Security

Great blog on smartcards deployment

Sergey Simakov — Mon, 20 Nov 2006 19:13:00 GMT

I just found that I've missed a great blog by Steve Patrick (from Critical Problem Resolution team) with invaluable information on SmartCard deployment, so begin with this post - So, you want to use smart cards?. Thanks for sharing this information, Steve! [subscribed]

Consolidation of Managed Security Services market

Sergey Simakov — Wed, 25 Oct 2006 18:09:00 GMT

Well, it didn't take long time after SecureWorks/LURHQ and IBM/ISS deals: British Telecom acquires Counterpane.

Active Directory Certificate Server Enhancements in Windows Server Longhorn RTW

Sergey Simakov — Tue, 24 Oct 2006 19:24:00 GMT

Active Directory Certificate Server Enhancements (aka Windows PKI) in Windows Server "Longhorn" guide by Carsten Kinder with help of PKI PMs was finally released to web. This comprehensive document contains information about new PKI features in Windows Server "Longhorn" such as:

Cryptography API: Next Generation (aka CNG) support in CAs to provide crypto agility
Unattended and integrated interactive setup options (without need to disable AIA in root CA cert)
Certificate templates v3
Restricted Enrollment Agent and Restricted Certificate Managers support (very needed in enterprise scenarios)
many other new features and OCSP standard support

So it's very recommended to study.

BitLocker cryptographic algorithm

Sergey Simakov — Mon, 18 Sep 2006 03:59:00 GMT

FYI - Niels Ferguson posted a link to a document with details about cryptographic algorithm that is used in BitLocker (AES-CBC with a specialized diffuser that improves the security against manipulation attacks) at System Integrity team blog.

Attack on RSA signature implementation

Sergey Simakov — Fri, 08 Sep 2006 17:03:00 GMT

Good description of Daniel Bleichenbacher's attack on RSA signature implementations that may, under some common circumstances, break SSL/TLS in Matasano blog.

Joint architecture for NAP/NAC interoperability announcement

Sergey Simakov — Thu, 07 Sep 2006 01:18:00 GMT

Joint architecture for Microsoft Network Access Protection (NAP) and Cisco Network Admission Control (NAC) interoperability is officially announced at Security Standard conference in Boston. More information is available in Cisco Network Admission Control and Microsoft Network Access Protection Interoperability Architecture whitepaper and NAP team blog.

Interesting blog

Sergey Simakov — Thu, 17 Aug 2006 15:22:00 GMT

I've missed the fact that Kevin Lam from ACE (Application Consulting & Engineering) Team (author of very interesting Accessing Network Security book about penetration testing) is now blogging - subscribed.

Crypto classes

Sergey Simakov — Tue, 23 May 2006 14:41:00 GMT

Michael Howard posted a link to the lecture materials from University of Washington's cryptography class.

And you should pay attention to the lecturers list:

Brian LaMacchia (ex-security architect for the .NET Framework and Common Language Runtime)
Josh Benaloh (senior cryptographer in Microsoft Research)
John Manferdelli (Distinguished Engineer, worked on the TPM stuff at Microsoft.)

BTW, does anyone mentions that v1.1 of KMDF was released? It supports Windows 2000 now, so driver developers position helped =)

Identity management seminar in Moscow

Sergey Simakov — Sun, 26 Mar 2006 16:29:00 GMT

Last month Rafal Lukawiecki (Project Botticelli Ltd) made a very good presentation about 'Identification and access management in heterogeneous enterprise networks' in Moscow Microsoft office (program in russian is available here).

Overview and comparison of Microsoft identity management technologies (MIIS, ADFS) was the most interesting part of this presentation (especially assuming that InfoCard and other plans for future developments in this area from Microsoft was announced at RSA conference at the same day).

Unfortunately presentation is not available for download right now, but I think it'll be available for download from TechNet IT's Showtime section.

SmartCard Base CSP and Windows PKI resources

Sergey Simakov — Wed, 14 Dec 2005 19:22:00 GMT

Yeap, I knew that I forget someting -

David Cross announced on public.security.crypto newsgroup release of the Smart Card Base Cryptographic Service Provider as free download (also available via Windows Update):

Writing a Smart Card CSP has not been trivial. This has been addressed by splitting the CSP architecture to a Base CSP and Card Module architecture. The Base CSP is provided by Microsoft as a part of the platform (with this
Base CSP release).

Card Module is a interface supported by Microsoft for card vendors to write their implementations for the same to their card. This is analogous to writing a printer driver for a printer.
It is this new Card Module architecture that will also be available as a part of Windows Vista. With this release, one of the goals that we want to accomplish is that the same card module works on older platforms and also Vista.

More information available in Shivaram Mysore blog (he is active participant of XML Encryption and XKMS and ex-Sun software architect).

There are also great collection of Windows PKI and cryptography references and links [subscribed].