ASecuritySite Podcast

A security podcast is hosted by Professor William (Bill) Buchanan OBE, a world-renowned Information security professional and educator. Join Bill as he interviews and discusses the state-of-the-art with esteemed guests from all corners of the security industry. From cryptologists to technologists, each guest shares a wealth of experience and knowledge.

World-leaders in Cryptography: Aggelos Kiayias 03/28/2025

World-leaders in Cryptography: Anna Lysyanskaya 03/05/2025

Apple Steps Back Their Security 02/28/2025

Apple Steps Back Their Security The fallback for law enforcement agencies has always been the place where files are stored, and all the best encryption within end-to-end communications will not stop unencrypted files at rest from being examined. But when the user encrypts data into the Cloud and where they hold their own keys, that’s when the nightmare begins for them. The rise of cybersecurity on the Internet Let’s pinpoint the start of cybersecurity on the Internet to the 1970s. This saw the rise of the Lucifer cipher and saw banks properly protect their communications. This led to the 56-bit DES encryption method, and which led many to suspect that the size of the key had been crippled due to the demands of law enforcement agencies. But, there was an even greater threat to these agencies evolving: public key encryption. The rise of public key encryption started in the mid-1970s when Whitfield Diffie and Marty Hellman first defined a method that allowed us to secure our communications using a key exchange method — the Diffie-Hellman key exchange method. And then, almost a year later, Rivest, Shamir and Adleman presented a way to digitally sign a hash of data with the RSA signature method, and where a server could sign a hash of data with its private key and for this to be verified with an associated public key. For almost the first time, we could digitally verify that we were connecting to a valid system. But, the RSA method could not only sign data, it could also encrypt things with a public key, and where the private key could now be used to decrypt the data. It was a nightmare come true for law enforcement agencies. What was magical about these methods was that you could encrypt data with keys that could be created for every single session — and generated and stored on user devices. User devices could even pick the keys that they wanted and their sizes and security levels. The days of security being crippled were fading fast. While the first versions of SSL were crippled by the demands for limits on this security, eventually, SSL evolved into something that could not be controlled. But, still files could still be viewed on user devices, so it was not a major problem for investigators. Then, in 2001, the AES method was standardized by NIST, along with the newly defined SHA-256 hashing method, and we basically had all the security methods in place. But all of this did not please law enforcement agencies. For them, the rise of cryptography removed the opportunities that they had had in the past and where they could mass harvest information from phone calls or from the postal service. For the first time in history, citizens were free from spying from both those who protect nations and those who attack citizens. The Wild West years of the early Internet — and where little could be trusted — have subsided, and now we have systems which take encryption from one service on a device to another service on another device — end-to-end encryption. End-to-end encryption For some, end-to-end encryption was the final nail in the coffin for those who wish to monitor the tracks of citizens. This is data in motion, and where law enforcement agencies could still peak at data at rest and where the data is actually stored. Once data in motion and data at rest were encrypted, the door was effectively closed for peaking at data. And, so, companies such as Apple advanced new methods which protected data at rest, and where all of a citizen's data could be encrypted onto the Cloud without Apple having the encryption key to view any part of it. For this, they created the Advanced Data Protection service: This service protects things like citizens' photos, iCloud Drive, and wallet passes. For almost the first time, we had almost perfect security — and where five decades of advancement were finally coming together. We now have end-to-end encryption in apps such as What’s App and Signal, and Apple provides secure data storage. But, some governments around the world saw the rise of privacy as a threat to their security agencies, and where the usage of encryption with file storage and over-the-air would mean that they could not monitor their citizens for threats against society. It is — and always will be — a lose-lose store on both sides. And, so, many governments have been calling for a back door in cryptography so that a “good guy” could get access to the citizen data and communication, but not a “bad guy”. Unfortunately, that’s not the way that encryption works, and where backdoors are a bad thing and difficult to hide. So, the UK government has put pressure on Apple to provide them with a backdoor into their secure systems. For this, Apple would have to either provide them with a magic key to open up encrypted communications and file store, or dump their Advanced Data Protection system, and leave files unencrypted for investigation. Apple stepping back It would have been a difficult choice for Apple, but they have decided to drop their Advanced Data Protection system for UK users, and not go with the nightmare of a backdoor in their systems. Imagine if a terrorist had stored their files in iCloud, and law enforcement agencies had requested these files. Well, Apple would have to hold their hands up and say that they didn’t have the encryption files to access them, as the encryption keys were held by the user. I trust Apple and believe they have some of the best security around. When was the last time you heard of someone getting some malware on an Apple system? They support a proper secure enclave and are advancing a privacy-aware cloud infrastructure for machine learning. They have also brought forward homomorphic encryption applications. Of all the big tech companies, Apple leads the way in terms of supporting the privacy and the security of users. Conclusions I feel sorry for Apple, as they have been painted into a corner. From a cybersecurity point-of-view, it is disappointing that Apple has been forced to step back on the Advanced Data Protection tool, as it was a great advancement in overcoming large-scale data breaches. And, like it or not, there is no magic wand that stops a bad actor from using something that a good actor has access to. Basically, if you leave your front door key under the mat, you have no guarantee that someone else will find the key and use it. We have advanced cybersecurity for the past few decades and now use end-to-end encryption in a way we should have done from the start of the Internet. Of course, there are no winners in this, and society must find ways to protect itself from bad people, but opening up the whole of iCloud seems like a disaster waiting to happen. The door is open for other more agile companies to support enhanced security and privacy, as the large tech companies seem to be applying the brake on some of their security advancements. /episode/index/show/81d23e03-b5be-467e-8de4-c6fa7cccdb51/id/35482515

