(old)Puppy Linux Discussion Forum

What determines the length of the encryption key?

Edwardo wrote:What determines the length of the encryption key?

The encryption algorithm sets the maximum key length:
i.e. the maximum key length is fixed by the encryption method.

e.g. old DES has 56-bit encryption which is now crackable by brute force in days on modern computers.

Currently the industry standard is AES 256-bit , Attempting to crack it by brute force is currently "computationally infeasible" :
it would take trillions of years using state-of-the-art computers.

Each additional bit in key length doubles the number of permutations possible, and doubles the time it would take to crack by brute force.

OK. 256 bits sounds good.

If we may go back to my original question, part is still not so clear to me ...

The computer and router are inches apart. A cable connects the router to the roof antenna.
The antenna talks to the ISP several km distant. A hacker can access my router, this I know from experience.

The question is can he intercept traffic anywhere along the route between the antenna and the ISP?

Edwardo wrote: The computer and router are inches apart. A cable connects the router to the roof antenna.
The antenna talks to the ISP several km distant. A hacker can access my router, this I know from experience.

The question is can he intercept traffic anywhere along the route between the antenna and the ISP?

Wireless connection which use the mobile (cell)phone network would be particularly vulnerable to interception as you are literally broadcasting your data to everyone in a radius of about 1Km.
But if the channel is encrypted the intercepted transmission will be incomprehensible to eavesdroppers (scrambled).

Thanks. I understand the Wi-Fi encryption at my router. This is the fourth box
the ISP techs have set up as three failed in a short time.
They think I was messing with the settings so they locked me out.
The settings are now a mystery. I admit I messed one box up, but only one.

I put the question on another security forum, they asked if the ISP encrypted
the signals at their end, something I have not heard about. I will ask.

btw, I borrowed your URL code for the Custom Search Engine. Very useful.

Barkin wrote:
Wireless connection which use the mobile (cell)phone network would be particularly vulnerable to interception as you are literally broadcasting your data to everyone in a radius of about 1Km.

I do not use a cellphone connection. It is a regular Wi-Fi 801.xx.

"It is quite easy to tell however. Make another known-good copy of the USB, put them both in a known-good, isolated machine,
and make a filesystem comparison. The only files that should show differences are the ones related to the firefox configuration,
and maybe a few system logs in /var".

To compare before and after changes to the disk is there an app for this?

I appear to be leaning toward the forensic side of things. I have no idea why.. Curiosity I suppose. The need to know if such and such is happening or not.

Perhaps AIDE or Tripwire to start..

Semme wrote:Perhaps AIDE or Tripwire to start..

I need a PhD for that. We live in the instant world. Quick things. A comparison must be almost instant. Compare this face to that. True or false. Legit or not. At 186624 [mps]

Hey, I've laid you the groundwork.. the GUI's are out there..

Semme wrote:Hey, I've laid you the groundwork.. the GUI's are out there..

OK Semme, I appreciate it. This is worth putting in the time to get to know how to use the program.

I liked this explanation for how HTTPS works

1. put the "Thing" in the box, and lock it with your padlock.
2. send the locked box to the other party.
3, they put their padlock on the loop also (so that there are two locks on it), and return the double-locked box to you
4. You remove your padlock, and return the now singly-locked box to them
5. they remove their own lock and open the box.

With encryption the locks and keys are math, but the general concept is vaguely like this.

This question may seem obvious to some but I would like to be quite certain and remove any doubt. Bits and bytes travel in mysterious ways.

Say you spend the day browsing a broad range of websites exposing your system to whatever is out there. The read-write USB is plugged for the duration of the session. At the end of the session you remove the stick and do not permit the OS to save RAM to the stick.

Is there any way a snooper could write and save data to your stick during the session without your knowledge? I ask because the orange box appears about once an hour. stating 'saving RAM to savefile' Has any data been saved if the stick is removed before the black screen saving routine at shutdown?

Edwardo wrote: ... the orange box appears about once an hour. stating 'saving RAM to savefile' Has any data been saved if the stick is removed before the black screen saving routine at shutdown?

