03.700]  The net is all about getting the next big thing out there as fast as possible.
[08:04.140 --> 08:06.580]  And unfortunately that's opposite to security.
[08:08.160 --> 08:08.760]  Right?
[08:09.120 --> 08:10.880]  The fast media is insecure.
[08:11.920 --> 08:14.760]  The internet is less secure than dedicated lines.
[08:15.220 --> 08:17.480]  Sailors less secure than land lines.
[08:19.320 --> 08:22.960]  By doing things automatically is less secure than manually.
[08:24.900 --> 08:29.580]  So we are seeing a lot of these new things and we are seeing stuff diversifying.
[08:29.800 --> 08:35.460]  So if you want to attack a communications link, it might be going over five different physical media.
[08:35.660 --> 08:37.140]  So you can attack it at the weakest point.
[08:37.560 --> 08:38.000]  Right?
[08:38.020 --> 08:41.320]  Similar to what we saw with the NT hash and the land man hash.
[08:41.480 --> 08:42.680]  They are both being used.
[08:42.820 --> 08:44.080]  We can attack the weakest one.
[08:44.940 --> 08:50.060]  So even if we fix a piece, we have to fix the weakest piece to make a difference.
[08:50.640 --> 08:51.060]  Right?
[08:51.120 --> 08:55.680]  We are seeing a lot more mobile solutions out there and we are seeing stuff come faster and faster.
[08:56.000 --> 09:01.620]  And security is really against the philosophy of the net and it slows down progress.
[09:05.690 --> 09:06.950]  Kind of like this wand.
[09:21.240 --> 09:22.960]  You are the first approximation.
[09:23.480 --> 09:29.540]  The threats against digital systems are the same threats against their analog analogs.
[09:30.800 --> 09:31.480]  Right?
[09:31.700 --> 09:34.280]  Criminals will attack systems for financial gain.
[09:34.660 --> 09:39.180]  They will be privacy violations against systems for various reasons.
[09:39.360 --> 09:39.420]  Right?
[09:39.560 --> 09:41.160]  This is no big deal.
[09:41.260 --> 09:42.220]  This is nothing new.
[09:43.980 --> 09:46.660]  So when we are looking at what are the risks?
[09:46.680 --> 09:47.540]  What are the dangers?
[09:47.920 --> 09:49.960]  You look at existing systems.
[09:50.060 --> 09:51.120]  You look at previous systems.
[09:51.440 --> 09:56.880]  You try to see where criminals have exploited problems for financial gain.
[09:58.480 --> 10:06.860]  Now, unfortunately, there are three characteristics of cyberspace that make attacks much worse.
[10:07.620 --> 10:09.520]  And the first one is automation.
[10:11.180 --> 10:15.560]  Nobody would care if I figured out a way to counterfeit nickels.
[10:15.900 --> 10:17.680]  It fundamentally doesn't matter.
[10:17.860 --> 10:19.780]  I can't make enough nickels to make a difference.
[10:21.180 --> 10:26.720]  The Iranians have some really impressive printing presses making hundred dollar bills.
[10:27.440 --> 10:30.320]  We can calculate how much money they could make.
[10:30.460 --> 10:36.600]  They could run the presses 24 hours a day, 365 days a year, and this is the maximum amount of damage they can do.
[10:37.440 --> 10:39.280]  We know what that is.
[10:40.360 --> 10:50.460]  Now, on the net, because I can automate my attack, if I can counterfeit nickels, I might be able to make, you know, a million dollars overnight or in a week.
[10:51.040 --> 10:56.380]  So attacks that flew below the radar suddenly become important.
[10:57.620 --> 11:06.820]  The maybe 20 year old attack of skimming the fractions of pennies from people's interest accounts is a nice example of this.
[11:07.040 --> 11:10.100]  That attack wouldn't be possible without automation.
[11:11.180 --> 11:15.580]  And the same thing about the marginal probability of success.
[11:16.020 --> 11:20.560]  If I found a way to pick someone's pocket, that would work one in a million times.
[11:20.980 --> 11:22.520]  That wouldn't be very useful.
[11:22.940 --> 11:27.340]  But if I can automate it and put it out on the net, I could get seven successes in a day.
[11:31.200 --> 11:33.420]  The second problem is action at a distance.
[11:33.680 --> 11:37.220]  I mean, all of our laws are really based on proximity.
[11:37.820 --> 11:42.000]  An attacker getting in front of somebody and committing some crime.
[11:42.540 --> 11:46.880]  On the net, it's very hard to establish jurisdiction.
[11:47.200 --> 11:50.280]  It's very hard to track where somebody's coming from.
[11:51.640 --> 12:00.680]  If you're a reasonably well funded criminal, you could pick a jurisdiction with a lousy police force and launch your attacks from there.
[12:02.540 --> 12:10.820]  Really on the net, for a lot of attacks, the legal system is only as good as the weakest legal system on the net.
[12:11.580 --> 12:17.000]  And I would expect to see jurisdiction shopping, where people would pick jurisdictions to launch their attacks from.
[12:18.540 --> 12:22.980]  The third big problem is the speed in which attacks propagate.
[12:24.660 --> 12:30.660]  You could look at a lot of attacks against systems and realize the limits of the damage they can do.
[12:31.200 --> 12:37.700]  You look at attacks against pay TV, buying and selling set-top boxes, making, you know, getting free television.
[12:37.980 --> 12:45.560]  If someone works in their basement for a week and makes himself a little box or stick in his television and gets free TV, I mean, that's great.
[12:45.660 --> 12:46.280]  He deserves it.
[12:46.340 --> 12:47.020]  Let him have it.
[12:47.980 --> 12:49.700]  You know, Murdoch doesn't care.
[12:49.700 --> 12:51.120]  It doesn't affect his revenue.
[12:52.420 --> 12:55.540]  Because fundamentally, only very few people could do that.
[12:56.080 --> 13:02.480]  If someone goes out and tries to sell these boxes, you know, he'll be captured by conventional criminal techniques.
[13:02.600 --> 13:03.840]  We know how to deal with dealers.
[13:05.280 --> 13:07.620]  But on the net, it's all software.
[13:08.040 --> 13:16.800]  If someone comes out with a software program that would break a credit card protocol, post it on the net, you could have 100,000 people using it overnight.
[13:18.880 --> 13:23.980]  Physical attacks by their nature level off in how much damage they can do.
[13:24.800 --> 13:28.500]  Software-only attacks can blow up exponentially.
[13:29.120 --> 13:31.580]  You can destroy systems very quickly.
[13:32.720 --> 13:38.340]  And sort of historically, if you look at, especially commerce systems, they've been very reactive.
[13:39.180 --> 13:42.320]  A type of fraud happens and they figure out a way to fix it.
[13:42.560 --> 13:44.540]  And in a few months, they solve it.
[13:44.640 --> 13:45.720]  Or a couple of years.
[13:45.880 --> 13:47.200]  And they eat their losses until then.
[13:47.860 --> 13:51.020]  That only works with physical attacks.
[13:51.320 --> 13:57.980]  With net attacks that are software-only that can explode exponentially, you can't be reactive anymore.
[13:58.200 --> 13:59.720]  You just don't have the time.
[14:06.160 --> 14:11.620]  So now I want to run through some of the three different kinds of attacks.
[14:12.100 --> 14:14.440]  This is the one I've been talking about pretty much for now.
[14:14.680 --> 14:15.560]  It's a criminal attack.
[14:15.780 --> 14:16.520]  It's real easy.
[14:16.720 --> 14:19.240]  How can I make money by attacking this system?
[14:19.500 --> 14:21.780]  And it's all the things you'd expect it to be.
[14:21.940 --> 14:25.520]  It's forgery, misrepresentation, replay, repudiation.
[14:26.120 --> 14:27.780]  I guess counterfeiting is forgery.
[14:28.900 --> 14:30.960]  Generally, these attacks are opportunistic.
[14:31.340 --> 14:32.360]  Often it's insiders.
[14:33.320 --> 14:35.740]  Usually they use the minimum necessary resources.
[14:35.740 --> 14:39.140]  They'll focus on low-tech flaws.
[14:39.180 --> 14:42.320]  They usually won't attack things like the cryptography.
[14:42.920 --> 14:47.760]  They're more likely to steal a stack of cards and attack it that way.
[14:47.920 --> 14:50.600]  Or guess lousy passwords or bribe somebody.
[14:51.500 --> 14:53.400]  It'll focus on the weak systems.