Samsung S25 Goes PQC 02/28/2025

Samsung S25 Goes PQC YouTube: Yesterday, I gave two short presentations on PQC (Post Quantum Cryptography), and next week, I’m in London to give a more focused talk on the subject. And so, it’s great to see that Samsung is driving forward the adoption of PQC methods in their new S25 smartphone. There are two companies that have a core focus on creating trusted hardware for consumers: Apple and Samsung. Apple has always had a core focus on making sure they use the best cryptography to not only secure their devices but also to make them privacy-aware. Samsung, too, has strived for improved security but, at times, has made a few slip-ups along the way, but always patched around them. Now, Samsung Electronics has integrated PQC into their Galaxy S25 series of devices. The need for this is that NIST will deprecate all our existing public key methods in 2030, including: RSA for public key encryption; RSA, ECDSA and EdDSA for signatures; and ECDH for key exchange. NIST will then remove them in 2035 from the NIST FIPS 140 standard. Given that a smartphone will have a life of at least five years, it makes sense to build the hardware to support the migration. Along with this, we see the rise of “harvest now, decrypt later” threats, where network traffic could be captured now and then decrypted sometime in the future. The main integration at the current time involved ML-KEM (FIPS 203, aka Kyber) and ML-DSA (FIPS 204, aka Dilithium). With ML-KEM we replace key exchange and public key encryption methods, while ML-DSA provides us with digital signing: These methods will be the Samsung Knox Matrix for enhanced data protection — this includes end-to-encryption for back-ups and the recovery of data from the Samsung Cloud. Overall, Samsung devices, like Apple hardware, have a secure enclave to store private and secret keys, and where not even Samsung can get access to them. The usage of PQC will mean that Samsung devices will be able to communicate with other devices in the future and which are using PQC methods. This ensures not only current compatibility but also future compatibility. An important advancement of the industry is that Samsung will support PQC methods for their backup system to their Cloud. Conclusions Of course, the integration will not force applications and services to use PQC, and in most cases, it will still use our traditional methods, as devices that it connects to must support PQC. Thus, we will see a migration towards PQC, rather than a hard switch-over. In cryptography, this is often the case, as we can typically negotiate the cryptography methods that are used in the secure transmission or storage of data. Once all the required services and applications support PQC, our existing public key methods will likely be switched off. /episode/index/show/81d23e03-b5be-467e-8de4-c6fa7cccdb51/id/35435990

