Bruce Schneier is reporting that the SHA-1 hash algorithm has been broken:

The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu (mostly from Shandong University in China) have been quietly circulating a paper describing their results:

• collisions in the the full SHA-1 in 2**69 hash operations, much less than the brute-force attack of 2**80 operations based on the hash length.
• collisions in SHA-0 in 2**39 operations.
• collisions in 58-round SHA-1 in 2**33 operations.

This attack builds on previous attacks on SHA-0 and SHA-1, and is a major, major cryptanalytic result. It pretty much puts a bullet into SHA-1 as a hash function for digital signatures (although it doesn't affect applications such as HMAC where collisions aren't important).

So, on the Treo 650, when you enable a mail account for Exchange ActiveSync, it warns you that creating the account will empty your calendar-- if you use EAS, you have to use it to sync your calendar. I knew that, and had been manually forcing my desktop to overwrite the handheld calendar. This worked fine until (drum roll) I forgot to set the "desktop overwrites handheld" flag as a default. This morning, I synced the device and-- oops-- almost all of my calendar data is now gone. This is not the end of the world, since we're coming up to a slow time of year. I still have all of my contact and task data, but it'll be a hassle to re-enter the events I do have (including kids' holiday parties at school and my regular weekly team concalls).

From the "I hate it when that happens" department: there's a vuln in the BlackBerry software (at least in the 7230 model) that can be used to cause the device to reboot on demand. The problem is triggered by >128Kb of text in the "Location" field of a meeting request. As RIM points out, Outlook limits that field to 255 characters, so you'd have to hand-craft attack messages. However, these messages don't do permanent damage; they just cause annoying reboots.

RIM confirms that they've already fixed this for version 3.8 of the handheld software, and that they will be adding a filter on their server-side software versions to keep these messages from getting to the device in the first place. It does raise the interesting question of what other vulns might exist in the RIM devices (as well as those from Good, Palm, and Microsoft).

Inaugurating a new category for security mistakes, we have this story from Computerworld. Seems that the Los Alamos National Laboratory has had a little email security problem, on top of their other recent problems:

In the latest incident, lab spokesman Kevin Roark late yesterday confirmed a Los Angeles Times report that the lab recently discovered new incidents of classified information being sent through a nonclassified e-mail system.

"We have had occurrences recently, yes," Roark said. "We have had them in the past. It's anticipated we will have them in the future."

I hate it when that happens. This particular set of incidents apparently happened because of something called aggregate classification: factoids A, B, and C may not be classified, but put them together and they are! For example, knowing the thermal output of an aircraft carrier's nuclear reactor would let you estimate its maximum speed pretty well. The diameters of various inlet and outlet pipes aren't themselves classified, but the specs for the reactor piping as a whole is. Make sense? Yeah, me neither. Anyway, it's hard to purge the classified content from the mail system; that's actually the topic of an upcoming UPDATE column, but in the meantime suffice it to say that you'll probably need a third-party tool, since AFAIK none of the existing enterprise messaging systems on the market offer built-in keyword scanning across multiple mailboxes or stores.