[14:53.940 --> 14:59.800]  So the joke about not having to outrun the bear, only having to outrun your friends works here.
[15:00.340 --> 15:05.540]  If your system is better than the next one, it's likely to be avoided by criminals.
[15:12.200 --> 15:16.580]  And for electronic commerce, we're likely to see a lot of criminal attacks.
[15:16.720 --> 15:19.980]  We've seen criminal attacks against every commerce system ever invented.
[15:21.780 --> 15:26.960]  And I list a few there, from weighted scales to shaving coinage to forging stock certificates.
[15:27.740 --> 15:29.760]  And electronic commerce will be the same.
[15:30.080 --> 15:32.200]  As soon as the money is there, criminals will be there.
[15:32.380 --> 15:34.960]  And it will be loan criminals up to organized crime.
[15:36.060 --> 15:42.800]  I know Ira's going to give a talk tonight talking about how some crime syndicates are using hacker tools.
[15:43.320 --> 15:44.680]  And this is going to continue.
[15:46.220 --> 15:49.900]  I listed sort of the three differences of why it's going to be worse on the net.
[15:50.900 --> 15:53.220]  One thing we're not doing enough of is audit.
[15:53.520 --> 15:57.880]  By audit, I don't mean auditing a system like validating its security.
[15:58.180 --> 16:00.240]  I mean building in an audit trail.
[16:01.220 --> 16:03.340]  We don't prevent crime in this country.
[16:03.460 --> 16:04.100]  It's sort of a myth.
[16:04.100 --> 16:07.220]  If someone wanted to kill you, they would just kill you.
[16:07.700 --> 16:11.100]  What we do is we detect crime after the fact.
[16:11.180 --> 16:12.120]  You're lying there bleeding.
[16:12.720 --> 16:23.440]  We try to build a body of evidence that can be used to convince a neutral third party, judge and jury, of the perpetrator's guilt.
[16:23.840 --> 16:25.860]  And then punish the perpetrator.
[16:26.020 --> 16:30.420]  And then we kind of assume there's some back channel which will prevent further crime.
[16:31.940 --> 16:42.480]  So given that, it makes a lot of sense when we build these commerce systems to put in very strong audit capability to be able to detect crime and to build a body of evidence.
[16:45.160 --> 16:56.460]  I know there are commerce systems where they can figure out who did the fraud, but they can't bring the evidence into a public courtroom because by doing so they'll compromise further security.
[16:56.720 --> 16:57.760]  I mean that's not very good.
[17:02.310 --> 17:03.630]  There's a new kind of fraud.
[17:03.750 --> 17:06.110]  Well it's not really new, but it's going to get a lot worse.
[17:06.430 --> 17:07.790]  Is identity theft.
[17:08.810 --> 17:16.870]  As more of this stuff goes online, as our online identity becomes more important, stealing our online identity will become more valuable.
[17:17.690 --> 17:25.950]  And you can read privacy times and get a lot of great war stories of people who have had their identity stolen, have credit cards issued in their name.
[17:26.550 --> 17:28.150]  This is going to become worse.
[17:30.770 --> 17:35.170]  We've spent a bunch of years in the fiction that mother's maiden name is good enough.
[17:35.690 --> 17:40.030]  And really that fiction is over and there's nothing good to replace it yet.
[17:48.410 --> 17:52.270]  I lump privacy violations into as a criminal attack.
[17:52.950 --> 17:54.610]  I'm not sure it belongs here.
[17:55.550 --> 17:59.650]  Very often, especially in this country, privacy violations are actually legal.
[17:59.930 --> 18:03.110]  You do not own the information about you stored in databases.
[18:04.470 --> 18:08.210]  But, you know, especially some countries in Europe are better about that.
[18:08.690 --> 18:10.270]  And laws might change.
[18:10.470 --> 18:12.190]  And there are illegal privacy violations.
[18:12.490 --> 18:13.830]  There's basically two types.
[18:14.370 --> 18:20.350]  One is a targeted attack where I want to know everything about a specific person or company.
[18:21.390 --> 18:23.050]  And I will target them.
[18:23.730 --> 18:29.170]  Now cryptography and computer security in general can protect you, but only up to the point.
[18:29.310 --> 18:32.970]  Only to the point where someone will come in and bug your room.
[18:33.610 --> 18:35.290]  Or go through your trash.
[18:35.790 --> 18:38.650]  Or do any of the non-computer based attacks.
[18:39.910 --> 18:45.850]  What cryptography can do is sort of make the attacker have to get close and personal to put himself at risk.
[18:46.070 --> 18:50.290]  He won't be able to sit at home and spy on you from the safety of his computer.
[18:51.710 --> 18:55.070]  The second kind of privacy violation is what I call data harvesting.
[18:55.970 --> 19:09.350]  And an example of that is if I want a list of every widow 60 years or older with more than $2 million in the bank who has given to more than a dozen charities in the past year and regularly reads her horoscope.
[19:10.050 --> 19:12.330]  That is a database I want for whatever reason.
[19:13.390 --> 19:16.430]  And there are many attacks that are based on data harvesting.
[19:18.310 --> 19:20.690]  In the movie Paper Moon is a good example.
[19:20.810 --> 19:31.530]  A depression attack attack where someone would go to the obituary column, find the names of wealthy people who died and then try to sell their widow stuff that he supposedly bought while he was alive.
[19:32.590 --> 19:44.730]  There have been attacks I think as recently as the Vietnam War where con artists will go to the families of servicemen who died overseas and charge them money supposedly to attend their graves.
[19:45.010 --> 19:46.750]  These are data harvesting attacks.
[19:47.010 --> 19:51.550]  We are looking for people that meet a certain criteria so we can try to defraud them.
[19:52.670 --> 20:01.750]  Now cryptography is actually really good against protecting against that because we can hide all of the data and make it impossible for the attacker to sift through it all.
[20:02.590 --> 20:09.030]  So you can't get a list of everybody who takes AZT in this country because that data isn't available and encrypted.
[20:09.390 --> 20:15.650]  Now of course there are still the human attacks bribing an operator who has legal access to the data.
[20:21.130 --> 20:26.250]  The second kind of attack and this is fundamentally different than a criminal attack.
[20:26.430 --> 20:27.710]  It is what I call a publicity attack.
[20:27.970 --> 20:32.010]  And the goal is how can I get the most publicity by attacking this system.
[20:32.110 --> 20:33.890]  I want my name in the New York Times.
[20:34.130 --> 20:35.530]  What do I have to do to get it?
[20:36.810 --> 20:38.890]  And this is kind of neat.
[20:41.250 --> 20:43.730]  Because a lot of companies aren't ready for this.
[20:44.670 --> 20:52.470]  The good example is the Netscape bug found by the University of California Berkeley grad students.
[20:52.990 --> 21:01.090]  Netscape did the analysis and figured out it wasn't profitable for anybody to break it because it would take so much computer time.
[21:01.930 --> 21:05.610]  The Berkeley grad students had the computers lying around in their labs.
[21:05.750 --> 21:06.570]  They just weren't using them.
[21:06.730 --> 21:08.790]  They didn't have to actually go out and buy them.
[21:09.990 --> 21:12.370]  So attackers are typically very skilled.
[21:12.610 --> 21:16.870]  They have access to significant resources either at the university or at their company.
[21:17.950 --> 21:19.750]  Usually they have no social lives.
[21:19.910 --> 21:20.970]  They have large amounts of time.
[21:21.570 --> 21:23.130]  They don't have a lot of money.
[21:26.040 --> 21:27.960]  And they have low risk tolerance.
[21:28.220 --> 21:29.460]  They usually don't want to go to jail.
[21:32.240 --> 21:36.620]  This attack is very important especially in eroding public confidence.
[21:37.080 --> 21:42.360]  Banks are very careful not to talk about successful attacks.
[21:42.860 --> 21:44.760]  They don't want public confidence eroded.
[21:45.640 --> 21:50.680]  Even more than the money lost, the value lost of people not trusting their systems is greater.
[21:51.720 --> 22:04.420]  So when there are, you know, when you see month after month new bugs coming out through the Netscape or Microsoft Internet Explorer, people are trusting the security less and less.
[22:05.080 --> 22:06.360]  This is probably a good thing.
[22:06.460 --> 22:07.440]  The security kind of sucks.
[22:07.740 --> 22:10.460]  But for a company, this is a big problem.
[22:18.280 --> 22:20.720]  The third sort of attack is the legal attack.
