IEEE Technology and Society Magazine - Fall 2014 - 13

The story of intrigues is not over, although the
NSA fingerprints are less obvious. In April 2014,
the Heartbleed bug was revealed. It results from
a weakness in an OpenSSL, an implementation of
SSL/TLS, the basis of communication security
and privacy over the Internet. It affects the security/privacy of web transactions, email, and instant
messaging. The Heartbleed bug allows anyone on
the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL
software. The bug may compromise the secret keys
used to identify the service providers and to encrypt
their transmissions, the names and passwords of the
users, and the actual message content. This allows
attackers to eavesdrop on communications, steal
data directly from the services and users, and to
impersonate services and users.
We live in dangerous times and our security may
be threatened by many sources. There are legitimate
roles for NSA, but undermining the security of transactions over the Internet seems too high a price to pay.
Perhaps, they should use the front door.

Author Information
Alan Konheim is Professor Emeritus in the Computer Science Department, University of California,
Santa Barbara, CA 93101, U.S.A. Email: konheim@
cs.ucsb.edu.

Acknowledgment
The author acknowledges with thanks the many helpful suggestions, comments, and encouragement made
by Andrew Pickholtz.

References

[1] H.E. Petersen and R. Turn, "System implications of information
privacy," in Proc.AFIPS Spring Joint Computer Conf. AfIPS: 1967,
vol. 30, pp. 291-300.
[2] W. Diffie and M.E. Hellman, "New directions in cryptography,"
IEEE Trans. Information Theory, vol. IT-22, pp. 644-654, Nov. 1976.
[3] R.L. Rivest, A. Shamir, and L. Adelman, "A method for obtaining
digital signatures and public-key cryptosystems," Commun. ACM, vol. 21,
no. 2, pp. 120-126, 1978.
[4] L.M. Kohnfelder, "Towards a practical public-key cryptosystem,"
M.I.T., Cambridge, MA, Bachelor's thesis, May 1978.
[5] X. Wang and H. Yu, "How to break MD5 and other hash functions," in Proc. Advances in Cryptology-Eurocrypt 05. Springer, 2005,
pp. 1-18.
[6] X. Wang, Y. Yin, and H. Yu, "finding collisions in the full SHA-1,"
in Proc.Advances in Cryptology-Crypto 05.Springer, 2005, pp. 17-36.
[7] M. Stevens, A. Sotirov, B. Applebaum, A. Lenstra, D. Molinar,
D.A. Osvik, and B. de Weger, "Short chosen-prefix collisions for
MD5 and the creation of a rogue CA certificate," in Proc. Crypto `09.
Springer-Verlag, 2009.
[8] National Institute of Standards, "Recommendation for random
number generation using deterministic random bit generators," NIST
Special Publication 800-90A, Mar. 10, 2009; updated feb. 14, 2013.
[9] Z. Weissmueller, "Lavabit's Ladar Levison on Snowden, why he
shut down, and how to beat the NSA," reason.com, feb. 28, 2014;
http://reason.com/reasontv/2014/02/28/lavabits-ladar-levison-onsnowden-why-he.
[10] Writing contest - winning entry, Philadelphia Dollar Newspaper,
vol. 1, no. 23, pp. 1-4, June 28, 1843.

Upcoming SSIT Conferences
Visit:
ieeessit.org
for more information on upcoming SSIT-sponsored
and co-sponsored conferences.

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

|

fALL 2014

|

13
http://www.reason.com http://www.reason.com/reasontv/2014/02/28/lavabits-ladar-levison-on http://www.ieeessit.org
Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Fall 2014