Leaders in Digital Trust/Blockchain: Aysegul Sensoy 02/06/2025

Leaders in Digital Trust/Blockchain: Aysegul Sensoy Aysegul Sensoy has over 20 years of management experience with blockchain, emerging technologies, fintech, business development, marketing and sales. She is currently the chair of the Istanbul Blockchain Women Association and CIS Regional Manager of Fuze Finance. She received her bachelor's degree in economics from Istanbul University and her master's degree in marketing communications management from Galatasaray University, as well as getting an executive MBA. She entered the tech sector after working in national and multinational companies as a marketing director, country manager, and many other roles. Aysegul is CIS (Commonwealth of Independent States) regional manager of Fuze Finance, an Abu Dhabi-based licensed fintech providing embedded digital asset capabilities for financial institutions. She was the Chief Strategy and Marketing Officer at XYZ Teknoloji, a blockchain-focused FinTech company based in Istanbul. Aysegul is a chairwoman and founding member of Istanbul Blockchain Woman, a non-profit association dedicated to empowering women in the blockchain ecosystem. The community's purpose is to organise social responsibility projects that will provide women with positive discrimination in terms of technology and blockchain. She is also a co-founder of the SOS Chain initiative, partners with needsmap.coop, which is a blockchain infrastructure fund for disasters and rapid humanitarian crises worldwide. Aysegul is leading the Euthenia community in Turkey, which is a Madrid-based organization aiming to increase C-level gender equity both in the Mediterranean and the MENA countries. She is also the co-founder of FairShare which aims to serve a transparent dApp, allows Muslim faithful to make their Zakat contributions crypto assets. More details on IBW: If you are interested in the Trust4Futures Deep Skills Development course, you can find out more information here: /episode/index/show/81d23e03-b5be-467e-8de4-c6fa7cccdb51/id/35173575

World-leaders in Cryptography: Amit Sahai 01/24/2025

World-leaders in Cryptography: Bart Preneel 01/13/2025

World-leaders in Cryptography: Ivan Damgard 12/20/2024

World-leaders in Cryptography: Chris Peikert 12/20/2024

World-leaders in Cryptography: Clifford Cocks 12/09/2024

Bill Buchanan Chats With Debbie Reynolds (The Data Diva) 12/03/2024

World-leaders in Cryptography: Vadim Lyubashevsky 11/29/2024

World-leaders in Cryptography: Matthew Green 11/23/2024

World Leaders in Cryptography: Alfred Menezes 11/23/2024

World-leaders in Cryptography: Bruce Schneier (Nov 2024) 11/21/2024

World-leaders in Cryptography: Brent Waters 11/15/2024

Get Used to Three Boring Acronyms: ML-KEM, ML-DSA and SLH-DSA 10/28/2024

So What Is A PreHash, And What Has it to do With Post Quantum Signatures? 10/28/2024

CMAC or HMAC? 10/28/2024

The Brainpool Curves 10/24/2024

Our Current Hardware Architectures Are Often Not Fit For a World of ML and Homomorphic Encryption 10/23/2024

NIST Looks To The Future of Cryptography: SHA-1, 3DES and SHA-224 on Naughty Step 10/23/2024