[22:20.940 --> 22:22.940]  And this is kind of like a publicity attack with a budget.
[22:24.000 --> 22:31.060]  And the question is, how can I discredit this system to get my client off?
[22:34.260 --> 22:41.020]  Someone is being accused of fraud or a crime and there is some evidence from this computer security system.
[22:41.640 --> 22:51.280]  And one of you guys is hired as an expert witness by the defense to insult the system in front of the jury.
[22:51.720 --> 22:54.140]  Now it's kind of neat because you don't have to actually find a flaw.
[22:54.800 --> 22:57.700]  You don't have to actually demonstrate a successful attack.
[22:58.160 --> 23:02.920]  All you need to do is diss the system enough that the jury doesn't believe it anymore.
[23:04.140 --> 23:05.320]  Which is a lot easier.
[23:06.280 --> 23:10.580]  And in cases that might be, you know, multi-million dollar settlements.
[23:11.020 --> 23:13.300]  Some of the industrial espionage cases we are seeing.
[23:13.520 --> 23:15.200]  This could be a really big deal.
[23:15.940 --> 23:17.500]  You have the benefit of discovery.
[23:17.940 --> 23:20.700]  You want the system specs.
[23:21.220 --> 23:23.180]  You know, have the attorney demand them from the other side.
[23:26.560 --> 23:29.200]  So you will be able to get all the details you need.
[23:30.240 --> 23:35.080]  The NSA wrestled with this when they were prosecuting John Walker.
[23:35.360 --> 23:40.600]  The question was whether they should openly discuss their cryptography boxes.
[23:40.860 --> 23:45.500]  How they worked, what they did, what Walker actually did by compromising the keys.
[23:45.800 --> 23:50.540]  Whether they should discuss this in a public forum or whether they should keep quiet about it.
[23:50.760 --> 23:57.720]  They eventually decided that disclosing information was worth the good PR of putting Walker in jail.
[23:58.140 --> 24:00.060]  But, you know, 20 years ago it was different.
[24:00.340 --> 24:05.260]  When there were successful attacks against NSA equipment, it was all hushed up.
[24:05.740 --> 24:21.980]  When Chicago Tribune published information about the Battle of Midway that strongly implied that we broke the Japanese codes, the government was really pissed at the newspaper and indicted them under the Espionage Act.
[24:22.200 --> 24:28.860]  And eventually decided not to prosecute because the damage from prosecution, from a public prosecution, would have been even worse.
[24:49.270 --> 24:57.990]  So, the job for an attacker is actually a lot easier than a job for a defender.
[24:58.310 --> 25:00.930]  They are allowed to do a lot of things that defenders can't.
[25:01.010 --> 25:02.330]  They are allowed to cheat.
[25:02.750 --> 25:05.090]  They are allowed to invent new mathematics.
[25:05.510 --> 25:09.050]  They are allowed to invent new science to attack the system.
[25:09.250 --> 25:12.530]  They are allowed to wait a few generations for technology to catch up.
[25:14.790 --> 25:20.750]  They only have to find one way in, whereas the defender has to defend against every possible attack.
[25:21.590 --> 25:24.250]  They don't actually have to follow the defender's threat model.
[25:26.610 --> 25:34.810]  If you read about the hacks against the Japanese pachinko machines, there was a smart card they used for stored value in pachinko machines.
[25:35.370 --> 25:40.630]  And Japanese organized crime made about a few hundred million dollars breaking them.
[25:41.070 --> 25:43.770]  As it turns out, the system was done by Mitsubishi.
[25:44.310 --> 25:52.050]  And Mitsubishi falsely assumed that the pachinko parlors were on their side.
[25:52.250 --> 25:56.210]  When in fact some of them were in the employ of organized crime.
[25:57.010 --> 26:05.870]  And if you look at how the system was broken, that mistake in the trust model was one of the key problems with the system.
[26:08.230 --> 26:09.310]  So that's a threat.
[26:09.510 --> 26:10.770]  So what can we do about it?
[26:14.250 --> 26:15.930]  I don't have to go through any of this.
[26:16.250 --> 26:17.890]  We all know what cryptography can do.
[26:18.070 --> 26:22.430]  We have encryption, hash functions, public key, digital signature schemes.
[26:23.230 --> 26:26.610]  We can use it to do all these cool things.
[26:27.070 --> 26:31.970]  Privacy, commerce, authentication, nonrepudiation, email security.
[26:37.000 --> 26:39.580]  But none of them really work.
[26:42.880 --> 26:48.600]  The ideal is DES is used to protect our passwords.
[26:48.840 --> 26:51.360]  The reality is what you see from Microsoft.
[26:51.760 --> 26:53.580]  The LANMAN hash and their NT hash.
[26:53.860 --> 26:59.820]  The realities of the system work against applying cryptography properly.
[27:00.160 --> 27:02.160]  We have to have backwards compatibility.
[27:02.900 --> 27:07.320]  A security patch is antithetical to backwards compatibility.
[27:08.120 --> 27:12.420]  And there are many systems that are vulnerable to what we call a version rollback attack.
[27:12.700 --> 27:17.220]  You convince the system to use an older, more insecure version of the protocol.
[27:19.780 --> 27:22.100]  It's something you worry about against SSL.
[27:22.700 --> 27:24.620]  SSL 2 versus SSL 3.
[27:25.940 --> 27:31.600]  Implementation of these cryptography tools is a lot harder than dropping them into the product.
[27:32.400 --> 27:37.120]  And you often see mistakes that are added elsewhere in the system.
[27:37.680 --> 27:42.000]  I mean I've seen encryption products broken by the user interface.
[27:42.540 --> 27:46.380]  Where the cryptography was good but the user interface added flaws.
[27:47.220 --> 27:49.780]  Now you know the programmers weren't talking to each other.
[27:51.020 --> 27:55.100]  Because really in no other discipline do they have to.
[27:55.560 --> 27:58.320]  This part works, that part works, then the sum works.
[27:59.120 --> 28:06.340]  Only in security can you have this part working and that part working but putting the two of them together can break the security.
[28:09.750 --> 28:11.510]  There's a lot of good crypto.
[28:11.730 --> 28:13.890]  We really have all the tools we need.
[28:14.210 --> 28:17.110]  We just really have no idea how to use them properly.
[28:18.410 --> 28:28.710]  I mean I've often said that if you give me any set of security criteria I can design a product that is both meets this criteria and is insecure.
[28:29.090 --> 28:32.590]  I can do it on purpose and it's real easy to do by accident.
[28:36.400 --> 28:40.880]  So here's my list of sort of the other non-cryptographic parts of the solution.
[28:41.500 --> 28:43.480]  The first one is trust management.
[28:43.700 --> 28:45.460]  This is a really big deal.
[28:45.760 --> 28:48.560]  And it's a lot more complicated than certificates.
[28:49.140 --> 29:01.860]  And what trust management is, is basically fundamentally figuring out what your trust structure is that you're trying to mimic on computers and actually doing it properly without adding any other trust problems.
[29:03.260 --> 29:06.100]  And trust is a very complex social phenomenon.
[29:07.020 --> 29:07.660]  Right?
[29:07.800 --> 29:14.360]  If you trust somebody to let them give you a lift in their car or you know lend them ten dollars.
[29:14.920 --> 29:16.540]  Or go into business with them.
[29:17.080 --> 29:19.120]  Or let them babysit your children.
[29:19.800 --> 29:22.540]  These are very different definitions of trust.
[29:23.340 --> 29:27.940]  And right now the systems aren't rich enough to encompass them all.
[29:28.260 --> 29:30.660]  We have one certificate we use for everything.
[29:31.000 --> 29:32.260]  That makes no sense.
[29:32.380 --> 29:34.420]  You open up your wallet, you have many certificates.
[29:34.820 --> 29:38.480]  You have driver's licenses, library cards, and credit cards.
[29:38.860 --> 29:39.200]  Right?
[29:39.220 --> 29:42.600]  There's a real reason why Visa doesn't accept your driver's license.
[29:43.060 --> 29:45.220]  Even though in reality they could.
[29:45.920 --> 29:49.740]  There's no technological reason why they can't.
[29:49.840 --> 29:58.580]  But there are very strong social reasons why Visa or the bank must issue you the certificate that's being used to access their money.
[30:00.200 --> 30:02.520]  And the net has to accomplish this richness.
[30:04.880 --> 30:07.520]  We need a lot more work in access control.
[30:09.340 --> 30:13.640]  Sort of, there's a big difference between authentication and authorization.
