I crypt, You crypt Budi Rahardjo Institut Teknologi Bandung – Invited Talk at Indonesian Cryptology and Information Security Conference Jakarta, March 2005

2005Budi Rahardjo - I crypt, you crypt2 Gur Pelcg Fbat V pelcg, lbh pelcg Jr nyy pelcg, sbe V pelcg Yn, yn, yn …

2005Budi Rahardjo - I crypt, you crypt3 ROT13 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z n o p q r s t u v w x y z a b c d e f g h i j k l m Characters are shifted 13 places Commonly used during the Usenet newsgroup era to post puzzles or offensive messages There are many tools to perform rot13 –Usenet news readers –Text editors: vi, emacs –Now, web-based:

2005Budi Rahardjo - I crypt, you crypt4 The Crypt Song I crypt, you crypt We all crypt, for I crypt La, la, la … Adapted from “The I scream ice cream” song I scream, you scream We all scream for ice cream La, la, la Monday, Tuesday We all scream for sundae La, la, la

2005Budi Rahardjo - I crypt, you crypt5 Daily-crypto-live Cryptography is part of our (digital?) live –GSM communication (with A5) –Bank ATM (PIN, encrypted communication) –Microsoft Office files can be saved with password (RC4) –Access control (password, token, smartcard) –SSL in e-commerce –If that’s not enough, roll your own coding scheme for puzzles, quizzes, … secret SMS messages ! –Many more … What does it mean?

2005Budi Rahardjo - I crypt, you crypt6

2005Budi Rahardjo - I crypt, you crypt7 GSM Source:

2005Budi Rahardjo - I crypt, you crypt8 Microsoft Office Password

2005Budi Rahardjo - I crypt, you crypt9 What does it mean? It means that we already dependent on crypto for –Commercial environment –Government –Military –and … personal (home)

2005Budi Rahardjo - I crypt, you crypt10 Impact To Government Should the government come up with regulation? Over protected/regulated –Privacy on the line –Bad for business Under protected –False sense of security –National security issues? How to strike balance? There will be more debates in the future

2005Budi Rahardjo - I crypt, you crypt11 Crypto problems in Indonesia The problems –Lack of understanding crypto. A difficult subject. Not much interest. Don’t care… –Lack of expertise in Indonesia(?) –How to build and keep talented human resources in Indonesia? That is why we need the Society of Indonesian Cryptology and Information Security

2005Budi Rahardjo - I crypt, you crypt12 Resulting in … As a result –Technology dependencies are high –We are at the mercy of vendors and other governments –We were given a sub-standard products (e.g. shorter key length, which results in less secure system)

2005Budi Rahardjo - I crypt, you crypt13 International Surveilance Source: IEEE Spectrum April 2003

2005Budi Rahardjo - I crypt, you crypt14 Listen, Filter, Store Source: IEEE Spectrum April 2003

2005Budi Rahardjo - I crypt, you crypt15 Road from Crypto to Security Some would think that encryption can solve all security problems. Wrong! Crypto alone cannot solve all security problems –e.g. availability problems All of this lead to information security

2005Budi Rahardjo - I crypt, you crypt16 Initiatives There has to be security initiative(s) to solve this problem, by –Research –Product development –Applications –Standards (for military, commercial, and personal/home use) –Certification –Education [crypto for kids?] Indonesia’s National Strategy to Secure Cyberspace

2005Budi Rahardjo - I crypt, you crypt17 Security Initiative Drivers Who is the driver? –Government –Academia –Commercial entities –Special interest groups (such as our society?)

2005Budi Rahardjo - I crypt, you crypt18

2005Budi Rahardjo - I crypt, you crypt19

2005Budi Rahardjo - I crypt, you crypt20 What to do next? Let’s hope that this is conference continues (annually?) Let’s discuss this in this forum …

2005Budi Rahardjo - I crypt, you crypt21 Gunax Lbh