Sigillu FAQ: ultra strong encryption software to secure calls and provide privacy

• What's GSM?

The Global System for Mobile Communications, GSM (original acronym: Groupe Spécial Mobile) is the most popular standard for mobile phones in the world. GSM service is used by over 2 billion people across more than 212 countries and territories. The ubiquity of the GSM standard makes international roaming very common between mobile phone operators, enabling subscribers to use their phones in many parts of the world. GSM differs significantly from its predecessors in that both signaling and speech channels are Digital call quality, which means that it is considered a second generation (2G) mobile phone system. This fact has also meant that data communication was built into the system from the 3rd Generation Partnership Project (3GPP).

From the point of view of the consumers, the key advantage of GSM systems has been higher digital voice quality and low cost alternatives to making calls such as text messaging. The advantage for network operators has been the ability to deploy equipment from different vendors because the open standard allows easy inter-operability. Like other cellular standards GSM allows network operators to offer roaming services which mean subscribers can use their phones all over the world.

As the GSM standard continued to develop, it retained backward compatibility with the original GSM phones; for example, packet data capabilities were added in the Release '97 version of the standard, by means of GPRS. Higher speed data transmission has also been introduced with EDGE in the Release '99 version of the standard.

(from www.wikipedia.org)

• What's CDMA?

CDMA refers to a technology designed by Qualcomm in the US that utilizes spread spectrum communications for the radio link. Rather than sharing a channel as many other network air interfaces do, CDMA spreads the digitized data over the entire bandwidth available, distinguishing multiple calls through a unique sequence code assigned. Successive versions of the IS-95 standard define CDMA usage in the US, which is the reason why the term CDMA is often used to refer to IS-95 compliant cellular networks. IS-95 CDMA systems are sometimes referred to as cdmaOne. The next evolutionary step for CDMA to 3G services is cdma2000, TIA/EIA/IS-2000 SeriesF1F, Release A, based on the ITU IMT-2000 standard. Both Verizon and Sprint operate nationwide CDMA networks in the US.

• What's WCDMA?

GSM is a cellular system used worldwide that was designed in Europe, primarily by Ericsson and Nokia. Cingular and T-Mobile operate nationwide networks in the US. GSM uses a TDMA air interface. TDMA refers to a digital link technology whereby multiple phones share a single carrier, radio frequency channel by taking turns – using the channel exclusively for a certain time slice, then releasing it and waiting briefly while other phones use it. A packet switching enhancement to GSM wireless networks called GPRS was standardized to increase transmission speeds of data. The next generation of GSM, commonly referred to as the third generation or 3G, is known as UMTS (Universal Mobile Telecommunications System) and involves enhancing GSM networks with a Wideband CDMA (W-CDMA) air interface.

• What's a SIM card?

Subscriber Identity Modules (SIMs) are synonymous with mobile phones and devices that interoperate with GSM (Global System for Mobile communications) cellular networks. Under the GSM framework, a cellular phone is referred to as a Mobile Station and is partitioned into two distinct components: the Subscriber Identity Module (SIM) and the Mobile Equipment (ME). As the name implies, a SIM is a removable component that contains essential information about the subscriber. The ME, the remaining radio handset portion, cannot function fully without one. The SIM’s main function entails authenticating the user of the cell phone to the network to gain access to subscribed services. The SIM also provides storage for personal information, such as phone book entries and text messages, as well as service-related information.

The SIM-ME partitioning of a cell phone stipulated in the GSM standards has brought about a form of portability. Moving a SIM between compatible cell phones automatically transfers with it the subscriber’s identity and the associated information and capabilities. In contrast, present-day CDMA phones do not employ a SIM. Analogous SIM functionality is instead directly incorporated within the device. While SIMs are most widely used in GSM systems, comparable modules are also used in iDEN (Integrated Digital Enhanced Network) phones and UMTS user equipment (i.e., a USIM). Because of the flexibility a SIM offers GSM phone users to port their identity, personal information, and service between devices, eventually all cellular phones are expected to include (U)SIM-like capability.

At its core, a SIM is a special type of smart card that typically contains a processor and between 16 to 128 KB of persistent electronically erasable, programmable read only memory (EEPROM). It also includes random access memory (RAM) for program execution, and read only memory (ROM) for the operating system, user authentication and data encryption algorithms, and other applications. The SIM’s hierarchically organized file system resides in persistent memory and stores such things as names and phone number entries, text messages, and network service settings. Depending on the phone used, some information on the SIM may coexist in the memory of the phone. Alternatively, information may reside entirely in the memory of the phone instead of available memory on the SIM.

• What's firmware?

Firmware is a software program or set of instructions programmed on a hardware device. It provides the necessary instructions for how the device communicates with the other computer hardware. But how can software be programmed onto hardware? Good question. Firmware is typically stored in the flash ROM of a hardware device. While ROM is "read-only memory," flash ROM can be erased and rewritten because it is actually a type of flash memory.

Firmware can be thought of as "semi-permanent" since it remains the same unless it is updated by a firmware updater. You may need to update the firmware of certain devices, such as hard drives and video cards in order for them to work with a new operating system. CD and DVD drive manufacturers often make firmware updates available that allow the drives to read faster media. Sometimes manufacturers release firmware updates that simply make their devices work more efficiently.

(extracted from Sharpened Computer Glossary)

• What's full duplex?

A full-duplex system allows communication in both directions, and unlike half-duplex, allows this to happen simultaneously. Land-line telephone networks are full-duplex since they allow both callers to speak and be heard at the same time. A good analogy for a full-duplex system would be a two lane road with one lane for each direction. Examples: Telephone, Mobile Phone, etc.

