| Bruce Schneier | |
|---|---|
| Born | January 15, 1963 [1] New York |
| Residence | United States |
| Citizenship | American |
| Fields | Computer science |
| Institutions | Counterpane Internet Security Bell Labs United States Department of Defense BT Group |
| Alma mater | American University University of Rochester |
| Known for | Cryptography, security |
Bruce Schneier ( /ˈʃnaɪər/; born January 15, 1963[1]) is an American cryptographer, computer security specialist, and writer. He is the author of several books on general security topics, computer security and cryptography, and is the founder and chief technology officer of BT Managed Security Solutions, formerly Counterpane Internet Security, Inc. He received his master's degree in computer science from the American University in Washington, D.C. in 1988.[2] He was awarded an honorary Ph.D from the University of Westminster in London, England in November 2011. The award was made by the Department of Electronics and Computer Science in recognition of Schneier's 'hard work and contribution to industry and public life'.
Contents |
In 1994, Schneier published "Applied Cryptography", which details the design, use, and implementation of cryptographic algorithms. More recently he published "Cryptography Engineering", which is focused more on how to use cryptography in real systems and less on its internal design. He has also written books on security for a broader audience. In 2000, Schneier published Secrets and Lies: Digital Security in a Networked World. In 2003, Schneier published Beyond Fear: Thinking Sensibly About Security in an Uncertain World.
Schneier writes a freely available monthly Internet newsletter on computer and other security issues, Crypto-Gram, as well as a security weblog, Schneier on Security.[3] The weblog started out as a way to publish essays before they appeared in Crypto-Gram, making it possible for others to comment on them while the stories were still current, but over time the newsletter became a monthly email version of the blog, re-edited and re-organized.[4] Schneier is frequently quoted in the press on computer and other security issues, pointing out flaws in security and cryptographic implementations ranging from biometrics to airline security after the September 11 attacks. He also writes "Security Matters", a regular column for Wired Magazine.[5]
Schneier revealed on his blog that in the December 2004 issue of the SIGCSE Bulletin, three Pakistani academics, Khawaja Amer Hayat, Umar Waqar Anis, and S. Tauseef-ur-Rehman, from the International Islamic University in Islamabad, Pakistan, plagiarized an article written by Schneier and got it published.[6] The same academics subsequently plagiarized another article by Ville Hallivuori on "Real-time Transport Protocol (RTP) security" as well.[6] Schneier complained to the editors of the periodical, which generated a minor controversy.[7] The editor of the SIGCSE Bulletin removed the paper from their website and demanded official letters of admission and apology. Schneier noted on his blog that International Islamic University personnel had requested him "to close comments in this blog entry"; Schneier refused to close comments on the blog, but he did delete posts which he deemed "incoherent or hostile".[6]
To Schneier, peer review and expert analysis are important for the security of cryptographic systems.[8] Mathematical cryptography is usually not the weakest link in a security chain, but effective security requires that cryptography be combined with other things.[9]
Schneier is critical of digital rights management (DRM) and has said that it allows a vendor to increase "lock in."[10] Proper implementation of control-based security for the user via trusted computing is very difficult, and security is not the same thing as control.[10]
Schneier has said that homeland security money should be spent on intelligence, investigation, and emergency response.[11] Defending against the broad threat of terrorism is generally better than focusing on specific potential terrorist plots.[11] According to Schneier, analysis of intelligence data is difficult but is one of the better ways to deal with global terrorism.[12] Human intelligence has advantages over automated and computerized analysis, and increasing the amount of intelligence data that is gathered does not help to improve the analysis process.[12] Agencies that were designed around fighting the Cold War may have a culture that inhibits the sharing of information; the practice of sharing information is more important and less of a security threat in itself when dealing with more decentralized and poorly funded adversaries such as al Qaeda.[13]
Schneier has criticized security approaches that try to prevent any malicious incursion, instead arguing that designing systems to fail well is more important.[14] The designer of a system should not underestimate the capabilities of an attacker; technology may make it possible in the future to do things that are not possible at the present.[8] Under Kerckhoffs's Principle, the need for one or more parts of a cryptographic system to remain secret increases the fragility of the system; whether details about a system should be obscured depends upon the availability of persons who can make use of the information for beneficial uses versus the potential for attackers to misuse the information.[15]
Schneier is a proponent of full disclosure, i.e. making security issues public.
Schneier and Karen Cooper were nominated in 2000 for the Hugo Award, in the category of Best Related Book, for their Minicon 34 Restaurant Guide, a work originally published for the Minneapolis science fiction convention Minicon which gained a readership internationally in science fiction fandom for its wit and good humor.[18]
Schneier has been involved in the creation of many cryptographic algorithms.
Hash functions:
Stream ciphers:
Pseudo-random number generators:
Block ciphers: