Daniel Cuthbert’s Post

Security Researcher

4mo

In December, we published our joint research with Microsoft and GitHub on performing static analysis of the top 5000 open source repositories from a cryptographic perspective https://lnkd.in/eb-38hMt That was the start. If you have access to source code, you too can work out if it is Post-Quantum safe and ready, but what if you don't? What if you had a vendor product whereby you need to ascertain if it is indeed doing cryptography in a modern(ish) way? Well this is what we are hoping to address in this release. CryptoMon is a service that allows the interception and analysis of over-the-wire TLS cryptography by Mark Carney and we hope that it is used by all to better understand what is happening at a cryptographic level. The more we know about what cryptography is in use all in supply chains, networks, devices, embedded devices and so much more, the better off we all are. https://lnkd.in/ehNeCj2D

Post-Quantum Cryptography PQC

csrc.nist.gov

12 Comments

Vladimir Cicović

DevOps | GitOps | Expert for Trumpet Winsocket on Windows 3.11

4mo

so we do not use the internet until we get these anti-quantum algos, right?

Fredrik (Freddie) Hult

Innovation | Digital Products | Chief Information Security Officer (CISO) at PagoNxt.tech making the lives of 150 million people a bit better

4mo

Great job and you have killed a few startups and large corps along the way that aim to do exactly this. Kudos!

3 Reactions

Inbar Badian

Cybersecurity Innovation | Quantum Security | Strategy & Product Incubation

4mo

The best Daniel Cuthbert Mark Carney 👑

2 Reactions

Mark Carney

Head of Quantum Tech @ Santander Global (CSR) || Mathematician || Quantum Hacker || Created CryptoMon

4mo

Pinging some potentially interested peeps: Bill Newhouse Evgeny Gervis Zygmunt Lozinski John Buselli Lory Piccirilli Thorpe Michael Osborne Benjamin Rodes Inbar Badian Itan Barmes Anne Ardon 👩🏻💻 Filipe Beato - I think these tools might be a handy tool for various activities I know are going on for PQC discovery; code and network scanning are two significant components of a good CBOM analysis coverage, and we'd love to hear people's thoughts. :)

7 Reactions

🔐Tiago Q.

4mo

Great work Daniel Cuthbert and Mark Carney - thanks for making CryptoMon available to anyone who wishes to use it.

1 Reaction

See more comments

To view or add a comment, sign in

More Relevant Posts

Mark Carney

Head of Quantum Tech @ Santander Global (CSR) || Mathematician || Quantum Hacker || Created CryptoMon
4mo
Report this post
This was an excellent project to work on - whilst CodeQL can show you what cryptography your code supports, and filesystem analysis can show you what certificates etc. you have, only a passive network analysis will show you what cryptography is actually in play! So that's what we did... 📍The concept is really simple - using eBPF loaded by a python script, we can passively monitor for TLS and SSH traffic. If we find either, we take the packet and extract data from it. 💡 The analyser doesn't just look at HTTPS and SSH - it also looks at port 990 (FTPS), 3389 (RDP) and some proxy ports as well to give a fuller picture of the cryptography that is in play on a network. 🕵🏻♂️ But what can we see? Well, we can see client TLS ciphersuite offerings, we can see server ciphersuite confirmation, we can see certificates (TCP fragmentation permitting), SSH KEX and cipher negotiations, and in the future hopefully more! 📋 The aim is to gather as much information as we can to enrich our picture of cryptography that we use, for #DORA #PCIDSS, #PQC migration, and much more.

Daniel Cuthbert

Security Researcher
4mo

In December, we published our joint research with Microsoft and GitHub on performing static analysis of the top 5000 open source repositories from a cryptographic perspective https://lnkd.in/eb-38hMt That was the start. If you have access to source code, you too can work out if it is Post-Quantum safe and ready, but what if you don't? What if you had a vendor product whereby you need to ascertain if it is indeed doing cryptography in a modern(ish) way? Well this is what we are hoping to address in this release. CryptoMon is a service that allows the interception and analysis of over-the-wire TLS cryptography by Mark Carney and we hope that it is used by all to better understand what is happening at a cryptographic level. The more we know about what cryptography is in use all in supply chains, networks, devices, embedded devices and so much more, the better off we all are. https://lnkd.in/ehNeCj2D

