Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the CIA WikiLeaks Dump Tells Us: Encryption Works

nytimes.com

Post reply on HN
Print view View original

141–150 of 270 posts

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#141

Post by SAI_Peregrinus »

patrickaljord wrote: post #71
jfhcc wrote: post #36

It's possible defeating encryption is the responsibility of another top secret department whose work remains unleaked.

Breaking pgp like encryption would require a huge mathematical breakthrough in how prime numbers work and their discovery. It would also require unknown math geniuses to work for said secret department which is unlikely, most of the best mathematical geniuses are already known and tend to work at universities/public research/private research and publish their work there. Not saying this is impossible but it's really…

The NSA is the single largest employer of mathematicians in the US. The Snowden leaks did not include any of the data from the departments actually involved in attacking cryptography. All we really know is that they don't have any breaks for their low-level mass surveillance tools.

Likewise with the CIA. From the 1% of the documents leaked so far, there's no evidence that they have the ability to crack modern encryption. But the documents leaked seem to come from a contractor (or were shared with a contractor) so there are likely internal-use-only tools with greater capability than shown in this leak.

That's not to say that they definitely have ways to break modern crypto, just that we can't prove that they don't given the material publicly known so far.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#142

Post by snakeanus »

jacquesm wrote: post #134
snakeanus wrote: post #126

Earlier quoted context omitted.

I am not claiming that you can though.

Then you probably meant to start a new thread. The one you are replying to is about encryption exclusively.

Nope, the poster I replied to talked about asymmetric crypto in general, which includes signatures.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#143

Post by Kadin »

andai wrote: post #70

Does anyone here have an air-gapped computer setup? I'm thinking of doing something with raspberry pi. I'm stuck at the part where it communicates (for my purposes, small amounts of ascii) with a non airgapped computer without using USB or networking. I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. Why, you may be wondering? 1. Airgapped sy…

That doesn't make sense. Once you connect it to the rest of the network, it's no longer "air gapped".

The phrase "air gapped" doesn't signify something special about air, it refers specifically towards breaking the connection (which is typically electrical) between that system and the rest of the network. Perhaps it is not the best term, and "completely isolated" would be better.

If you set up an IR LAN, or use sound, or whatever, then the system is no longer air gapped and you have created a potential vector for information leakage and potential penetration. Sure, probably nobody is going to bother, if the implementation is unique and nothing you have on that system is of particular value, but there have been a number of high-profile compromises of "air gapped" systems and networks (e.g. Iranian nuclear production facilities), that show it can be done even without an intentional connection if the desire is really there.

There are scenarios where partially isolated systems can offer a real benefit, though. I have periodically seen ideas for logging systems that use a 100BT (not Gigabit) Ethernet connection with the Tx pair cut, so that traffic can only ever go INTO the system and never back out again. The system sits on the far side of this one-way hardware gate, listening and logging, and is extremely difficult (although not impossible) to compromise because of the lack of feedback. Note if you want to do this, you need to use old 10 or 100BT network cards that don't have GigE capability, because I believe GigE uses all the pairs in the Ethernet cable in unpredictable ways; you don't have the old Tx pairs / Rx pairs / shield pairs like you used to be able to count on (and selectively cut). I think you'd need to make sure the cards didn't support auto MDIX as well.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#144

Post by smaddox »

Retric wrote: post #129
chimeracoder wrote: post #116

Earlier quoted context omitted.

Could you elaborate? I'm not sure I follow. It's been a while since my CS Theory classes.

Basically, you can do 64 bit calculations on a 16 bit traditional computer, it just takes more steps and some RAM. However, to do 64 bit quantum calculations you need a 64 quibit quantum computer. Now, we may be able to build a 64 QC, bout even that is useless for real world encryption. Further, it while it does not take more time to run a 64vs 4096 quibit QC, it does become exponentially harder to build. Sort of lik…

Good analogy; and quite accurate.

It's not just the number of bits that affects signal to noise ratio, though... It's also the complexity of the calculation; more gate operations and longer storage in memory leads to more quantum decoherence. And AFAIK, each type of calculation must be implemented in hardware, because reversible quantum gates must be used. This means you would need a specialized chip for each algorithm. I haven't confirmed this understanding with someone that specializes in QC, but I don't see a way around it, other than to combine many algos onto a single chip, sharing as many gates as possible, but degrading S/N further.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#145

Post by smaddox »

catshirt wrote: post #97
andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

> the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. pardon my ignorance. but, isn't this an inevitability? not just a possibility?

I would argue no... there's nothing inevitable about technology. Doubly so for quantum computing. Others will likely disagree.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#147

Post by smaddox »

MarkMc wrote: post #37
colordrops wrote: post #10

Earlier quoted context omitted.

It seems that most people are completely in the dark when it comes to security, including myself, but there are some principles that should be unwavering that regularly get ignored again with every new iteration of "secure" software: * If there is a weak layer in the stack, from the physical layer to to UI, then the system is not secure. Even if your messaging app is secure, your messages are not secure if your OS is…

I think you are being too strict in your definition of 'secure'. 99.99% of devices run Android, iOS or Windows which are closed source and therefore not 'secure'. To me, security is not a binary property but rather a sliding scale. WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be telling the truth. No hacker has demonstrated that WhatsApp are lying and the Wikileaks dump su…

Based on my (admittedly limited) understanding of the human condition, it seems like it would be more accurate to say "WhatsApp say they use end-to-end encryption and they have a strong financial incentive to be _lying_."

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#148

Post by Laforet »

smaddox wrote: post #139
mikepurvis wrote: post #132

Earlier quoted context omitted.

Dropbox de-duplicates your files with other users who have the same ones, and are capable of serving them all to you through a web site. There's no encryption there at all, except TLS in transit.

Found that hard to believe, so I googled it. Not positive this is a trustworthy source, but it sounds like Dropbox does use encryption for files at rest and in motion: https://www.virtru.com/blog/dropbox-encryption/

Dropbox is known to have intergration with PhotoDNA, a state program that matches file signature with a database of known illicit images. This would be impossible if the encryption used is irreversible and as far as I know dropbox never claimed otherwise.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#149

Post by Cyph0n »

falcolas wrote: post #136
Cyph0n wrote: post #127

Earlier quoted context omitted.

TLS implements PFS (perfect forward secrecy) by generating an ephemeral asymmetric key pair for the session, usually through DH. In other words, breaking the session key pair will only reveal the plaintext of the current session for the current client. No previous communication is broken, so the NSA would have to traverse the history for each client.

And for a target of interest, given quantum computing, it would not really provide any real protections. I could see how recalculating the key would be well worth it, if you really want the data.

Agreed, it won't help much in that case.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#150

Post by smaddox »

Laforet wrote: post #148
smaddox wrote: post #139

Earlier quoted context omitted.

Found that hard to believe, so I googled it. Not positive this is a trustworthy source, but it sounds like Dropbox does use encryption for files at rest and in motion: https://www.virtru.com/blog/dropbox-encryption/

Dropbox is known to have intergration with PhotoDNA, a state program that matches file signature with a database of known illicit images. This would be impossible if the encryption used is irreversible and as far as I know dropbox never claimed otherwise.

I'm not claiming it is end-to-end, nor did I expect it to be, but perhaps some people would assume that. I thought you were claiming they don't use encryption at all.
Post reply on HN