Two way radios can be, for instance, designed as full-duplex systems, which transmit on one frequency and receive on a different frequency. This is also called frequency-division duplex. Frequency-division-duplex systems can be extended to farther distances using pairs of simple repeater stations, owing to the fact the communications transmitted on any one frequency always travels in the same direction.

• What's a backdoor?

A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication or securing remote access to a computer, while attempting to remain hidden from casual inspection. The backdoor may take the form of an installed program (e.g., Back Orifice or the Sony/BMG rootkit backdoor installed when any of millions of Sony music CDs were played on a Windows computer), or could be a modification to a legitimate program.

• What's an IMSI catcher?

An IMSI catcher is a device for intercepting GSM mobile phones. It subjects the phones in its vicinity to a man in the middle attack, acting to them as a preferred base station in terms of signal strength.

The IMSI catcher logs the IMSI numbers of all the mobile phones in the area, as they attempt to attach to the base station, and can determine the phone number of each individual phone. It also allows forcing the mobile phone connected to it to revert to A5/0 for call encryption (in other words, no encryption at all), making the call data easy to intercept and convert to audio. It can also tap and record the phone calls on its own.

The GSM specification requires the handset to authenticate to the network, but does NOT require the network to authenticate to the handset, which is a glaring and reportedly intentional security hole.

IMSI catchers are used by law enforcement and intelligence agencies.

Several countermeasures against IMSI catchers exist. A directional antenna can be used to lock the telephone to a distant base station, making it not see the nearby IMSI catcher, or the phone can be forced to a specific base station ID (if the firmware supports it), sacrificing mobility for security. To avoid being wiretapped, even if the phone is still seen and recognized, a GSM compatible secure telephone or cipher unit for end-to-end voice encryption is required.

• What's TSCM?

TSCM (Technical Surveillance Counter-Measures) is the original military abbreviation provided to the trade of bug-sweeping or electronic counter-surveillance. It is related to ELINT, SIGINT and ECM.

The United States Department of Defense defines a TSCM survey as a service provided by qualified personnel to detect the presence of technical surveillance devices and hazards and to identify technical security weaknesses that could aid in the conduct of a technical penetration of the surveyed facility. A TSCM survey will provide a professional evaluation of the facility's technical security posture and normally will consist of a thorough visual, electronic, and physical examination in and about the surveyed facility.

This definition is however lacking some of the technical scope involved. COMSEC (Communications Security), ITSEC (Information Technology Security) and physical security are also a major part of the work in the modern environment, the advent of multimedia devices and remote control technologies allow huge scope for removal of massive amounts of data in very secure environments by the staff employed within, with or without their knowledge. Even PlayStation Portables (PSPs) have wireless connectivity and optional storage capacity, therefore connection and forward on receive over 54Mbps wireless for hundreds of meters is achievable. This is only the tip of the iceberg.

• What's phone surveillance?

The official and unofficial tapping of telephone lines is widespread.

The contracts or licenses by which the state controls telephone companies means that they must provide access for tapping lines to the security services and the police.

For mobile phones the major threat is the collection of communications data. This data not only includes information about the time and duration of the call, but also the geographical location where the call was made from and to whom. This data can be determined generally because the geographic communications cell that the call was made in is stored with the details of the call. But it is also possible to get greater resolution of a persons location by combining information from a number of cells surrounding the persons location.

Mobile phones are, in surveillance terms, a major liability. This liability will only increase as the new third-generation (3G) phones are introduced. This is because the base stations will be located closer together.

• What's business espionage?

Industrial espionage and corporate espionage are phrases used to describe espionage conducted for commercial purposes instead of national security purposes.

At the most innocuous level, the term is applied to the legal and mundane methods of examining corporate publications, web sites, patent filings, and the like to determine the activities of a corporation (though this is normally referred to as business intelligence), through to illegal methods such as bribery, blackmail, technological surveillance and even occasional violence. As well as spying on commercial organizations, governments can also be targets of commercial espionage—for example, to determine the terms of a tender for a government contract so that another tenderer can underbid.

Information can make the difference between success and failure; if a trade secret is stolen, the competitive playing field is levelled or even tipped in favor of a competitor.

Although a lot of information gathering is accomplished by combing through public records (public databases and patent filings), at times corporations feel the best way to get information is to take it. Corporate espionage is a threat to any business whose livelihood depends on information. The information competitors seek may be client lists, supplier agreements, personnel records, research documents, or prototype plans for a new product or service.

In recent years, corporate espionage has taken on an expanded definition. For instance, attempts to sabotage a corporation may be considered corporate espionage; in this sense, the term takes on the wider connotations of its parent word. In some cases, malware and spyware has even entered the arsenal of the warfare known as corporate espionage.

The government of France has conducted ongoing industrial espionage against American aerodynamics and satellite companies and vice versa.

The development of the Tupolev Tu-144 supersonic aircraft, with its rapid design and similarity to Concorde, was one of the most prominent examples of industrial espionage in the 20th century.

• How do I initiate a secure call?

To initiate an encrypted call just press the "C" key of the phone keypad for a couple of seconds. The encryption screen will pop-up, and you will be able to dial in the number you want to call securely, or select it from the phone's address book.

After a hand-shaking process, the encryption software will let you know when/whether a secure communication was established.

• Is your solution software-based or do I need specially modified hardware?

Our encryption system is software-based. It utilizes the NokiaTMnative processing power and does not require any additional hardware. We do not change, modify, or compromise the standard functionality of the Nokia device.

• Can somebody decrypt my recorded calls?

No modern hacking/decryption techniques are capable of decrypting the signal in any way. Even the mathematicians who developed the encryption algorithms are not capable of decrypting your secure calls and messages.

• Does the other party need to have the same technology to enable a secure call?

