Cryptanalyst Marc Stevens from the Centrum Wiskunde & Informatica (CWI) in Amsterdam published on 15 August open source software that can detect and block forged digital signatures: CWI's hash collision detection library. The use of digital signatures is very common: secure websites, documents, email and other software can contain them. It is therefore very important to identify forged signatures and to ward off cyber attacks that use them – like the recent super malware Flame. To enable this, Stevens developed platform independent software that can easily be incorporated in existing software for processing digital signatures.
Marc Stevens is known worldwide for breaking the https security in 2008 and the analysis of the Flame virus in 2012. With advanced mathematics he showed that the widely used MD5 and SHA-1 security standards were not safe anymore. For this research he received the Martinus Van Marum Prize 2013 of the Royal Holland Society of Sciences and Humanities (KHMW) earlier this summer.
The analysis software the CWI researcher now releases is unique in the world. Several companies already work on an implementation. "With my mathematical analysis and software I was the first to unravel the cryptanalytic attack in the Flame virus. To protect the internet against similar future cyber-attacks, I would like to share my results with more people", the researcher says. “That's why I made the software open source available.” Stevens made a preliminary announcement of the publication during the hacker conference OHM earlier this month.
The URI of the new software is http://www.cwi.nl/research/cwi-cryptanalysis.
More information:
- Cryptanalysis webpage with a link to CWI's hash collision detection library software
- press release Martinus van Marum Prize
- press release Flame-analysis (2012) en Stevens' PhD research at CWI
- press release on breaking the https security (2008)
Pictures: Shutterstock.