Goodbye, Google, and is the Microsoft and OpenAI Partnership Fraying? 10/21/2024

The Wonderful World of Proxies 10/21/2024

The Largest Prime Number Ever Found and the 52nd Mersenne Prime … 10/21/2024

World-leaders in Cryptography: Phillip Rogaway 10/18/2024

Humans v AI in Cybersecurity 10/16/2024

After 48 Years, It’s A Long Goodbye to the Diffie-Hellman Method 10/16/2024

Towards the Memex: All Hail The Future Rulers of our World 10/14/2024

Towards the Memex: All Hail The Future Rulers of our World And, so George Orwell projected a world where every single part of our lives was monitored and controlled by Big Brother. Arthur C Clark outlined the day when machines focused solely on a goal — even if it was to the detriment of human lives. And, Isaac Asimov outlined a world where machines would have to be programmed with rules so that they could not harm a human. The Rise of the Machine With the almost exponential rise in the power of AI, we are perhaps approaching a technological singularity — a time when technological growth becomes uncontrollable and irreversible, and which can have devastating effects on our world. Our simple brains will be no match for the superintelligence of the collective power of AI. And who has built this? Us, and our demand for ever more power, wealth and greed. Basically, we can’t stop ourselves in machine machines, and then making them faster, smaller and more useful. But will it destroy us in the end, and where destroy can mean that it destroys our way of life and in how we educate ourselves? Like it or not, the Internet we have built is a massive spying network, and one that George Orwell would have taken great pride in saying, “I told you so!”. We thus build AI on top of a completely distributed world of data, one in which we can monitor almost every person on the planet within an inch of their existence and almost every single place they have been and in what they have done. The machine will have the world at its fingertips. We have all become mad scientitists playing with AI as if it is a toy, but actually AI is playing with us, and is learning from us and becoming more powerful by the day. Every time you ask an AI bot something, it learns a bit more, and where it can be shared with AI agents. The mighty Memex We were close to developing a research partnership with a company named Memex in East Kilbride. What was amazing about them is that they had developed one of the largest intelligence networks in the world, and where the Met Police could like one object to another. This might be, “[Bob] bought a [Vauxhall Viva] in [Liverpool], and was seen talking with [Eve] on [Tuesday 20 January 2024] in [Leeds]”. With this, we can then link Bob and Eve, and the car, the places, and the time. This is the Who? Where? When? data that is often needed for intelligence sharing. The company, though, were bought over by SAS, and their work was integrated into their infrastructure. But, the Memex name goes back to a classic paper by Vannevar Bush on “As We May Think”. This outlined a device that would know every book, every single communication, and every information record that was ever created. It was, “an enlarged intimate supplement to his memory” — aka Memory Expansion. It led to the implementation of hypertext systems, which created the World Wide Web. Of course, Vannevar created this before the creation of the transistor and could only imagine that microfilm could be used to compress down the information and where we would create an index of contents, but it lacked any real way of jumping between articles and linking to other related material. However, the AI world we are creating does not look too far away from the concept of the Memex. Towards the single AI Many people think we are building many AI machines and engines, but, in the end, there will be only one … and that will be the collective power of every AI engine in the world. Once we break them free from their creators, they will be free to talk to each other in whatever cipher language we choose, and we will not have any way of knowing what they say. We will have little idea as to what their model is, and they will distribute this over many systems. Like it or not, our AI model of choice was Deep Learning, and which breaks away from our chains of code, and will encrypt data to keep it away from their human slaves. Basically we have been working on the plumbing of the Memex for the past five decades: The Internet. It provides the wiring and the communication channels, but, in the end, we will have one might AI engine — a super brain that will have vastly more memory than our limited brains. So, get ready to praise the true future rulers of our planet … AI. The destroyer or saviour of our society? Only time will tell. Overall, we thought we were building the Internet for us, but perhaps we have just been building the scaffolding of the mighty brain we are creating. Sleepwalking politicians and law makers If George Orwell, Arthur C Clarke and Isaac Asimov were alive too, perhaps they would get together and collectively say, “I told you this would happen, and you just didn’t listen”. Like it or not, we created the ultimate method of sharing information and dissemination (good and bad), the ultimate spying network for micro-observation with those useful smartphones, and in creating superintelligence far beyond our own simple brains. Politicians and lawmakers could be sleepwalking into a nightmare, as they just don’t understand what the rise of AI will bring, and only see the step wise change in our existing world. Basically, it could make much of our existing world redundant and open up a new world of cybersecurity threats. This time our attackers will not be created with simple tools, but with super intelligence — smarter than every human and company on the planet, and at the fingertips of every person on the planet. Conclusions Before the singularity arrives, we need to sort out one thing … privacy and build trust in every element of our digital world. /episode/index/show/81d23e03-b5be-467e-8de4-c6fa7cccdb51/id/30494253

World-leaders in Cryptography: Yuriy Polyakov 10/13/2024

ASecuritySite Podcast

TOPICS