STE WILLIAMS

We – as in, both the public and private sectors – are under the delusion that emailing content as password-protected .zip files is a secure way to share files, Senator Ron Wyden said in a letter sent to the National Institute of Standards and Technology (NIST) on Wednesday.

That’s just one of the non-secure ways that government agencies are sharing sensitive data, he said, because they don’t know how else to do it.

Government agencies routinely share and receive sensitive data through insecure methods – such as emailing .zip files – because employees are not provided the tools and training to do so safely.

That’s where you come in, Wyden said in the letter to NIST Director Walter G. Copan, asking that NIST come up with guidance on how to safely share sensitive documents with others over the internet. We need some help, Wyden said, given that it’s commonly thought that passwords protect .zip files… which they don’t.

Wyden noted that off-the-shelf hacking tools can be used to easily break into password-protected .zip files, since…

… many of the software programs used to create .zip files use a weak encryption algorithm by default.

But it’s password protected!

Wyden’s absolutely right, concurred Matthew D. Green, a cryptography associate professor at Johns Hopkins University. As he said in a Twitter thread, on many old versions of Windows, when you password-protect/”encrypt” a Zip file with the operating system’s default utility, it’s done with the crusty, old, broken legacy scheme.

Senator Wyden asks NIST to develop standards for safely sending and receiving files. This would be a modern and sec… twitter.com/i/web/status/1…

—
Matthew Green (@matthew_d_green) June 19, 2019

Green referred to a known plaintext attack on the PKZIP stream cipher. That scheme is the default Zip encryption algorithm on Windows XP and current versions of MacOS, Green said. Microsoft removed it on more recent versions of Windows Home.

Even if you use a modern Zip utility, “you’re still dealing with modestly crummy crypto,” he said. And that’s the dusty, fusty old junk with which government employees are emailing sensitive data with:

We cryptographers are arguing over PGP key sizes. Meanwhile government employees are emailing each other documents encrypted with a cipher that was handily broken in the 90s.

It’s proposal time

Green welcomed Wyden’s request, saying that it presents a…

… huge opportunity for smart people in this field to come up with something much better.

Adam Langley, a senior staff software engineer for Google who works on its HTTPS serving infrastructure and Chrome’s network stack, agreed. He said this could be a fine chance for NIST to get some new thinking with regards to secure file sharing:

I hope they ask for proposals. There are a number of valuable ideas in this space (Firefox Send, minilock, probably Filippo has something).

We’re at risk if we don’t do something

It’s bad enough that the government has to contend with hostile states cyber-stalking the government and cyber-targeting US infrastructure.

We shouldn’t also be using broken encryption schemes and leaving sensitive data vulnerable by insecure file-sharing workflows. It leaves us open to yet more data breaches and cyber attacks. From Wyden’s letter:

The government must ensure that federal workers have the tools and training they need to safely share sensitive data.

To address this problem, I ask that NIST create and publish an easy-to-understand guide describing the best way for individuals and organizations to securely share sensitive data over the internet.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/GUVefxhuBvg/