[30:14.440 --> 30:14.960]  Right?
[30:15.000 --> 30:20.300]  If I get a PGP encrypted email message and it says, you know, this is a purchase order for a thousand dollars.
[30:20.680 --> 30:26.020]  And I validate the key and I validate the certificate and yes, it's correct.
[30:26.580 --> 30:27.440]  So what?
[30:27.520 --> 30:30.420]  That doesn't tell me anything about whether I should accept the purchase order.
[30:31.780 --> 30:36.340]  So there's a lot more richness in there that really hasn't been discussed yet.
[30:41.090 --> 30:44.710]  The whole notion of dealing with the human computer problem.
[30:46.470 --> 30:51.030]  I used to say I could do, you know, if you get it to me in bits, I can secure it.
[30:51.150 --> 30:51.590]  That's easy.
[30:52.090 --> 30:55.070]  It's very hard to move from people to bits.
[30:55.550 --> 30:57.370]  That's the whole problem with passwords.
[30:57.870 --> 30:59.590]  Passwords have to be remembered by people.
[30:59.890 --> 31:02.570]  So they're often lousy when they turn into bits.
[31:05.790 --> 31:12.450]  So it's very hard to move between a person and the computer.
[31:13.450 --> 31:13.930]  Right?
[31:14.110 --> 31:18.050]  When I digitally, when I physically sign something, I take my pen and write it on a piece of paper.
[31:18.290 --> 31:22.370]  When I digitally sign something, I type PGP-S file name.
[31:22.950 --> 31:23.430]  Right?
[31:23.450 --> 31:30.190]  I need to be able to convince a jury that when you typed PGP-S file name, that you knew what you were doing.
[31:30.390 --> 31:32.110]  That you actually were signing the document.
[31:32.970 --> 31:35.550]  And that's a very hard conceptual leap.
[31:37.570 --> 31:41.410]  This is separate from the whole human computer interaction problem.
[31:41.690 --> 31:45.130]  Of making the security work with people.
[31:45.630 --> 31:45.950]  Right?
[31:46.510 --> 31:48.190]  People don't want to see security.
[31:48.310 --> 31:50.230]  So it tends to be pushed down in the IP stack.
[31:50.710 --> 31:56.730]  We as security professionals try to push it up because it's more secure the closer it gets to the user.
[31:57.530 --> 32:02.190]  But if we push it up, we expect our users to make real security decisions.
[32:02.590 --> 32:13.230]  So you're expecting your user, when he's browsing the web, and he pulls up a screen that says, a website that says click here for the dancing pigs.
[32:13.510 --> 32:20.230]  And he clicks and a warning comes up and says, you know, this is a dangerous Java app and it might trash your system.
[32:20.490 --> 32:24.410]  The user is going to pick dancing pigs over security every time.
[32:24.770 --> 32:26.910]  He's not going to notice the security problem.
[32:27.710 --> 32:30.510]  Users can't make intelligent security decisions.
[32:31.010 --> 32:32.570]  And yet we expect them to.
[32:39.710 --> 32:42.330]  Then we have the whole notion of secure perimeters.
[32:42.670 --> 32:43.130]  Right?
[32:43.350 --> 32:44.850]  Tamper proof smart cards.
[32:46.050 --> 32:47.970]  Computers behind locked rooms.
[32:49.650 --> 32:55.050]  As a cryptographer, a lot of my problems are made easier if I can assume tamper proof hardware.
[32:55.770 --> 32:57.930]  It's a really good crutch.
[32:58.570 --> 33:05.850]  And everything I've learned about tamper resistance, you speak to anybody who works in, you know, talk to people who work at Sandia.
[33:06.150 --> 33:08.030]  They do have a big tamper resistance lab.
[33:08.210 --> 33:09.430]  It's basically impossible.
[33:09.610 --> 33:10.450]  It just doesn't work.
[33:10.530 --> 33:11.310]  You can't have it.
[33:12.810 --> 33:19.050]  And we're building a lot of systems that are assuming tamper resistance, that assume a secure perimeter.
[33:20.370 --> 33:23.410]  And it's my, you know, this last sentence is really my belief.
[33:23.590 --> 33:35.430]  Any system where the device is owned by one person and the secrets within the device are owned by somebody else is fundamentally flawed.
[33:36.510 --> 33:37.150]  Right?
[33:37.350 --> 33:39.650]  Systems based on that assumption just can't work.
[33:47.110 --> 33:52.530]  There's the whole key escrow government access to your key problem.
[33:52.530 --> 33:54.670]  This is actually a very hard problem.
[33:54.830 --> 33:54.850]  Right?
[33:55.030 --> 33:56.670]  It's very easy to do key backup.
[33:56.990 --> 34:00.270]  I can design a system that has key backup or really data recovery.
[34:00.830 --> 34:05.670]  Because I'm designing a system with a feature that the user likes.
[34:05.830 --> 34:05.910]  Right?
[34:05.930 --> 34:07.130]  The user is on my side.
[34:07.910 --> 34:16.950]  If I'm trying to design a government access to key system, I have to design a system that even works in the face of a hostile user.
[34:17.250 --> 34:19.130]  And that's a lot harder to do.
[34:20.490 --> 34:24.570]  And really, with the way computers are set up now, it's, it's pretty much impossible to do.
[34:29.590 --> 34:32.750]  The, the most powerful security tool we have is relationships.
[34:33.450 --> 34:39.910]  I mean, you can look at a lot of systems out there that are really pretty mediocre and survive because they're based on relationships.
[34:40.650 --> 34:42.690]  Now, credit cards are a great example.
[34:45.810 --> 34:48.710]  It's, you know, there are a lot of ways to attack credit cards.
[34:49.030 --> 34:53.310]  But credit card companies rely on the fact that they've got your name and address.
[34:53.590 --> 34:54.510]  They know who you are.
[34:55.410 --> 34:59.110]  If you call up and you dispute a transaction, they'll say, yeah, don't worry about it.
[34:59.830 --> 35:00.970]  We'll take it off your bill.
[35:01.470 --> 35:04.890]  You do that four times, five times, they'll kick you out of the system.
[35:05.010 --> 35:06.150]  We don't want your business.
[35:07.750 --> 35:14.490]  So, you know, for them it is cheaper to rely on the relationship than it is to investigate whatever the fraud is in a lot of cases.
[35:17.050 --> 35:23.830]  So, the upshot about this is that I don't really believe there's much future in anonymous commerce systems.
[35:24.170 --> 35:30.670]  I think the liabilities are much greater and there's no real reason for an institution to accept those liabilities.
[35:31.350 --> 35:34.710]  Because systems based on relationships are much easier to police.
[35:38.880 --> 35:41.260]  And finally, there's the testing problem.
[35:41.620 --> 35:43.360]  And this is really a big deal.
[35:43.640 --> 35:43.720]  Right?
[35:43.920 --> 35:46.120]  Flaws in systems can be anywhere.
[35:46.600 --> 35:50.320]  They can be in the threat model, the design, the implementation, the interface.
[35:51.900 --> 35:54.120]  You could have insecure interactions.
[35:56.360 --> 35:59.480]  These flaws are very common and they're invisible.
[36:00.340 --> 36:06.000]  If I was building a word processor and I want to know if it printed, I would just test the print function.
[36:06.140 --> 36:08.260]  And if it worked, I would know it would print properly.
[36:08.920 --> 36:12.840]  If I'm building a DES encryptor, I can test it.
[36:12.900 --> 36:14.260]  It encrypts or decrypts properly.
[36:14.420 --> 36:16.780]  I have no idea whether it's secure or not.
[36:17.660 --> 36:22.020]  No amount of beta testing can uncover a security flaw.
[36:22.440 --> 36:26.020]  You need testing by, you know, like people like you guys.
[36:26.160 --> 36:27.780]  By people who know what they're doing.
[36:28.960 --> 36:29.460]  Right?
[36:29.700 --> 36:32.640]  And there's no such thing as a comprehensive security checklist.
[36:34.420 --> 36:42.500]  And often the only feedback as to whether a system is good or not is when one of you guys publishes an attack.
[36:48.650 --> 36:52.150]  So I often get systems to, you know, to examine.
[36:52.470 --> 36:56.570]  And, you know, the problem is it's really easy to test for any given weakness.
[36:58.990 --> 37:06.130]  It's probably, well, I guess it's possible to detect, to look for all known weaknesses.
