Not to suggest this is what's happening in this particular case, but if the CIA (or any other intelligence agency) did figure out a way to break some particular encryption protocol, wouldn't it be in their best interest to create fake internal documentation claiming they couldn't break that form of encryption, and "leak" that to Wikileaks?
What the CIA WikiLeaks Dump Tells Us: Encryption Works
211–220 of 270 posts
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#212Not to suggest this is what's happening in this particular case, but if the CIA (or any other intelligence agency) did figure out a way to break some particular encryption protocol, wouldn't it be in their best interest to create fake internal documentation claiming they couldn't break that form of encryption, and "leak" that to Wikileaks?
Considering that Wikileaks allegedly has the new malwares that CIA has been using, I think something like that would be part of the slew of documents in Vault 7. Of course, it might be confidential enough for only a select few to know, but I'm just saying it looks to me that the leak is revealing pretty hush-hush stuff.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#213Original article on AP News in case your NY Times free article count is up: https://apnews.com/cf84bf54c2954de8baaa5fb6931a84d0/What-the...
Please consider subscribing to high quality newspapers, donating to NPR, or otherwise supporting journalists. IMHO the last few months have driven home the vital public service they provide. I recently read that Tom Hanks sends an espresso machine to the White House press corps every year, while I've been reading their articles in incognito mode.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#214Earlier quoted context omitted.
It also doesn't have to be a central authority, since "anyone" (meaning: anyone who can afford to operate a mailserver, which is actually a surprisingly-high number) can be such an authority for one's own mail.
Practically nobody is running own mail server these days. Email is extremely centralized
one single actor Let's not make the perfect the enemy of the good.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#215Does anyone here have an air-gapped computer setup? I'm thinking of doing something with raspberry pi. I'm stuck at the part where it communicates (for my purposes, small amounts of ascii) with a non airgapped computer without using USB or networking. I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. Why, you may be wondering? 1. Airgapped sy…
Check out Google Tone:
https://chrome.google.com/webstore/detail/google-tone/nnckeh...
"Broadcast any URL to computers within earshot. Google Tone turns on your computer's microphone (while the extension is on) and uses your computer's speakers to exchange URLs with nearby computers connected to the Internet. You can use Google Tone to send the URL for any web page, including news stories, pictures, documents, blog posts, products, YouTube videos, recipes—even search results. Any computer within earshot (including over a phone or Hangout) that also has the Google Tone extension installed and turned ON can receive a Google Tone notification."
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#216The only encryption I truly trust is one-time pad. Discrete log may be NP-intermediate (if P!=NP, which is open), and we know from the Snowden disclosures that NSA was working with U Maryland on a quantum computer which will be a reality at some point (Shor's algorithm). With 'collect it all,' today's ciphertext is tomorrow's plaintext. Always be skeptical.
If you trust a one-time pad---which no one actually uses---you can trust stream ciphers, which are actually practical.
That doesn't follow at all...
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#217Earlier quoted context omitted.
Found that hard to believe, so I googled it. Not positive this is a trustworthy source, but it sounds like Dropbox does use encryption for files at rest and in motion: https://www.virtru.com/blog/dropbox-encryption/
Dropbox is known to have intergration with PhotoDNA, a state program that matches file signature with a database of known illicit images. This would be impossible if the encryption used is irreversible and as far as I know dropbox never claimed otherwise.
Couldn't dropbox hash the images on the client, and upload the encrypted images as well as the hash? No need to upload an unencrypted file to do matching.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#218I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…
And the NSA apparently doesn't use Asymmetric Crypto for anything for this reason and perhaps others.
Their most secure devices use FIREFLY, a variant of Photurius protocol.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#219Earlier quoted context omitted.
There's an extremely simple method which is to onion multiple algorithms. If you want to add the promised security features of a new algorithm that hasn't been battle-tested it's well worth the effort.
I've never heard of such technique, what does onioning do?
I don't think there is an exact term (and if there is I'm all ears), so the closest one I found pertains to onion routing[1], except instead of each layer being a different key, each layer is a different algorithm and a different key. I.E if you wanted to use algorithm X and algorithm Y, you could encrypt your plaintext with cyphertext_x = X(x_key,plaintext), and then cyphertext = Y(y_key,cyphertext_x). If X is terrible, Y still protects your data. if Y is terrible, X still protects your data. Note that the order in which X and Y are applied doesn't matter.
Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works
#220Earlier quoted context omitted.
I've never heard of such technique, what does onioning do?
I don't think there is an exact term (and if there is I'm all ears), so the closest one I found pertains to onion routing[1], except instead of each layer being a different key, each layer is a different algorithm and a different key. I.E if you wanted to use algorithm X and algorithm Y, you could encrypt your plaintext with cyphertext_x = X(x_key,plaintext), and then cyphertext = Y(y_key,cyphertext_x). If X is terri…
Algorithms composition? (similar to function compositions[1], since algorithms are just function that take an input and return an output.)