Post-Quantum Cryptography PQC

csrc.nist.gov

1 Comment
Like Comment
To view or add a comment, sign in
Jaime Gómez García Jaime Gómez García is an Influencer

Head of Quantum, Banco Santander | Chair of the Quantum Safe Financial Forum Steering Committee | Representative at EU Quantum Industry Consortium, AMETIC | Speaker | LinkedIn QuantumTopVoices 2022-2024
4mo
Report this post
The Santander Cybersecurity Research team with Daniel Cuthbert and Mark Carney continues to opensource useful tools to help discover your cryptography. This is a demonstration of our strong belief that collaboration is needed to address this as a global task. Take a look!

Daniel Cuthbert

Security Researcher
4mo

In December, we published our joint research with Microsoft and GitHub on performing static analysis of the top 5000 open source repositories from a cryptographic perspective https://lnkd.in/eb-38hMt That was the start. If you have access to source code, you too can work out if it is Post-Quantum safe and ready, but what if you don't? What if you had a vendor product whereby you need to ascertain if it is indeed doing cryptography in a modern(ish) way? Well this is what we are hoping to address in this release. CryptoMon is a service that allows the interception and analysis of over-the-wire TLS cryptography by Mark Carney and we hope that it is used by all to better understand what is happening at a cryptographic level. The more we know about what cryptography is in use all in supply chains, networks, devices, embedded devices and so much more, the better off we all are. https://lnkd.in/ehNeCj2D

Post-Quantum Cryptography PQC

csrc.nist.gov

3 Comments
Like Comment
To view or add a comment, sign in
Jan Kulanek 🐺

CISSP, CCSP, Quantum Safe, 12y+ of Enterprise exp
4mo
Report this post
CryptoMon - the best way to verify TLS encryption in use inside of your network! There are many cipher suits available for TLS 1.2 and 1.3, but not all of them are currently strong enough to protect your sensitive data, or meet strong cryptography requirements (PCI DSS). This tool will help you spot your weak points and prepare plan for migration to more secure algorithms, including Quantum Safe TLS suits. Great job Mark Carney and Daniel Cuthbert ! #CryptoMon #TLS #CBOM #SBOM #QuantumSafe #PQC #compliance

Daniel Cuthbert

Security Researcher
4mo

In December, we published our joint research with Microsoft and GitHub on performing static analysis of the top 5000 open source repositories from a cryptographic perspective https://lnkd.in/eb-38hMt That was the start. If you have access to source code, you too can work out if it is Post-Quantum safe and ready, but what if you don't? What if you had a vendor product whereby you need to ascertain if it is indeed doing cryptography in a modern(ish) way? Well this is what we are hoping to address in this release. CryptoMon is a service that allows the interception and analysis of over-the-wire TLS cryptography by Mark Carney and we hope that it is used by all to better understand what is happening at a cryptographic level. The more we know about what cryptography is in use all in supply chains, networks, devices, embedded devices and so much more, the better off we all are. https://lnkd.in/ehNeCj2D

Post-Quantum Cryptography PQC

csrc.nist.gov

1 Comment
Like Comment
To view or add a comment, sign in
Paul Fuegner

Chief Marketing Officer; Strategy, Brand & Growth, Board Advisor || QuSecure, Diageo, Allianz, Forrester, Colgate, Bank of America, Sara Lee, Campari, AMEX
4mo
Report this post
Big day for #PQC and the evolution of #cybersecurity! QuSecure is proud of our #leadership role in advancing #crypto agility with our #quantum resilient software solution QuProtect. To assist organizations in getting started, contact QuSecure as we are offering organizations the following four opportunities: 1. For CISOs: A free road mapping session with QuSecure, the award-winning company in crypto agility with more implementations than anyone to date. 2. For Boards and Executive Team Members: A half-day briefing with Accenture and QuSecure. Learn what others are doing and how to apply what they have learned to your organization. 3. For Organizations Ready to Test Crypto Agility: A #free #POC addressing your choice of Crypto Agility across applications, networks, and routers. 4. For Anyone Looking to Learn More: QuSecure is teaming with PayPal for a webinar on “Protecting Blockchain & Crypto Against Quantum & AI” on Wednesday, August 14, at 1 pm PT/4 pm ET.