[37:06.390 --> 37:07.270]  It'll take a long time.
[37:07.550 --> 37:12.630]  It is impossible to test for every possible weakness.
[37:13.010 --> 37:15.210]  Because there are always the weaknesses you don't know about.
[37:17.550 --> 37:21.510]  Now, the neat thing, especially for commerce systems, is that they don't have to be perfect.
[37:21.870 --> 37:22.210]  Right?
[37:22.250 --> 37:26.290]  You look at credit cards, you look at checks, you look at the notary public system.
[37:26.530 --> 37:28.670]  I mean, these are moronic systems for security.
[37:28.870 --> 37:30.010]  But they're good enough.
[37:30.750 --> 37:34.530]  And often it's a matter of dealing with the liabilities.
[37:43.280 --> 37:43.920]  Right?
[37:44.080 --> 37:48.260]  A couple of slides on sort of the needs for cryptography and security.
[37:49.460 --> 37:52.060]  Most people don't need long-term security.
[37:52.580 --> 37:54.120]  Especially business data.
[37:54.900 --> 37:57.240]  Mailing lists are obsolete after a year.
[37:57.500 --> 38:02.100]  You know, negotiations are obsolete after two weeks or three weeks or a month.
[38:02.460 --> 38:04.780]  Product research is a year, two years.
[38:05.040 --> 38:08.020]  You know, even five-year plans are obsolete after six months.
[38:08.300 --> 38:14.020]  There's no real... There are very few business things that require multi-year security.
[38:14.680 --> 38:17.040]  The big examples are embarrassments.
[38:18.220 --> 38:18.740]  Right?
[38:18.880 --> 38:25.080]  Businesses would like to keep their, you know, less than legal activities quiet for a long time.
[38:25.760 --> 38:29.920]  People would like to keep their personal life quiet for a long time.
[38:38.550 --> 38:39.070]  Right?
[38:39.130 --> 38:40.710]  There are needs for strong authentication.
[38:41.590 --> 38:44.030]  Authentication needs really depend on the value of the transaction.
[38:44.310 --> 38:45.630]  What is it I'm authenticating?
[38:46.370 --> 38:55.430]  The authentication you need for a library card might be a lot less than for a card used to, you know, to check, to take cars out of a rental lot.
[38:56.550 --> 39:07.970]  The authentication needed for a stored value card that you get, you know, photocopies and Kinkos is a lot less than a stored value card that might have a couple of thousand dollars on it.
[39:08.790 --> 39:12.190]  And those are a lot less less than authentication you need to buy a house.
[39:19.280 --> 39:20.640]  Okay, a little bit about the future.
[39:24.100 --> 39:29.160]  So here are the things I think we should watch or at least root for in terms of security.
[39:29.440 --> 39:31.040]  The first one is tamper resistance.
[39:31.300 --> 39:33.820]  I would love it if we would have real tamper resistance.
[39:34.100 --> 39:35.700]  It will really make my job easier.
[39:36.200 --> 39:37.140]  So work on it.
[39:38.900 --> 39:41.080]  I'd love it if we had good biometrics.
[39:41.240 --> 39:46.020]  Right now biometrics is being touted as a solution to a lot of problems.
[39:46.280 --> 39:47.540]  It really isn't.
[39:47.860 --> 39:53.740]  Yes, a fingerprint is a good token that people carry around with them all the time.
[39:54.040 --> 39:56.120]  But it's too easy to steal.
[39:56.760 --> 40:00.040]  And once you steal it, it's impossible to update.
[40:00.580 --> 40:03.140]  So you have people walking around with ten keys.
[40:03.280 --> 40:05.120]  And if they lose them all, what happens?
[40:06.380 --> 40:14.380]  Right, you know, if you put your thumb print down in a POS terminal, you have to assume that POS terminal is not on your side.
[40:14.560 --> 40:18.300]  So you are giving out your fingerprint pretty much to anybody who asks.
[40:18.580 --> 40:19.860]  That doesn't work for security.
[40:25.090 --> 40:28.710]  Now we are starting to see some real good work in trust management.
[40:29.370 --> 40:34.150]  The SDSI, the SPKI initiatives are worth looking at.
[40:34.370 --> 40:44.770]  Dealing with how trust is given, how it's transferred, how to store trust, how to use it, how to revoke trust, which is a very hard thing to do on computers.
[40:47.770 --> 40:48.250]  Right?
[40:48.570 --> 40:50.430]  We need to watch the internet standards.
[40:51.930 --> 40:53.190]  I root for some of them.
[40:53.290 --> 40:54.250]  I don't have high hopes for others.
[40:57.550 --> 41:00.350]  I'd like to see some real good work in human computer interface.
[41:01.210 --> 41:05.210]  Ways to make computers, computer security work for people.
[41:05.770 --> 41:08.650]  To be embedded in what they do so it's easy.
[41:09.290 --> 41:13.330]  So, you know, looking at the way PGP works with Eudora now.
[41:13.490 --> 41:18.030]  It's really nice to see a good user interface where it's easy to encrypt the message.
[41:18.470 --> 41:21.870]  Where it's, you know, it's harder not to encrypt than it is to encrypt it.
[41:22.190 --> 41:23.530]  And that's when you know you've won.
[41:24.970 --> 41:27.910]  Oh, you know, keep watching the legal infrastructure.
[41:29.530 --> 41:33.090]  Fundamentally, we have to assume that the tech can't do everything.
[41:33.530 --> 41:39.870]  I think I said in applied cryptography that we need to protect ourselves not with laws but with mathematics.
[41:40.570 --> 41:42.770]  I mean, that sounds good but it's actually pretty naive.
[41:43.190 --> 41:45.410]  We can't protect ourselves with mathematics.
[41:46.110 --> 41:48.570]  Because we don't work in the world of mathematics.
[41:48.910 --> 41:53.190]  We work in the world of computers and people and interactions.
[41:53.870 --> 41:55.990]  So, the math is over here.
[41:56.330 --> 41:56.390]  Right?
[41:56.470 --> 41:57.450]  The math is perfect.
[41:57.810 --> 41:59.630]  The computers are mediocre.
[41:59.890 --> 42:01.150]  The networks are lousy.
[42:01.230 --> 42:02.310]  The people are just awful.
[42:04.130 --> 42:13.390]  So, I need a legal system to deal with the fraud and the attacks that are inevitable against any complex system.
[42:13.390 --> 42:14.350]  Right?
[42:14.430 --> 42:24.550]  I can build a copy protection system for DVD that can stop grandma from buying one copy of The Little Mermaid and making copies for all our grandchildren.
[42:24.950 --> 42:30.270]  I can't build a system that will stop the Taiwanese hackers from pirating them.
[42:31.030 --> 42:34.470]  I need a legal system to prevent, to stop those attacks.
[42:36.310 --> 42:38.150]  And, you know, we're seeing some stuff.
[42:38.370 --> 42:42.770]  We're seeing some digital signature acts which are trying to give digital signatures the force of law.
[42:43.190 --> 42:44.350]  Some of them are pretty silly.
[42:44.530 --> 42:45.370]  Some of them are better.
[42:46.450 --> 42:55.150]  If you want to know how this will shake out, it's worth reading history of the typewriter and when the typewriter was first used for contracts.
[42:55.350 --> 42:58.370]  And what a typewritten contract meant versus a handwritten contract.
[42:59.290 --> 43:02.410]  There's a good 20 years of case laws that were sorted out.
[43:02.710 --> 43:07.010]  And you're going to see similar stuff with electronic contracts and electronic signatures.
[43:08.370 --> 43:08.990]  Right?
[43:09.090 --> 43:13.170]  We need legal infrastructure to support electronic commerce or it just won't happen.
[43:14.750 --> 43:18.930]  And we need criminal statutes to prosecute digital criminals.
[43:20.770 --> 43:30.150]  Personally, I like laws that are technologically invariant because technology is just moving too quickly now for laws to catch up.
[43:30.690 --> 43:33.270]  We need to write laws that are independent of technology.
[43:35.130 --> 43:38.530]  And we also need to solve this silly government cryptography nonsense.
[43:39.050 --> 43:40.830]  I mean, it's going to go away in 10 years.
[43:40.930 --> 43:41.550]  It just has to.
[43:42.170 --> 43:46.730]  But... Yeah, the sooner it does, the better.
[43:49.210 --> 43:53.030]  All right, finally there are some cool advances in cryptography that are worth paying attention to.
[43:53.650 --> 43:55.770]  NIST is finally replacing DES.