Yes. This is an end-to-end protection system. Both sides of the conversation must use the same technology, even if they use different Nokia devices. Regular calls (not secure) can be made from this device to all other phones.

• Why Symbian and not other OS?

Click hereto access a white paper describing the key characteristics required of an operating system designed for mobile phones and why Symbian OS is the best-in-class mobile operating system. It is important to take into account that some operating systems are more vulnerable than others. It is worth mentioning that, whilst Microsoft has been continually patching their desktop OS, the mobile versions, which use a lot of the same code, has generally gone un-patched.

• Should I disable bluetooth on my phone?

Only set your Bluetooth connection to ‘visible’ (also called ‘discoverable’) when necessary. Leaving your Bluetooth connection set to ‘visible’, means anyone in Bluetooth range (~10 metres) could potentially contact you via Bluetooth. It is advisable to set the Bluetooth connection to visible only when you need to pair the phone with another device, for instance a headset, your computer or another phone. In normal use, leave the Bluetooth connection to hidden, this enables your phone to connect to your already paired headset or computer but not to devices that have not been paired.

If you set your Bluetooth connection to visible, for instance to use social network type of applications, do not install applications you do not trust and you have not specifically requested.

On a Symbian OS phone, every time a Bluetooth message is sent to you, you will receive a prompt stating “RECEIVE MESSAGE?” Never say “YES” unless you know who is sending you the message and you are expecting such a message from that person. If you say no and the message continues to be seen, move location and then switch to hidden mode.

• Is it risky to use bluetooth, SMS, or connect my phone to a PC?

As platform convergence continues, mobile threats will keep growing. With increased connectivity through BlueTooh, SMS, instant messaging, email, WiFi, USB, audio, video, and web, there are more possibilities for cross device contamination. For example, a smartphone can be affected by a PC vector via ActiveSync, the synchronization application in Windows Mobile.

SMiShing, which involves taking the techniques of phishing by email and porting them to SMS, is expected to increase. Several variations of the VBS/Eliles mass mailing worm that also sends short message service (SMS) messages to mobile phones have already been discovered.

So far, malicious SMS's have been seen to:

* have a URL embedded within the message instructing the user to invoke that link with the phone's web browser

* instruct the user to divulge sensitive information

* tell the user to download and install software to their mobile phone that will compromise the device

As in the traditional forms of phishing, this technique relies heavily on fraudsters masquerading as legitimate entities or using some form of deception.

There are already several spy-ware offerings in the mobile world. Most are designed to monitor phone numbers and SMS call logs, or to steal SMS messages by forwarding copies to another phone. Some are also capable of remotely activate the phone's microphone, allowing somebody to eavesdrop on a person using his/her cellular phone.

• Communications security (COMSEC): Measures and controls taken to deny unauthorized persons information derived from telecommunications and ensure the authenticity of such telecommunications. Communications security includes cryptosecurity, transmission security, emission security, traffic-flow security. and physical security of COMSEC material.

cryptosecurity: The component of communications security that results from the provision of technically sound cryptosystems and their proper use. This includes insuring message confidentiality and authenticity.

emission security (EMSEC): Protection resulting from all measures taken to deny unauthorized persons information of value which might be derived from intercept and analysis of compromising emanations from crypto-equipment, automated information systems (computers), and telecommunications systems.

physical security: The component of communications security that results from all physical measures necessary to safeguard classified equipment, material, and documents from access thereto or observation thereof by unauthorized persons.

traffic-flow security: Measures that conceal the presence and properties of valid messages on a network. It includes the protection resulting from features, inherent in some crypto equipment, that conceal the presence of valid messages on a communications circuit, normally achieved by causing the circuit to appear busy at all times.

transmission security (TRANSEC): The component of communications security that results from the application of measures designed to protect transmissions from interception and exploitation by means other than cryptanalysis (e.g. frequency hopping and spread spectrum).

• TSCM (Technical Surveillance Counter-Measures) is the original military abbreviation provided to the trade of bug-sweeping or electronic counter-surveillance. It is related to ELINT, SIGINT and ECM.

• Surveillance, counter-surveillance, inverse surveillance, sousveillance

Surveillance is the art of watching over the activities of persons or groups from a position of higher authority. Surveillance may be covert (without their knowledge) or overt (perhaps with frequent reminders such as "we are watching over you"). Surveillance has been an intrinsic part of human history. Sun Tzu's The Art of War, written 2,500 years ago, discusses how spies should be used against a person's enemies. But modern electronic and computer technology have given surveillance a whole new field of operation. Surveillance can be automated using computers, and people leave extensive records that describe their activities.

Counter surveillance is the practice of avoiding surveillance or making surveillance difficult. Before computer networks, counter surveillance involved avoiding agents and communicating secretly. With recent developments; the Internet, increasing prevalence of electronic security systems, and computer databases, counter surveillance has grown in scope and complexity. Now counter surveillance involves everything from knowing how to delete a file on a computer to avoiding becoming the target of direct advertising agencies.

Inverse surveillance is the practice of reversalism on surveillance, e.g., citizens photographing police, shoppers photographing shopkeepers, and passengers photographing cab drivers who usually have surveillance cameras in their cabs. A well-known example is George Haliday's recording of the Rodney King beating. Inverse surveillance attempts to subvert the Panoptic gaze of surveillance, and often attempts to subvert the secrecy of surveillance through making the inverse surveillance recordings widely available (in contrast to the usually secret or restricted surveillance tapes).

Sousveillance (a term coined by Steve Mann, a professor at the University of Toronto [2]) is inverse surveillance that includes the recording of an activity by a participant in the activity. Recent sousveillance workshops such as Microsoft's Continuous Archival and Recording of Personal Experience are evidence of a growing sousveillance industry including Microsoft (wearable cameras), Nokia, Hewlett Packard ("Casual Capture") and many others.