Your system , including any newly added data/software/malware, is being saved to the stick when you see that message.
On puppy it is possible to switch off those intermittent auto-backups and decide at shutdown whether to save or not ...
http://www.google.com/cse?cx=015995643981050743583%3Aabvzbibgzxo&q=kiosk&sa=Search&cof=FORID%3A0&siteurl=www.wellminded.com%2Fpuppy%2Fpupsearch.html&ref=&ss=1636j747498j5#gsc.tab=0&gsc.q=do%20not%20save%20savefile%20shutdown%20close

Barkin wrote: Your system , including any added malware, is being saved to he stick when you see that message.
On puppy it is possible to switch off those intermittent auto-backups and decide when closing whether to save or not ...
http://www.google.com/cse?cx=015995643981050743583%3Aabvzbibgzxo&q=kiosk&sa=Search&cof=FORID%3A0&siteurl=www.wellminded.com%2Fpuppy%2Fpupsearch.html&ref=&ss=1636j747498j5#gsc.tab=0&gsc.q=do%20not%20save%20savefile%20shutdown%20close

Thanks for clearing that up, Barkin.

Now, if an attacker wishes to write & save to the stick, where is his data going, to RAM or can he bypass RAM and access the stick directly?

Edwardo wrote:Now, if an attacker wishes to write & save to the stick, where is his data going, to RAM or can he bypass RAM and access the stick directly?

If the savefile has heavy encryption then I don't think it is possible to modify its contents directly (i.e. the "bypass RAM" scenario).

If you run from a live CD/DVD which is not the rewritable type then it is physically impossible to modify the data on it.

Barkin wrote:

Edwardo wrote:Now, if an attacker wishes to write & save to the stick, where is his data going, to RAM or can he bypass RAM and access the stick directly?

If the savefile has heavy encryption then I don't think it is possible to modify its contents directly (i.e. the "bypass RAM" scenario).

If you run from a live CD/DVD which is not the rewritable type then it is physically impossible to modify the data on it.

OK. At present only the save file is encrypted by bcrypt (read-write USB). 1. As bcrypt encrypts only the savefile can data be written to a part of the disk that is not encrypted? 2. If the whole disk is encrypted say with Truecrypt, does this prevent data being written?

Edwardo wrote:OK. Only the save file is encrypted (read-write USB).

It is possible to get USB sticks / SD cards which are write protected (they have a tiny switch on the side) so behave like a read-only CD/DVD.

Edwardo wrote: 1. Can data be written to that part of the disk that is not encrypted? 2. If the whole disk is encrypted say with Truecrypt, would this prevent data being written?

If someone has remote access to your computer they can do pretty much what they want, the firewall should prevent that, there is website called "Shields Up" which will check your firewall ... http://grc.com/x/ne.dll?bh0bkyd2

To change the contents of an encrypted file the attacker would have to have access to it and to the password.

I think it is also worth remembering that the internet (and router protocols) were developed to serve the purposes of the American military. Any data you send, encrypted or not, can be saved and decoded by many, many people in a variety of different organisations, everywhere throughout the data chain.

And any operating system can be hacked to include trojans, data echoing software and keyloggers that could trap your info before it even gets encrypted.

If you are wanting to hide data from your neighbour, encryption may be useful, but anything you transfer via the internet is an open book to governments, police and military establishments. If they want your data they will get it.

Hi,

If any reader, who is not using Opera and who does not have an exceptionally wide screen, can read this without using their horizontal scrollbar - please be so kind as reply stating your browser(s) and setting(s) that make such viewing possible.

SeaMonkey, Qt-Web, slimboat and dillo are of personal interest.

My regards

Hi Jasper - I am using Seamonkey version 2.13.1

I have no idea which settings to list - as far as I am aware my settings are default. I am viewing on a netbook with 1024x600 res. I have noticed from time to time that some threads appear very wide, but have never understood why (except in some cases where there is a large pic to view...)