It's really too bad the specifics of the machine weren't shared. I'm not speaking from a national security perspective, where it should be mentioned that other nations most likely already obtained this information, but rather from an academic perspective. It seems that there are a lot of questions regarding the machine, its purpose for instance, and such questions could best be answered by public study.
NYU Accidentally Exposed Military Code-Breaking Computer
31–40 of 65 posts
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#32It's really too bad the specifics of the machine weren't shared. I'm not speaking from a national security perspective, where it should be mentioned that other nations most likely already obtained this information, but rather from an academic perspective. It seems that there are a lot of questions regarding the machine, its purpose for instance, and such questions could best be answered by public study.
Ps I loved the part where NYU mailed Adam a poster in recognition of not sharing this.
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#33The very fact that the government invests substantially in brute-forcing encryption means that there are enough weak implementations to make it worthwhile.
Food for thought.
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#34Earlier quoted context omitted.
This is off the top of my head and I'd welcome correction: Large scale password cracking has a much clearer payoff than attacks on 1024 bit DH, which have to be targeted to individual (probably TLS) connections. The RSA that most of the Internet depends on is brokered by CAs --- so, problem 1, the USG already owns CAs and doesn't need supercomputers to get valid certificates, problem 2, the most valuable "authentic"…
I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger ever effectively say "Please tell me the secret whose SHA256 is equal to fcdf324499312efa027b5033513b0c0968f74ae7ba81a271ae62b3dda2cd4143 in order to proceed"? Maybe protocols where the attacker has access to a signature over some data, but doesn't get access t…
Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be.
If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#35Nothing in this article remotely qualifies as news. IBM builds computers, fast ones, to crack passwords for the US DOD. They engage with academia to apply research in building and programming them. Is that surprising? Even if it were, there's not even a source document in the article. Snoozefest.
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#36I miss reading things without reading the word snowden
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#37Earlier quoted context omitted.
Sorry to see you conclude the piece, or that portion, is malpractice :-\ The paragraph you quote was intended to give an overview of one type of work a machine like WindsorGreen might do, in broad terms. While it's true we mention RSA as a very basic example of the sort of thing a government would be /interested/ in breaking, we also specifically quote a security researcher saying WindsorGreen “might also have applic…
I'm guessing Thomas thinks that only problems that supercomputers can, in fact, usefully attack should be mentioned as the likely targets of this computer. :-) Although the experts quoted only mention 1024-bit keys as targets of attack, the particular paragraph that Thomas mentioned really seems to suggest that RSA in general may be within reach. The worst problem is the last two sentences: > Luckily for those using…
This exactly. Thanks for saying it more clearly than I could.
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#38Looks like someone needed more sticky notes. "This drive is a backup of a secret government supercomputer. Do not mount as a share."
A la CERN: https://upload.wikimedia.org/wikipedia/commons/3/37/CERN-fir...
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#39Nothing in this article remotely qualifies as news. IBM builds computers, fast ones, to crack passwords for the US DOD. They engage with academia to apply research in building and programming them. Is that surprising? Even if it were, there's not even a source document in the article. Snoozefest.
The point of the article is that these resources were exposed without authorization, intentional or not, to the public internet.
Re: NYU Accidentally Exposed Military Code-Breaking Computer
#40Earlier quoted context omitted.
I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger ever effectively say "Please tell me the secret whose SHA256 is equal to fcdf324499312efa027b5033513b0c0968f74ae7ba81a271ae62b3dda2cd4143 in order to proceed"? Maybe protocols where the attacker has access to a signature over some data, but doesn't get access t…
Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be. If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.
I'd guess something like Quantum Insert + targeting unprotected connections. Which I'd imagine there are still a lot of out there (circa pre-2000).
I'd be curious if there's any older network gear that provides a hash-based rather than connection-based security model. It seems like the thing that might have seemed like a good idea to a military 40 years ago.