Clinical Surveillance is the monitoring of events (including, for example, the occurrences of infectious diseases or chronic diseases) with a significant impact on public health. Increasingly, clinical surveillance is being used to inform public policy in allocating health care resources and meeting patient needs. As health care becomes increasingly dependent on information systems and the use of clinical surveillance becomes more widespread, privacy concerns may arise.

• Surveillance: Impact

The greatest impact of computer-enabled surveillance is the large number of organisations involved in surveillance operations:

The state and security services still have the most powerful surveillance systems, because they are enabled under the law. But today levels of state surveillance have increased, and using computers they are now able to draw together many different information sources to produce profiles of persons or groups in society.

Many large corporations now use various form of 'passive' surveillance. This is primarily a means of monitoring the activities of staff and for controlling public relations. But some large corporations actively use various forms of surveillance to monitor the activities of activists and campaign groups who may impact their operations.

Many companies trade in information lawfully, buying and selling it from other companies or local government agencies who collect it. This data is usually bought by companies who wish to use it for marketing or advertising purposes.

Personal information is obtained by many small groups and individuals. Some of this is for harmless purposes, but increasingly sensitive personal information is being obtained for criminal purposes, such as credit card and other types of fraud.

Modern surveillance cannot be totally avoided. However, non-state groups may employ surveillance techniques against an organisation, and some precautions can reduce their success. Some states are also legally limited in how extensively they can conduct general surveillance of people they have no particular reason to suspect.

• Surveillance: Telephones and mobile phones

The official and unofficial tapping of telephone lines is widespread.

The contracts or licenses by which the state controls telephone companies means that they must provide access for tapping lines to the security services and the police.

• Business intelligence (BI) has two basic different meanings related to the use of the term intelligence. The primary, less frequently, is the human intelligence capacity applied in business affairs/activities. Intelligence of Business is a new field of the investigation of the application of human cognitive faculties and artificial intelligence technologies to the management and decision support in different business problems.

The second, which is the subject of this article, relates to the intelligence as information valued for its currency and relevance. It is expert information, knowledge and technologies efficient in the management of organizational and individual business. Therefore, in this sense, business intelligence is a broad category of applications and technologies for gathering, providing access to, and analyzing data for the purpose of helping enterprise users make better business decisions. The term implies having a comprehensive knowledge of all of the factors that affect your business. It is imperative that you have an in depth knowledge about factors such as your customers, competitors, business partners, economic environment, and internal operations to make effective and good quality business decisions. Business intelligence enables you to make these kinds of decisions.

A specialized field of business intelligence known as competitive intelligence focuses solely on the external competitive environment. Information is gathered on the actions of competitors and decisions are made based on this information. Little if any attention is paid to gathering internal information.

• Industrial espionage and corporate espionage are phrases used to describe espionage conducted for commercial purposes instead of national security purposes.

Information can make the difference between success and failure; if a trade secret is stolen, the competitive playing field is levelled or even tipped in favor of a competitor.

The government of France has conducted ongoing industrial espionage against American aerodynamics and satellite companies and vice versa.

The development of the Tupolev Tu-144 supersonic aircraft, with its rapid design and similarity to Concorde, was one of the most prominent examples of industrial espionage in the 20th century.

• Espionage is the practice of obtaining information about an organization or a society that is considered secret or confidential (spying) without the permission of the holder of the information. What differentiates espionage from other forms of intelligence work is that espionage involves obtaining the information by accessing the place where the information is stored or accessing the people who know the information and will divulge it through some kind of subterfuge.

Espionage is usually thought of as part of an institutional effort (i.e., governmental or corporate espionage). The term espionage is most readily associated with state spying on potential or actual enemies, primarily for military purposes, but this has been extended to spying involving corporations, known specifically as industrial espionage. Many nations routinely spy on both their enemies and allies, although they maintain a policy of not making comment on this. In addition to utilizing agencies within a government many also employ private companies to collect information on their behalf such as SCG International Risk and others. Black's Law Dictionary (1990) defines espionage as: "...gathering, transmitting, or losing...information related to the national defence."

A spy is a person employed to obtain such secrets. The term intelligence officer is also used to describe a member of the armed forces, police, or civilian intelligence agency who specialises in the gathering, fusion, and analysis of information and intelligence in order to provide advice to their government or another organisation. In general, intelligence officers travel to foreign countries to recruit and "run" intelligence agents, who in turn spy on their own governments. These agents can be moles (who are recruited before they get access to secrets) or defectors (who are recruited after they get access to secrets).

• Cryptography (or cryptology) is the study of message secrecy. In modern times, it has become a branch of information theory, as the mathematical study of information and especially its transmission from place to place. The noted cryptographer Ron Rivest has observed that "cryptography is about communication in the presence of adversaries." It is a central contributor to several fields: information security and related issues, particularly, authentication, and access control. One of cryptography's primary purposes is hiding the meaning of messages, not usually the existence of such messages. In modern times, cryptography also contributes to computer science. Cryptography is central to the techniques used in computer and network security for such things as access control and information confidentiality. Cryptography is also used in many applications encountered in everyday life; the security of ATM cards, computer passwords, and electronic commerce all depend on cryptography.

• Encryption is the process of obscuring information to make it unreadable without special knowledge. While encryption has been used to protect communications for centuries, only organizations and individuals with an extraordinary need for secrecy had made use of it. In the mid-1970s, strong encryption emerged from the sole preserve of secretive government agencies into the public domain, and is now employed in protecting widely-used systems, such as Internet e-commerce, mobile telephone networks and bank automatic teller machines.

