Excellent read. One example:

Consider the case of basic public key cryptography, in which a person’s public and private key are created together in a single operation. These two keys are entangled, not with quantum physics, but with math.

When I create a virtual machine server in the Amazon cloud, I am prompted for an RSA public key that will be used to control access to the machine. Typically, I create the public and private keypair on my laptop and upload the public key to Amazon, which bakes my public key into the server’s administrator account. My laptop and that remove server are thus entangled, in that the only way to log into the server is using the key on my laptop. And because that administrator account can do anything to that server­read the sensitivity data, hack the web server to install malware on people who visit its web pages, or anything else I might care to do­the private key on my laptop represents a security risk for that server.

Here’s why it’s impossible to evaluate a server and know if it is secure: as long that private key exists on my laptop, that server has a vulnerability. But if I delete that private key, the vulnerability goes away. By deleting the data, I have removed a security risk from the server and its security has increased. This is true entanglement! And it is spooky: not a single bit has changed on the server, yet it is more secure.

Read it all.

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Chenlun’s Evolving Phishing Tactics Target Trusted Brands

October 29, 2024 0 Comments 0 tags

The phishing campaign targeted users via texts impersonating Amazon, linked to the threat actor Chenlun

Microsoft offers updates on 117 vulnerabilities on Patch Tuesday

October 9, 2024 0 Comments 0 tags

Microsoft on Tuesday shared security updates on 117 common vulnerabilities and exposures, including two that are being actively exploited, according to the company. The actively exploited vulnerabilities relate to the

CISA Adds Three Known Exploited Vulnerabilities to Catalog

September 9, 2024 0 Comments 0 tags

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2016-3714 ImageMagick Improper Input Validation Vulnerability CVE-2017-1000253 Linux Kernel PIE Stack Buffer Corruption