[43:56.550 --> 44:06.430]  And they're going to put out a call for algorithms in a few months and there will be about a two year period where people submit algorithms and they will be evaluated.
[44:07.450 --> 44:10.390]  My website has information on that if people are interested in following it.
[44:10.830 --> 44:12.190]  This is likely pretty exciting.
[44:12.450 --> 44:13.110]  I mean, it's fun.
[44:14.010 --> 44:19.050]  You know, it really won't affect security much, but it's neat and we like it.
[44:21.230 --> 44:23.310]  Elliptic curve cryptography is worth following.
[44:23.810 --> 44:26.350]  I'm not a big fan of it, but a lot of people are.
[44:27.650 --> 44:29.510]  Does anybody here from CertiCom in the audience?
[44:29.670 --> 44:31.790]  Every time I say that I get a phone call from CertiCom.
[44:32.290 --> 44:33.950]  Just don't tell them I said that.
[44:35.990 --> 44:44.730]  I mean, quantum cryptography is... it's getting... it's moving out of the lunatic fringe faster than I thought.
[44:46.650 --> 44:47.130]  Right?
[44:47.250 --> 44:52.810]  British Telcom has actually done quantum key exchange over a 10 kilometer fiber optic link.
[44:53.550 --> 44:54.510]  That's kind of neat.
[44:55.210 --> 44:59.770]  And, you know, this sort of has a potential of making, you know, most of my book obsolete.
[45:01.950 --> 45:03.290]  There are some new attacks.
[45:04.310 --> 45:08.010]  It's kind of... attacking is kind of neat because we see advances in a lot of different fronts.
[45:08.210 --> 45:08.230]  Right?
[45:08.270 --> 45:11.470]  You see more computers, so distributed attacks work better.
[45:11.770 --> 45:14.570]  You see faster computers, so any attack works better.
[45:14.910 --> 45:22.290]  You see tweaking of the computation to get a factor of 2, factor of 3, factor of 5 improvement on attacks.
[45:22.570 --> 45:26.610]  And then finally you see fundamental advances of cryptanalysis.
[45:26.910 --> 45:36.130]  Now, if you watch factoring, attacks against RSA, and you see how they creep up, they take advantage of all those 4 things.
[45:37.130 --> 45:41.630]  And attacks that, you know, 10 years ago we thought would never happen are now feasible.
[45:42.870 --> 45:45.230]  And 10 years from now, who knows what will happen?
[45:46.970 --> 45:50.730]  Quantum cryptanalysis, which is actually still really on the lunatic fringe.
[45:51.090 --> 45:53.210]  And that's some of that quantum factoring stuff.
[45:53.830 --> 46:00.390]  It's sort of odd, you know, the quantum computer was invented and no one knew what to do with it.
[46:00.950 --> 46:08.490]  And the first two things to figure out what to do with the quantum computer was break RSA and then break El Gamal.
[46:09.750 --> 46:13.430]  So, you know, this is really on the lunatic fringe.
[46:13.550 --> 46:15.210]  No one has a clue how to make this work.
[46:15.210 --> 46:22.010]  But in our lifetime, it is possible that we could live in the post-public key cryptography era.
[46:23.430 --> 46:25.210]  And that requires some thought.
[46:32.030 --> 46:33.430]  So a couple of conclusions.
[46:34.150 --> 46:39.030]  The problem with bad cryptography is that it looks exactly the same as good cryptography.
[46:39.730 --> 46:44.030]  Both a bad product and a good product will say, we use triple des.
[46:45.290 --> 46:48.330]  And there's really no way for most people to tell the difference.
[46:51.050 --> 46:54.470]  Unfortunately, successful attacks are often kept secret.
[46:54.790 --> 46:56.970]  And this is really bad.
[46:57.130 --> 47:07.950]  If you wanted to design an aircraft, you could walk into the FAA offices and read about every airline accident from the mid-30s until today.
[47:08.190 --> 47:11.450]  And you could learn from all of the mistakes everybody else made.
[47:12.610 --> 47:15.050]  You can't do that with computer security.
[47:15.310 --> 47:18.530]  When there's an attack, it's often kept secret.
[47:18.850 --> 47:25.190]  If like the Russian attack against Citibank, it's made public, we don't get any details.
[47:25.550 --> 47:32.110]  We don't know how the attackers broke in, what they did, what the mistakes were, how we can make our systems better for next time.
[47:34.730 --> 47:36.270]  Attackers need to publicize.
[47:36.570 --> 47:40.790]  So, I like it when people publicize because we all can learn from it.
[47:41.830 --> 47:46.330]  And more importantly, we need to be proactive in designing systems.
[47:46.590 --> 47:55.390]  We need to understand the real threats, design systems with crypto built in from the beginning, build systems that scale to reasonable levels.
[47:56.810 --> 48:04.090]  We don't need perfect solutions, but we need solutions where the disaster conditions aren't exponential.
[48:04.430 --> 48:04.970]  Right?
[48:05.110 --> 48:08.690]  I don't care if one person can break a system.
[48:08.890 --> 48:13.350]  But if they can post on the net how everybody can break a system, that's bad.
[48:16.560 --> 48:17.160]  Right?
[48:17.220 --> 48:18.820]  It's prudent to prepare for the worst.
[48:19.140 --> 48:23.400]  You build a system today and it's successful, you're stuck with it for 20 years.
[48:23.560 --> 48:25.280]  We're still stuck with LANMAN.
[48:26.680 --> 48:31.860]  There's no excuse for that kind of bad security to be around for so long.
[48:32.580 --> 48:36.360]  But, you know, cellular phones, we're still stuck with them.
[48:36.560 --> 48:41.080]  All the mistakes in digital cellular, we'll be stuck with them for another 20 years.
[48:43.120 --> 48:48.080]  And sort of finally, the social problems are a lot harder than the mathematics.
[48:48.720 --> 48:50.780]  The mathematics I can solve.
[48:51.080 --> 48:54.500]  The social engineering problems I really can't.
[48:55.300 --> 49:04.900]  And as a final quote, this quote is either Robert Morris or it's Roger Needham.
[49:04.980 --> 49:06.500]  They both seem to attribute it to each other.
[49:07.300 --> 49:13.920]  And it's if you think cryptography can solve your problem, then you don't understand your problem and you don't understand cryptography.
[49:15.080 --> 49:16.400]  And I'll take questions.
[49:29.000 --> 49:31.480]  Yeah, I just wanted to find... Oh, let me put this up again.
[49:31.900 --> 49:35.100]  There's the email address if you want copies of the slides.
[49:35.340 --> 49:37.600]  And website for just more generic information.
[49:38.120 --> 49:42.800]  You referred to something called quantum cryptography a few times.
[49:43.240 --> 49:44.540]  What exactly is it?
[49:44.900 --> 49:47.040]  I'll give a couple of sentences on quantum cryptography.
[49:47.400 --> 49:55.040]  Basically, quantum mechanics is kind of neat because I can tell physically if somebody tampers with my communication channel.
[49:56.260 --> 50:03.640]  One of the fundamental precepts of quantum mechanics is if you observe a particle, you disturb it.
[50:03.940 --> 50:13.120]  So I'm going to use that property to send a bit stream of a key and I know if it's been disturbed that someone's been eavesdropping.
[50:13.520 --> 50:19.900]  So I leverage the fact that quantum mechanics can tell me absolutely if there's been an eavesdropper.
[50:20.280 --> 50:24.880]  And there are a lot of protocols that leverage that into key generation.
[50:30.100 --> 50:31.520]  The question is what's neat about it.
[50:31.620 --> 50:36.080]  What's neat about it is unlike any other system, it's not based on any mathematical assumptions.
[50:37.340 --> 50:38.940]  What's so offbeat about it?
[50:39.160 --> 50:40.440]  It's really kind of weird.
[50:43.260 --> 50:44.840]  Somebody can actually use it.
[50:44.980 --> 50:47.460]  It still requires lasers and a lot of equipment.
[50:47.680 --> 50:50.320]  It's not going to be fielded in your PC any time soon.
[50:51.200 --> 50:53.840]  So it's very much a laboratory technology.
[50:54.080 --> 50:55.420]  It's not even close to being fielded.
[51:00.230 --> 51:22.250]  I have a question regarding, well first just I wanted to state that I'm really amazed by the fact that I guess maybe even two years ago you couldn't find applied cryptography in a bookstore anywhere and now it's all a great thing for the people who are trying to learn and a great thing for the people who want to protect themselves.