Encryption can be used to ensure secrecy, but other techniques are still needed to make communications secure, particularly to verify the integrity and authenticity of a message; for example, a message authentication code (MAC) or digital signatures. Another consideration is protection against traffic analysis.

Encryption or software code obfuscation is also used in software copy protection against reverse engineering, unauthorized application analysis, cracks and software piracy used in different encryption or obfuscating software.

• Public-key cryptography

Symmetric-key cryptosystems typically use the same key for encryption and decryption. A significant disadvantage of symmetric ciphers is the key management necessary to use them securely. Each distinct pair of communicating parties must, ideally, share a different key. The number of keys required increases as the square of the number of network members, which very quickly requires complex key management schemes to keep them all straight and secret. The difficulty of establishing a secret key between two communicating parties, when a secure channel doesn't already exist between them, also presents a chicken-and-egg problem which is a considerable practical obstacle for cryptography users in the real world.

In a groundbreaking 1976 paper, Whitfield Diffie and Martin Hellman proposed the notion of public-key (also, more generally, called asymmetric key) cryptography in which two different but mathematically related keys are used -- a public key and a private key. A public key system is so constructed that calculation of the private key is computationally infeasible from the public key, even though they are necessarily related. Instead, both keys are generated secretly, as an interrelated pair. The historian David Kahn described public-key cryptography as "the most revolutionary new concept in the field since poly-alphabetic substitution emerged in the Renaissance".

In public-key cryptosystems, the public key may be freely distributed, while its paired private key must remain secret. The public key is typically used for encryption, while the private or secret key is used for decryption. Diffie and Hellman showed that public-key cryptography was possible by presenting the Diffie-Hellman key exchange protocol. In 1978, Ronald Rivest, Adi Shamir, and Len Adleman invented RSA, another public-key system. And In 1997, it finally became publicly known that asymmetric key cryptography had been invented by James H. Ellis at GCHQ, a British intelligence organization, in the early 1970s, and that both the Diffie-Hellman and RSA algorithms had been previously developed (by Malcolm J. WilliamsonClifford Cocks, respectively).

Diffie-Hellman and RSA, in addition to being the first publicly known examples of high quality public-key cryptosystems, have been among the most widely used. Others include the Cramer-Shoup cryptosystem, ElGamal encryption, and various elliptic curve techniques. See Category:Asymmetric-key cryptosystems.

In addition to encryption, public-key cryptography can be used to implement digital signature schemes. A digital signature is reminescent of an ordinary signature; they both have the characteristic that they are easy for a user to produce, but difficult for anyone else to forge. Digital signatures can also be permanently tied to the content of the message being signed; they cannot be 'moved' from one document to another, for any attempt will be detectable. In digital signature schemes, there are two algorithms: one for signing, in which a secret key is used to process the message (or a hash of the message, or both), and one for verification, in which the matching public key is used with the message to check the validity of the signature. RSA and DSA are two of the most popular digital signature schemes. Digital signatures are central to the operation of public key infrastructures and to many network security schemes (SSL/TLS, many VPNs, etc).

Public-key algorithms are most often based on the computational complexity of "hard" problems, often from number theory. The hardness of RSA is related to the integer factorization problem, while Diffie-Hellman and DSA are related to the discrete logarithm problem. More recently, elliptic curve cryptography has developed in which security is based on number theoretic problems involving elliptic curves. Because of the complexity of the underlying problems, most public-key algorithms involve operations such as modular multiplication and exponentiation, which are much more computationally expensive than the techniques used in most block ciphers, especially with typical key sizes. As a result, public-key cryptosystems are commonly "hybrid" systems, in which a fast symmetric-key encryption algorithm is used for the message itself, while the relevant symmetric key is sent with the message, but encrypted using a public-key algorithm. Similarly, hybrid signature schemes are often used, in which a cryptographic hash function is computed, and only the resulting hash is digitally signed.

• Cryptography: prohibitions

Because of its potential to assist the malicious in their schemes, cryptography has long been of interest to intelligence gathering agencies and law enforcement agencies. Because of its facilitation of privacy, and the diminution of privacy attendant on its prohibition, cryptography is also of considerable interest to civil rights supporters. Accordingly, there has been a history of controversial legal issues surrounding cryptography, especially since the advent of inexpensive computers has made possible widespread access to high quality cryptography.

In some countries, even the domestic use of cryptography is, or has been, restricted. Until 1999, France significantly restricted the use of cryptography domestically. In China, a license is still required to use cryptography. Many countries have tight restrictions on the use of cryptography. Among the more restrictive are laws in Belarus, China, Kazakhstan, Mongolia, Pakistan, Russia, Singapore, Tunisia, Venezuela, and Vietnam.

In the United States, cryptography is legal for domestic use, but there has been much conflict over legal issues related to cryptography. One particularly important issue has been the export of cryptography and cryptographic software and hardware. Because of the importance of cryptanalysis in World War II and an expectation that cryptography would continue to be important for national security, many western governments have, at some point, strictly regulated export of cryptography. After World War II, it was illegal in the US to sell or distribute encryption technology overseas; in fact, encryption was classified as a munition, like tanks and nuclear weapons. Until the advent of the personal computer and the Internet, this was not especially problematic. Good cryptography is indistinguishable from bad cryptography for nearly all users, and in any case, most of the cryptographic techniques generally available were slow and error prone whether good or bad. However, as the Internet grew and computers became more widely available, high quality encryption techniques became well-known around the globe. As a result, export controls came to be seen to be an impediment to commerce and to research.

• Circuit Switched Data, often referred to as CSD, is the original form of data transmission developed for the TDMA-based mobile phone systems like GSM. CSD uses a single radio time slot to deliver 9.6 kbit/s data transmission to the GSM Network and Switching Subsystem where it could be connected through the equivalent of a normal modem to the PSTN allowing direct calls to any dial up service.

