Beyond cryptography: threats before and after

Cryptography is a powerful tool for computer and computer network security. This paper explores threats, other than cryptanalysis, to systems using cryptography for privacy and authentication. Even systems using the strongest cryptographic methods can be vulnerable to upstream and downstream threats, i.e. threats before and after cryptographic protection. Examples of such threats are described, with emphasis given to keystroke capture and hijacking threats. Vulnerabilities of various operating systems and routable protocols are detailed. It is shown that secure session authentication requires both secure user authentication and secure computer authentication