[51:22.550 --> 51:31.510]  And after having read it I want to say that I think publishing of that book is a great boon for anybody who's concerned with security.
[51:32.110 --> 51:37.770]  And the fascillation of being able to get it is an amazing thing.
[51:38.330 --> 51:41.990]  My question is I am led to understand.
[51:42.150 --> 51:43.730]  It's not a word but I made it up.
[51:44.710 --> 52:17.930]  I'm led to understand by some of my mathematician friends of which I have quite a few that about six months ago somebody came up with a an approximate solution to TSP in log n time and it was it was it's an approximation but the apparently the point is that they tried to implement it and he was such a bad writer and it's such a badly written paper and such a complicated theory that nobody was able
[52:17.930 --> 52:19.330]  to really We extract anything from it.
[52:19.550 --> 52:23.690]  But I'm not sure if you're familiar with that development.
[52:23.850 --> 52:36.970]  And if you are or if you're not, do you feel that that kind of solution would have an impact on, say, zero-knowledge proofs and various other protocols that you describe in your book?
[52:37.070 --> 52:37.590]  It's interesting.
[52:37.750 --> 52:39.090]  I'm not familiar with the work.
[52:40.410 --> 52:42.670]  It could have a serious effect.
[52:43.650 --> 52:51.070]  Sort of one of the odd things you learn when you start doing cryptography is that things affect your security from weird angles.
[52:52.150 --> 52:56.130]  So stuff that doesn't seem like it's important ends up being important.
[52:56.430 --> 52:58.770]  Stuff that looks really important ends up not.
[52:59.710 --> 53:01.570]  I'd be interested in seeing the work.
[53:02.630 --> 53:06.510]  And the answer to these questions is always maybe.
[53:06.810 --> 53:08.230]  Or at least it depends.
[53:11.540 --> 53:16.900]  Is it true that Utah passed a law that makes PGP signatures legally binding?
[53:17.840 --> 53:18.860]  Who did?
[53:19.100 --> 53:19.640]  Utah.
[53:19.840 --> 53:20.120]  No.
[53:20.600 --> 53:26.920]  Utah is one of the probably about 13 states that have passed something called Digital Signature Act.
[53:27.180 --> 53:31.840]  Which is an attempt to give digital signatures some legal standing.
[53:32.640 --> 53:34.320]  PGP is actually not mentioned.
[53:34.320 --> 53:38.140]  And in fact, X-509 is mentioned in the Utah statue.
[53:38.420 --> 53:48.780]  Most of the other statues are following the guidelines by, I think it's the ABA.
[53:49.600 --> 53:52.660]  And they're trying to be technologically neutral.
[53:54.160 --> 53:55.980]  Right now, no.
[53:56.960 --> 53:59.720]  Just normal digital signatures are not legally binding.
[53:59.720 --> 54:03.120]  But there are protocols you can go through to make them legally binding.
[54:03.640 --> 54:14.580]  So if you're a company that wants to accept digital purchase orders, you and your customers would go through a paper protocol that would say, look, we agree that we're going to use these digital signatures.
[54:17.220 --> 54:18.900]  This is all in flux.
[54:19.420 --> 54:25.440]  And I'll assume that in the next five years we'll be seeing a lot more digital signatures in real courtrooms.
[54:26.760 --> 54:27.560]  Yes, Bruce.
[54:27.760 --> 54:30.820]  I've been dying to know your opinion of PGP 5.0.
[54:30.980 --> 54:33.820]  In particular, any significant weaknesses in the Elgamal or DSS?
[54:33.820 --> 54:36.040]  The question is about PGP 5.0.
[54:36.160 --> 54:39.060]  And luckily I can duck it by saying I don't have one yet.
[54:39.780 --> 54:40.280]  Okay.
[54:40.280 --> 54:41.580]  More generically then.
[54:41.780 --> 54:47.200]  In the real world, is the Diffie-Hellman Elgamal key more secure than an old RSA key?
[54:48.600 --> 54:52.600]  Now, to a first approximation, all the public key algorithms are basically the same.
[54:52.600 --> 54:55.100]  It's a question of what key links are equivalent.
[54:55.720 --> 54:58.240]  Diffie-Hellman Elgamal is really the same as RSA.
[54:58.640 --> 55:00.320]  One is not more secure than the other.
[55:00.720 --> 55:06.320]  Remember, if you're going to break a product that uses Diffie-Hellman or RSA or anything, that you're not going to break the math.
[55:06.980 --> 55:10.180]  You know, if you want to attack PGP, you're going to attack the trust model.
[55:10.900 --> 55:11.280]  Right?
[55:11.360 --> 55:14.120]  There's a PGP key out there with my name on it.
[55:14.380 --> 55:15.240]  It's not mine.
[55:15.460 --> 55:17.800]  I get messages encrypted in it all the time.
[55:18.140 --> 55:20.500]  I can't seem to get it off the servers.
[55:20.820 --> 55:22.380]  You revoke it, it comes back.
[55:22.740 --> 55:23.220]  Right?
[55:23.280 --> 55:28.060]  You want to attack somebody, make a new PGP key, put it in their name, post it on the servers.
[55:28.260 --> 55:29.620]  You'll get their secret mail.
[55:29.900 --> 55:30.380]  Right?
[55:31.420 --> 55:33.220]  You're not going to attack the mathematics.
[55:33.420 --> 55:34.400]  The mathematics is fine.
[55:34.860 --> 55:36.540]  You're going to attack the trust model.
[55:37.000 --> 55:41.200]  You'll make a bogus copy of PGP and get it on someone else's computer.
[55:41.640 --> 55:44.600]  Nobody checks to make sure that the build is correct.
[55:44.940 --> 55:47.760]  You go to the servers, you can put a Trojan horse in PGP.
[55:48.560 --> 55:51.980]  Those, all of those attacks have nothing to do with PGP.
[55:52.320 --> 55:58.280]  PGP could be perfect, but it's only perfect in that very narrow area of encrypting the email.
[55:59.700 --> 56:03.040]  And you want to attack a system like that, attack it on the fringes.
[56:03.580 --> 56:06.760]  But haven't two out of the three legs of RSA been broken already?
[56:07.120 --> 56:07.780]  Haven't I what?
[56:08.040 --> 56:10.640]  Two out of the three legs of RSA been broken already?
[56:10.940 --> 56:12.100]  What are the legs of RSA?
[56:12.420 --> 56:17.460]  I was told by the PGP person I spoke to that there are three phases to RSA.
[56:17.460 --> 56:17.860]  No, no.
[56:17.940 --> 56:19.900]  PGP is a company now, so they do propaganda too.
[56:20.940 --> 56:22.160]  Pretty good propaganda.
[56:30.480 --> 56:33.860]  Okay, this has something to do with what he just said.
[56:34.240 --> 56:40.980]  I know that certain key lengths of the RSA algorithm have been cracked.
[56:41.220 --> 56:52.380]  What is the current state of the security of PGP assuming that the complete trust model is... I think PGP is up to like 2,000 bit keys.
[56:52.500 --> 56:54.180]  I mean, 4,000?
[56:54.400 --> 56:54.460]  See?
[56:54.740 --> 56:54.860]  Yeah.
[56:55.300 --> 56:58.680]  I mean, they're breaking in the 300 and change digits now.
[56:59.080 --> 57:01.660]  And probably 512 will be the next one to... sorry, bits.
[57:02.000 --> 57:03.580]  And 512 will be the next one to fall.
[57:03.900 --> 57:07.160]  So mathematically it's... Mathematically PGP is fine.
[57:07.800 --> 57:09.580]  Nobody will break the PGP mathematics.
[57:10.160 --> 57:10.720]  Probably.
[57:11.280 --> 57:14.460]  I mean, you'll attack something else.
[57:14.760 --> 57:16.100]  Is the code perfect?
[57:16.280 --> 57:16.920]  I don't know.
[57:17.160 --> 57:18.700]  It's been looked at by a lot of people.
[57:19.280 --> 57:19.380]  Right?
[57:19.520 --> 57:23.420]  Public code is almost by definition safer than private code.
[57:23.580 --> 57:24.920]  More people get to look at it.
[57:25.660 --> 57:27.180]  PGP has been a big target.
[57:27.520 --> 57:30.760]  A lot of hackers, a lot of crypto people have studied it.
[57:31.220 --> 57:36.040]  So you have a better sense of relief that they haven't found anything.
[57:37.580 --> 57:37.980]  No.