Prior to CSD, data transmission over mobile phone systems was done by using a modem, either built into the phone or attached to it. Such systems were limited by the quality of the audio signal to 2.4 kbit/s or less. With the introduction of digital transmission in TDMA-based systems like GSM, CSD provided almost direct access to the underlying digital signal, allowing for higher speeds. At the same time, the speech oriented audio compression used in GSM actually meant that data rates using a traditional modem connected to the phone would have been even lower than with older analogue systems.

A CSD call functions in a very similar way to a normal voice call in a GSM network. A single dedicated radio time slot is allocated between the phone and the base station. A dedicated "sub-time slot" (16 kbit/s) is allocated from the base station to the transcoder, and finally another time slot (64 kbit/s) is allocated from the transcoder to the Mobile Switching Centre (MSC).

At the MSC, it is possible to use a modem to convert to an "analog" signal, though this will typically actually be encoded as a digital PCM signal when sent from the MSC. It is also possible to directly use the digital signal as an ISDN data signal and feed it into the equivalent of a remote access server.

GSM data transmission has advanced since the introduction of CSD:

HSCSD is a system based on CSD but designed to provide higher data rates by means of more efficient channel coding and/or multiple (up to 4) time slots.
GPRS provides more efficient packet-based data transmission directly from the mobile phone at speeds similar to HSCSD.
Finally EDGE (E-GPRS) and UMTS provide improved radio interfaces with higher data rates, while still being backward compatible with the GSM core network.

• A Covert listening device, more commonly known as a bug, is usually a combination of a miniature radio transmitter with a microphone. The use of bugs, called bugging, is a common technique in espionage and, increasingly, in police investigations.

Most bugs use a radio transmitter, but there are many other options for carrying a signal: radio frequencies may be sent through the main wiring of a building and picked up outside; transmissions from a cordless phone can be monitored; and it is possible to pick up the data from poorly configured wireless computer networks or tune in to the radio emissions of a computer monitor.

Bugs come in all shapes and sizes. The original purpose of bugs was to relay sound, but today the miniaturisation of electronics has progressed so far that even commercially-available bugs designed to carry TV signals are usually the size of a cigarette packet. Professional bugs can fit into pens, calculators and other commonplace items. Some are only the size of small shirt buttons, although the power and operational life of the smallest bugs is very short.

The development of modern 'wireless' technology has presented new security concerns. To be 'wireless' a device must transmit information, either by radio waves or infrared light, and this potentially makes all the information sent via that link available to others. Radio waves are the easiest to intercept, but even infrared transmissions can be picked up through a window. Some wireless devices, such as wireless computer networks, do encrypt transmissions, but the standard forms of encryption are weak. Such devices, whether wireless keyboards or wireless telephones, should not be used in any environment where sensitive information is handled.

Most bugs emit radio waves. The standard counter-measure for bugs is therefore to 'sweep' for them with a receiver, looking for the radio emissions. Professional sweeping devices are very expensive. Low-tech sweeping devices are available through amateur electrical magazines, or they may be built from circuit designs on the Internet. But sweeping is not foolproof. Advanced bugs can be remotely operated to switch on and off, and some even rapidly switch frequencies according to a predetermined pattern in order to make location with sweepers more difficult. A bug that has run out of power may not show up during a sweep, which means that the sweeper will not be alerted to the surveillance.

A mobile phone may transmit at moments or to a receiving party that the listened-to party does not expect.

• Cryptography. As the field of cryptography has advanced, the dividing lines for what is and what is not cryptography have become blurred. Cryptography today might be summed up as the study of techniques and applications that depend on the existence of difficult problems.

Cryptanalysis is the study of how to compromise (defeat) cryptographic mechanisms, and cryptology (from the Greek kryptós lógos, meaning ``hidden word'') is the discipline of cryptography and cryptanalysis combined.

To most people, cryptography is concerned with keeping communications private. Indeed, the protection of sensitive communications has been the emphasis of cryptography throughout much of its history. However, this is only one part of today's cryptography.

Encryption is the transformation of data into a form that is as close to impossible as possible to read without the appropriate knowledge. Its purpose is to ensure privacy by keeping information hidden from anyone for whom it is not intended, even those who have access to the encrypted data. Decryption is the reverse of encryption; it is the transformation of encrypted data back into an intelligible form.

Encryption and decryption generally require the use of some secret information, referred to as a key. For some encryption mechanisms, the same key is used for both encryption and decryption; for other mechanisms, the keys used for encryption and decryption are different

Today's cryptography is more than encryption and decryption. Authentication is as fundamentally a part of our lives as privacy. We use authentication throughout our everyday lives - when we sign our name to some document for instance - and, as we move to a world where our decisions and agreements are communicated electronically, we need to have electronic techniques for providing authentication.

Cryptography provides mechanisms for such procedures. A digital signature binds a document to the possessor of a particular key, while a digital timestamp binds a document to its creation at a particular time. These cryptographic mechanisms can be used to control access to a shared disk drive, a high security installation, or a pay-per-view TV channel.

The field of cryptography encompasses other uses as well. With just a few basic cryptographic tools, it is possible to build elaborate schemes and protocols that allow us to pay using electronic money, to prove we know certain information without revealing the information itself, and to share a secret quantity in such a way that a subset of the shares can reconstruct the secret.

While modern cryptography is growing increasingly diverse, cryptography is fundamentally based on problems that are difficult to solve. A problem may be difficult because its solution requires some secret knowledge, such as decrypting an encrypted message or signing some digital document. The problem may also be hard because it is intrinsically difficult to complete, such as finding a message that produces a given hash value.