John Duigenan
4mo

IBM-Developed Algorithms Announced as World's First Post-Quantum Cryptography Standards LONDON, August 13, 2024 /PRNewswire/ -- Two IBM-developed algorithms (NYSE: IBM) have been officially formalized within the world's first three post-quantum cryptography standards, which were published today by the U.S. Department of Commerce's National Institute of Standards and Technology (NIST). https://lnkd.in/eFhv4Ybs

IBM-Developed Algorithms Announced as World's First Post-Quantum Cryptography Standards

uk.newsroom.ibm.com
Like Comment
To view or add a comment, sign in
Mark McLaughlin

Leading AI, hybrid cloud, and risk innovation engagements with insurance CxOs worldwide for IBM
4mo
Report this post
I'm sure other cyberrisk experts can comment, but I'd expect quantum-safe standards to eventually be a part of insurance cyberrisk coverage requirements and/or rating criteria. For non-insurance people: getting insurance coverage against cyberrisk incidents is going to be harder over the long haul if you cannot demonstrate you are running on secure platforms.

John Duigenan
4mo

IBM-Developed Algorithms Announced as World's First Post-Quantum Cryptography Standards LONDON, August 13, 2024 /PRNewswire/ -- Two IBM-developed algorithms (NYSE: IBM) have been officially formalized within the world's first three post-quantum cryptography standards, which were published today by the U.S. Department of Commerce's National Institute of Standards and Technology (NIST). https://lnkd.in/eFhv4Ybs

IBM-Developed Algorithms Announced as World's First Post-Quantum Cryptography Standards

uk.newsroom.ibm.com
Like Comment
To view or add a comment, sign in
Steven Kellner

Intellectual Property Associate at DLA Piper
4mo
Report this post
This is a HUGE milestone in cryptography. The ability of quantum computers to break RSA encryption with ease was always a bit concerning (to say the least). Hopefully having some guiderails in place will allow quantum development to move forward with speed. https://lnkd.in/ewUSE86y

The first post-quantum cryptography standards are here | TechCrunch

https://techcrunch.com
Like Comment
To view or add a comment, sign in
Yongkook(Alex) Kim

CTO for WW Samsung Strategic Partnership at IBM
2mo
Report this post
IBM is the company working on both solutions, I'd say :) 😀 "Notably, IBM Research cryptography researchers in Zurich developed two of these standards – ML-KEM and ML-DSA –with external collaborators. The third standard – SLH-DSA – was co-developed by a scientist who has since joined IBM Research. Clearly, this is a topic that greatly interests IBM. Considering that IBM is also a leading developer of quantum computers, you could say that the company is working on both the problem and its solution, with respect to cryptography in cyberspace" read more fun article from:

NIST Issues New Quantum Crypto Standards for Cyberspace

https://www.eejournal.com
Like Comment
To view or add a comment, sign in
Piscium

37 followers
4mo
Report this post
NIST has just published 3 post-quantum cryptography standards. They specify algorithms derived from CRYSTALS-Dilithium, CRYSTALS-KYBER and SPHINCS+. These standards were created in order to combat quantum computing threats when using asymmetric encryption methods. It is important to be prepared for a future where quantum computing may become a reality. More information in the following link https://lnkd.in/daZu6wJ

Post-Quantum Cryptography PQC

csrc.nist.gov
Like Comment
To view or add a comment, sign in
Mark Indermaur
5mo
Report this post
Are you planning to implement quantum-safe cryptography? IEEE Spectrum interviewed Scott Best for the "5 Questions" column in the July 2024 issue. "When does the switch to quantum-resistant cryptography need to happen? It will take another eight years to have a quantum computer with 400 logical qubits. That's when a state-funded actor could start breaking traditional encryption using Shor's algorithm. Which systems need to be switched now? Systems which will still be in operation then (8 years from now) should switch to quantum-resistant algorithms now." https://lnkd.in/ecthXm8p https://lnkd.in/ehUp5GWR

Prepping For Post-Quantum Cryptography

spectrum.ieee.org
Like Comment
To view or add a comment, sign in

5,373 followers

View Profile Follow

Daniel Cuthbert’s Post

Post-Quantum Cryptography PQC

csrc.nist.gov

More from this author

Hacker Summer Camp 2024

Memory is a beautiful thing...

Comparison and Evaluation on Static Application Security Testing (SAST) Tools for Java

Explore topics