[57:38.340 --> 57:39.820]  I mean, I wouldn't worry about the math.
[57:40.040 --> 57:42.520]  People who look at key lengths are really missing the point.
[57:43.140 --> 57:49.420]  I get very frustrated at companies that talk to me about key length, like that's the only measure of security.
[57:49.880 --> 57:56.060]  I mean, key length is used because it's easy to measure, it's easy to quote, it looks good in a press release, it looks good in a news article.
[57:57.020 --> 58:01.940]  Key length is, you know, key length is how good the lock on your front door is.
[58:02.240 --> 58:02.340]  Right?
[58:02.580 --> 58:03.960]  I don't know if you know how your front door lock works.
[58:04.060 --> 58:06.560]  There are 5 pins and each pin has 10 positions.
[58:07.200 --> 58:10.160]  So you have a key length of 10,000.
[58:10.880 --> 58:14.200]  And if someone went to you and said, okay, here's a better front door lock.
[58:14.300 --> 58:16.340]  It has 7 pins with 12 positions each.
[58:16.840 --> 58:20.080]  You can install it, but it doesn't make you any more secure.
[58:20.600 --> 58:22.460]  There's nothing about your windows.
[58:22.760 --> 58:24.940]  There's nothing about, you know, kicking down your door.
[58:25.600 --> 58:35.500]  There are a bunch of art thieves in California that would, uh, would take a chainsaw and cut through their, uh, their target's wall to get into the house.
[58:35.780 --> 58:36.000]  Right?
[58:36.020 --> 58:39.060]  That's a beautiful attack that just ignores the threat model.
[58:39.260 --> 58:41.340]  Not even an alarm system noticed that.
[58:42.480 --> 58:43.000]  Right?
[58:43.440 --> 58:48.360]  Brute forcing the key is, is, is not the attack people are going to do.
[58:51.100 --> 58:54.680]  I think I'll take these 2 questions and then get off the stage since it's probably about time.
[58:57.680 --> 59:13.300]  Uh, my question is, with the recent brute force of DES, do you think that DES is, you know, the useable, the usable lifetime of DES is over or do you think there's some space for session crypto or, you know, other kind of short life technologies?
[59:13.640 --> 59:17.200]  Again, you know, you can't, you can't look just at the key length.
[59:17.400 --> 59:20.140]  For some applications, DES was never secure.
[59:20.860 --> 59:24.540]  For some applications, the usable lifetime of DES was over five years ago.
[59:24.800 --> 59:30.240]  If I'm going to change my key every, uh, packet, DES is probably good enough.
[59:30.860 --> 59:37.080]  If I don't have the very high value stuff I'm securing, DES is probably good enough.
[59:37.540 --> 59:37.960]  Right?
[59:38.040 --> 59:42.220]  If, if I have a smart card that's used to buy candy out of a vending machine, DES will work.
[59:43.040 --> 59:46.100]  So it, it depends on, it's not just the key length.
[59:46.240 --> 59:47.740]  It really is the application.
[59:48.060 --> 59:56.460]  What it's being used for, uh, who the attack adversaries are, what the value of the data is, how long the data has to be secure.
[59:56.760 --> 01:00:02.180]  I can take pretty much any algorithm and make it secure by using it in a certain way.
[01:00:02.800 --> 01:00:03.240]  Right?
[01:00:03.340 --> 01:00:09.520]  I can, if I change my, my DES key often enough, I can make it so you can't brute force a message.
[01:00:10.200 --> 01:00:10.660]  Right?
[01:00:10.820 --> 01:00:12.200]  I'll, I'll, you do PGP.
[01:00:12.560 --> 01:00:17.120]  You, uh, have a separate DES key for each eight bytes of the message and you do it that way.
[01:00:17.300 --> 01:00:17.900]  And that's, you're done.
[01:00:18.360 --> 01:00:19.460]  That works just fine.
[01:00:20.860 --> 01:00:27.160]  Really, you know, the nice thing about the breaking is it was a, a good public example of why DES is vulnerable that we didn't have before.
[01:00:27.920 --> 01:00:38.460]  Right, well, I guess my, uh, you know, my real question is if, if you have a, an application where you need, you know, long-term security or... I, I don't, I don't recommend DES anymore for any applications.
[01:00:39.960 --> 01:00:41.180]  I mean, there's no real reason.
[01:00:41.580 --> 01:00:48.020]  It's, it's not terribly fast, not terribly secure, not terribly efficient, either in code size or in, uh, gate count.
[01:00:54.630 --> 01:00:59.410]  What, uh, algorithm would you, would you recommend for AES?
[01:00:59.670 --> 01:01:00.130]  Idea?
[01:01:00.750 --> 01:01:03.790]  Or... No, AES is going to require a larger block size.
[01:01:04.010 --> 01:01:05.090]  There'll be a bunch of things.
[01:01:05.370 --> 01:01:07.610]  It's, it's never as simple as one algorithm.
[01:01:07.750 --> 01:01:09.750]  My hope is that AES will be a family of algorithms.
[01:01:10.950 --> 01:01:14.230]  Something I'll learn in designing things is always something has to be optimized.
[01:01:14.590 --> 01:01:16.010]  Someone wants low gate count.
[01:01:16.150 --> 01:01:17.110]  Someone wants low latency.
[01:01:17.570 --> 01:01:22.790]  Someone wants fast, uh, fast encryption, raw encryption speed and software.
[01:01:23.150 --> 01:01:26.390]  Someone has hardware and wants efficiency and hardware.
[01:01:27.150 --> 01:01:28.610]  One thing isn't enough.
[01:01:29.110 --> 01:01:30.490]  And this will be the last question.
[01:01:30.850 --> 01:01:37.770]  Given that you think the math is good enough and that emphasis should be based on trust models and user interface.
[01:01:38.190 --> 01:01:44.930]  For person to person communication, do you have a favored trust model or user interface improvement that you'd like to suggest?
[01:01:45.290 --> 01:01:48.670]  Something like a, a web of trust versus a central hierarchical trust?
[01:01:48.970 --> 01:01:51.830]  Well, actually, well, well, person to person communication is really the easiest.
[01:01:52.730 --> 01:01:54.570]  So, you know, we can do that.
[01:01:55.510 --> 01:02:04.050]  Maybe, you know, one way to look at, look at computer security is, computer security sort of perverts the natural trust model of a system.
[01:02:04.050 --> 01:02:04.550]  Right?
[01:02:04.590 --> 01:02:08.010]  The natural order of a computer is, everybody can look at everything.
[01:02:09.990 --> 01:02:12.890]  So, the more I change that, the harder it is to do.
[01:02:13.130 --> 01:02:17.090]  So, if I, to make it so one person can look at everything, that's not that hard.
[01:02:17.270 --> 01:02:18.530]  I can encrypt everything with a password.
[01:02:18.790 --> 01:02:23.370]  To make it so that the sender and the receiver can look at everything, that's a little bit harder.
[01:02:23.850 --> 01:02:27.990]  To, to segment it so that multiple people can look at their own pieces, that's a little harder.
[01:02:28.270 --> 01:02:35.170]  To make a system so that the sender and the receiver can look at something and the Government can if they have a warrant, but they can't if they don't.
[01:02:35.470 --> 01:02:39.850]  And the system works even in the face of denial of service, that's even harder.
[01:02:40.690 --> 01:02:45.450]  So when I'm looking at trust models and usability, I'm usually not looking at point to point.
[01:02:45.610 --> 01:02:46.590]  Point to point is easy.
[01:02:46.910 --> 01:02:57.070]  I'm looking at the real systems, looking at commerce systems, where there are customers and merchants and point of sale terminals and banks and clearing houses and insurance companies insuring it all.
[01:02:57.250 --> 01:03:00.290]  We have many different players, each with their own agenda.
[01:03:00.830 --> 01:03:02.210]  Those are the hard problems.
[01:03:02.770 --> 01:03:05.730]  And really, those are the systems that are going to be used.
[01:03:05.850 --> 01:03:05.890]  Right?
[01:03:06.010 --> 01:03:10.010]  Cryptography is not going to be used to prevent, protect privacy to any large degree.
[01:03:10.350 --> 01:03:13.730]  The application and authentication are much, much bigger.
[01:03:15.210 --> 01:03:16.750]  And, and thanks for listening.
[01:03:17.210 --> 01:03:19.010]  I think go eat dinner now or something.
[01:03:19.310 --> 01:03:19.670]  And...