(extracted from RSA Security web site, see citation)

• RSA Cryptosystem.
The RSA cryptosystem is a public-key cryptosystem that offers both encryption and digital signatures (authentication). Ronald Rivest, Adi Shamir, and Leonard Adleman developed the RSA system in 1977; RSA stands for the first letter in each of its inventors' last names.

The RSA algorithm works as follows: take two large primes, p and q, and compute their product n = pq; n is called the modulus. Choose a number, e, less than n and relatively prime to (p-1)(q-1), which means e and (p-1)(q-1) have no common factors except 1. Find another number d such that (ed - 1) is divisible by (p-1)(q-1). The values e and d are called the public and private exponents, respectively. The public key is the pair (n, e); the private key is (n, d). The factors p and q may be destroyed or kept with the private key.

It is currently difficult to obtain the private key d from the public key (n, e). However if one could factor n into p and q, then one could obtain the private key d. Thus the security of the RSA system is based on the assumption that factoring is difficult. The discovery of an easy method of factoring would "break" RSA.

Here is how the RSA system can be used for encryption and digital signatures (in practice, the actual use is slightly different:

Encryption
Suppose Alice wants to send a message m to Bob. Alice creates the ciphertext c by exponentiating: c = me mod n, where e and n are Bob's public key. She sends c to Bob. To decrypt, Bob also exponentiates: m = cd mod n; the relationship between e and d ensures that Bob correctly recovers m. Since only Bob knows d, only Bob can decrypt this message.

Digital Signature
Suppose Alice wants to send a message m to Bob in such a way that Bob is assured the message is both authentic, has not been tampered with, and from Alice. Alice creates a digital signature s by exponentiating: s = md mod n, where d and n are Alice's private key. She sends m and s to Bob. To verify the signature, Bob exponentiates and checks that the message m is recovered: m = se mod n, where e and n are Alice's public key.

Thus encryption and authentication take place without any sharing of private keys: each person uses only another's public key or their own private key. Anyone can send an encrypted message or verify a signed message, but only someone in possession of the correct private key can decrypt or sign a message.

(extracted from RSA Security web site, see citation)

• Algorithm.
In mathematics and computing, an algorithm is a procedure (a finite set of well-defined instructions) for accomplishing some task which, given an initial state, will terminate in a defined end-state. The computational complexity and efficient implementation of the algorithm are important in computing, and this depends on suitable data structures.

Informally, the concept of an algorithm is often illustrated by the example of a recipe, although many algorithms are much more complex; algorithms often have steps that repeat (iterate) or require decisions (such as logic or comparison). Algorithms can be composed to create more complex algorithms.

The concept of an algorithm originated as a means of recording procedures for solving mathematical problems such as finding the common divisor of two numbers or multiplying two numbers. The concept was formalized in 1936 through Alan Turing's Turing machines and Alonzo Church's lambda calculus, which in turn formed the foundation of computer science.

Most algorithms can be directly implemented by computer programs; any other algorithms can at least in theory be simulated by computer programs. In many programming languages, algorithms are implemented as functions or procedures.

• Brute Force Attack.
In cryptanalysis, a brute force attack is a method of defeating a cryptographic scheme by trying a large number of possibilities; for example, exhaustively working through all possible keys in order to decrypt a message. In most schemes, the theoretical possibility of a brute force attack is recognized, but it is set up in such a way that it would be computationally infeasible to carry out. Accordingly, one definition of "breaking" a cryptographic scheme is to find a method faster than a brute force attack.

The selection of an appropriate key length depends on the practical feasibility of performing a brute force attack. By obfuscating the data to be encoded, brute force attacks are made less effective as it is more difficult to determine when one has succeeded in breaking the code.

• GSM: Global System for Mobile Communications.
The Global System for Mobile Communications, GSM (original acronym: Groupe Spécial Mobile) is the most popular standard for mobile phones in the world. GSM service is used by over 2 billion people across more than 212 countries and territories. The ubiquity of the GSM standard makes international roaming very common between mobile phone operators, enabling subscribers to use their phones in many parts of the world. GSM differs significantly from its predecessors in that both signaling and speech channels are Digital call quality, which means that it is considered a second generation (2G) mobile phone system. This fact has also meant that data communication was built into the system from the 3rd Generation Partnership Project (3GPP).

From the point of view of the consumers, the key advantage of GSM systems has been higher digital voice quality and low cost alternatives to making calls such as text messaging. The advantage for network operators has been the ability to deploy equipment from different vendors because the open standard allows easy inter-operability. Like other cellular standards GSM allows network operators to offer roaming services which mean subscribers can use their phones all over the world.

As the GSM standard continued to develop, it retained backward compatibility with the original GSM phones; for example, packet data capabilities were added in the Release '97 version of the standard, by means of GPRS. Higher speed data transmission has also been introduced with EDGE in the Release '99 version of the standard.

• Firmware.
Firmware is a software program or set of instructions programmed on a hardware device. It provides the necessary instructions for how the device communicates with the other computer hardware. But how can software be programmed onto hardware? Good question. Firmware is typically stored in the flash ROM of a hardware device. While ROM is "read-only memory," flash ROM can be erased and rewritten because it is actually a type of flash memory.

Firmware can be thought of as "semi-permanent" since it remains the same unless it is updated by a firmware updater. You may need to update the firmware of certain devices, such as hard drives and video cards in order for them to work with a new operating system. CD and DVD drive manufacturers often make firmware updates available that allow the drives to read faster media. Sometimes manufacturers release firmware updates that simply make their devices work more efficiently.

(extracted from Sharpened Computer Glossary, see citation)

• Half Duplex.
A half-duplex system provides for communication in both directions, but only one direction at a time (not simultaneously). Typically, once a party begins receiving a signal, it must wait for the transmitter to stop transmitting, before replying.

An example of a half-duplex system is a two-party system such as a "walkie-talkie" style two-way radio, wherein one must use "Over" or another procedure to indicate the end of transmission, and ensure that only one party transmits at a time, because both parties transmit on the same frequency. A good analogy for a half-duplex system would be a one lane road with traffic controllers at each end. Traffic can flow in both directions, but only one direction at a time with this being regulated by the controllers.

• Full Duplex.
A full-duplex system allows communication in both directions, and unlike half-duplex, allows this to happen simultaneously. Land-line telephone networks are full-duplex since they allow both callers to speak and be heard at the same time. A good analogy for a full-duplex system would be a two lane road with one lane for each direction. Examples: Telephone, Mobile Phone, etc.

Two way radios can be, for instance, designed as full-duplex systems, which transmit on one frequency and receive on a different frequency. This is also called frequency-division duplex. Frequency-division-duplex systems can be extended to farther distances using pairs of simple repeater stations, owing to the fact the communications transmitted on any one frequency always travels in the same direction.

• Wiretap.
Telephone tapping (or wire tapping/wiretapping in the US) is the monitoring of telephone and Internet conversations by a third party, often by covert means. The telephone tap or wire tap received its name because historically, the monitoring connection was applied to the wires of the telephone line of the person who was being monitored and drew off or tapped a small amount of the electrical signal carrying the conversation. Legalized wiretapping by police or other recognized governmental authority is otherwise known as lawful interception.

Official use
The contracts or licenses by which the state controls telephone companies often require that the companies must provide access for tapping lines to the security services and the police. In the U.S., telecommunications carriers are required by law to cooperate in the interception of communications for law enforcement purposes under the terms of CALEA. Taps must be secret and undetectable.

When telephone exchanges were mechanical, a tap had to be installed by technicians, linking circuits together to route the audio signal from the call. Now that many exchanges have been converted to digital technology tapping is far simpler and can be ordered remotely by computer. Telephone services provided by cable TV companies also use digital switching technology. If the tap is implemented at a digital switch, the switching computer simply copies the digitized bits that represent the phone conversation to a second line and it is impossible to tell whether a line is being tapped. A well designed tap installed on a phone wire can be difficult to detect. The noises that some people believe to be telephone taps are simply crosstalk created by the coupling of signals from other phone lines.

Data on the calling and called number, time of call and duration, will generally be collected automatically on all calls and stored for later use by the billing department of the phone company. This data can be accessed by security services, often with fewer legal restrictions than for a tap. This information used to be collected using special equipment known as pen registers and trap and trace devices and U.S. law still refers to it under those names. Today, a list of all calls to a specific number can be obtained by sorting billing records. A telephone tap during which only the call information is recorded but not the contents of the phone calls themselves, is called a Pen Register tap.

For telephone services via digital exchanges, the information collected may additionally include a log of the type of communications media being used (some services treat data and voice communications differently to conserve bandwidth).

Unofficial use
It is also possible to tap conversations unofficially. There are a number of ways to monitor telephone conversations:

Recording the conversation - the person making/receiving the call records the conversation using a coil tap ('telephone pickup coil') attached to the ear-piece, or they fit an in-line tap with a recording output. Both of these are easily available through electrical shops. A more modern alternative is to use telephone recording devices connected to computers, such as PhoneValet Message Center. Most who record telephone conversations, such as journalists, will refer to the recording for their work.

Direct line tap - this is what the state used to do via the telephone exchange. But unofficial tapping, where the user's line is physically tapped near the house, is also possible. The tap can either involve a direct electrical connection to the line, or an induction coil. An induction coil is usually placed underneath the base of a telephone or on the back of a telephone handset to pick up the signal inductively. With a direct connection, there will be some drop in signal levels because of the loss of power from the line, and it may also generate noise on the line. A well designed induction tap does not drain voltage or current from the line because it isn't physically connected to the phone line. Direct taps sometimes require regular maintenance, either to change tapes or replace batteries, which may give away their presence.

Radio tap - this is like a bug that fits on the telephone line. The state does not normally do this because they have access via the telephone exchange, though certain organizations exempt from the common framework of law applying to citizens may use devices like this. It can be fitted to one phone inside the house, or outside on the phone line. It may produce noise (there might even be signal feedback on the monitored line on poorly made equipment) to inadvertently alert the caller. Modern state of the art equipment operates in the 30-300 GHz range. The unit is powered from the line to be maintenance free, and only transmits when a call is in progress. These devices tend to be low powered because the drain on the line would become too great, however a state of the art receiver could be located as far away as ten kilometers under ideal conditions, but is usually located within a radius of 1 to 3 km. Research however has also shown that a satellite can be used to receive emissions in the range of a few milliwatts.

To guard against unofficial amateur line taps, the phone should be regularly inspected, and the telephone line should be checked for new joints, or small wires connected to the line; a time-domain reflectometer is a worthy tool here. If you have reason to suspect your phone has been tapped consult a technical surveillance countermeasures (TSCM) specialist. Never contact a TSCM specialist from a phone you suspect is tapped or on any other phone on the premises or any other phone that is linked to you or your organization (home phone, company cellular, etc.).

• Backdoor.
A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication or securing remote access to a computer, while attempting to remain hidden from casual inspection. The backdoor may take the form of an installed program (e.g., Back Orifice or the Sony/BMG rootkit backdoor installed when any of millions of Sony music CDs were played on a Windows computer), or could be a modification to a legitimate program.

• IMSI Catcher.

An IMSI catcher is a device for intercepting GSM mobile phones. It subjects the phones in its vicinity to a man in the middle attack, acting to them as a preferred base station in terms of signal strength.