The NSA's Backdoor in Dual EC • Hacker News Board

Re: The NSA's Backdoor in Dual EC

#21

Post by markus_zhang » Fri, Sep 03, 2021, 3:08 PM UTC

dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

There is no good/bad guy in this scenario if you model the world in a way such that there are people who have and people who don't.

Re: The NSA's Backdoor in Dual EC

#22

Post by JasonFruit » Fri, Sep 03, 2021, 3:13 PM UTC

This bit stuck out to me:

> The second lesson is that “serious” people are always inclined away from worst-case predictions. In bridge building and politics you can listen to those people. But computer security is adversarial: the conscious goal of attackers is to bring about worst-case outcomes.

Are they suggesting that bridge-building and politics are not adversarial? It seems to me that bridges and politics are weak points that are frequently attacked.

Or am I missing sarcasm?

Re: The NSA's Backdoor in Dual EC

#23

Post by trasz » Fri, Sep 03, 2021, 3:16 PM UTC

perihelions wrote: post #8

I don't understand the significance of the Dual EC vulnerabilities here. The attackers had write access to the target's crypto code, and altered it to their convenience. What cryptosystem is secure against that threat model? That the "re-keying" edit fits in 32 bytes is a neat math trick, but doesn't seem to me like a central issue. What am I misunderstanding? > "In practice this would simply mean hacking into a majo…

The central issue was that the algorithm was backdoored in the first place, by NSA.

Re: The NSA's Backdoor in Dual EC

#24

Post by not2b » Fri, Sep 03, 2021, 3:17 PM UTC

Y_Y wrote: post #3

> the field is called computer security; not computer optimism I'd like to go even further and propose the following terms: * computer wishful thinking * security by credulity * zero-skepticism proof

The NSA actually had their own term for this, NOBUS, which meant "nobody but us". They were fond of attacks that they thought nobody but the NSA could exploit. They were arrogant enough to think they were better than all adversaries.

Re: The NSA's Backdoor in Dual EC

#25

Post by troyvit » Fri, Sep 03, 2021, 3:17 PM UTC

ackbar03 wrote: post #10

bob1029 wrote: post #4

Calling out the cryptographic community on this has always resulted in becoming tarred & feathered in my experience. "How dare you question these experts? You are not a cryptographer." No, I am not. But, I understand information theory and people. I don't need an ivory tower credential to call out potential bullshit or leverage my own intuition. This kind of nonsense also makes me wonder how many of those "dont roll…

Then you my friend are free to roll your own crypto

Not that I sanction all of the parent's post, but for instance Telegram did exactly that, and they still receive grief for rolling their own crypto. So per the parent you can either use back-doored state-sponsored encryption or roll your own which nobody trusts. Which is better? Is there another alternative?

Re: The NSA's Backdoor in Dual EC

#26

Post by sjaak » Fri, Sep 03, 2021, 3:18 PM UTC

marcan_42 wrote: post #16

jokoon wrote: post #13

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography. I've heard the NSA is one of the biggest employer of math people. At that point, I'm guessing some form of obscurity might somehow be a better idea to protect data from the NSA, or at least it would force NSA employees to analyze some obfuscated data, buying more time than just using mainstre…

This has nothing to do with brain power. This was a deliberately backdoored algorithm that any cryptographer familiar with elliptic curve cryptography could've come up with. It wasn't even good or clever, seeing as people saw through it almost immediately. The only thing it had going for it is it was plausibly deniable and that allowed the US government to force people to implement it, since nobody could prove the NS…

> Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography.

Unless they're one step ahead here and they want us to think that which is why they add backdoors knowing that years later that knowledge will become public, giving us all a reason to think they cannot break modern crypto.

Re: The NSA's Backdoor in Dual EC

#27

Post by not2b » Fri, Sep 03, 2021, 3:21 PM UTC

bob1029 wrote: post #4

Calling out the cryptographic community on this has always resulted in becoming tarred & feathered in my experience. "How dare you question these experts? You are not a cryptographer." No, I am not. But, I understand information theory and people. I don't need an ivory tower credential to call out potential bullshit or leverage my own intuition. This kind of nonsense also makes me wonder how many of those "dont roll…

But the cryptographic community was RIGHT on this, with at least six papers from respected researchers raising concerns back around 2007. It was businesses (like RSA and Juniper) that overrode these concerns under pressure.

Re: The NSA's Backdoor in Dual EC

#28

Post by marcus_holmes » Fri, Sep 03, 2021, 3:21 PM UTC

bob1029 wrote: post #15

ackbar03 wrote: post #10

Earlier quoted context omitted.

Then you my friend are free to roll your own crypto

Just so we are clear, rolling my own crypto doesnt necessarily involve reinventing SHA256 and AES from scratch. It just means using these primitives directly rather than farming out and allowing others to select the underlying methods for you. I use Microsoft's cryptographic implementations, but I don't let them pick the method for me. I don't think this is unreasonable if you have some experience in the space.

It's that old saw of "anyone can create a security system that they can't break". How do you know that your combination of methods is secure?

There may well be hidden (or at least non-obvious) complications with using certain methods and/or implementations together that make them easier to break. If you're not aware of that, but someone else is, then the first you'll know about it is years later when a security leak is traced back to your "secure" system. And the only other way of knowing about this sort of stuff is to spend a lot of time staying current with the research.

Or you can let someone else do all that hard work, and run the extremely small risk that their work has been silently compromised by the NSA (or other state actor of your choice).

Re: The NSA's Backdoor in Dual EC

#29

Post by dleslie » Fri, Sep 03, 2021, 3:22 PM UTC

markus_zhang wrote: post #21

dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

There is no good/bad guy in this scenario if you model the world in a way such that there are people who have and people who don't.

Sure there is!

There are people who act with malice and sadism, people driven to harm others, people overwhelmed by greed and people consumed by a lust for power. And there are people who devote their lives to aiding others, people who are mindful of their community's needs, people who take opportunities to help others over opportunities to help themselves.

All these sorts can be found across the whole spectrum of wealth.

Re: The NSA's Backdoor in Dual EC

#30

Post by marcan_42 » Fri, Sep 03, 2021, 3:22 PM UTC

bob1029 wrote: post #15

ackbar03 wrote: post #10

Earlier quoted context omitted.

Then you my friend are free to roll your own crypto

Just so we are clear, rolling my own crypto doesnt necessarily involve reinventing SHA256 and AES from scratch. It just means using these primitives directly rather than farming out and allowing others to select the underlying methods for you. I use Microsoft's cryptographic implementations, but I don't let them pick the method for me. I don't think this is unreasonable if you have some experience in the space.

Putting together primitives in a way that doesn't have subtle flaws is not trivial. Many a standard have been vulnerable due to this. You think you can do better?

We do have simple, well engineered, and sometimes even probably secure constructions. Look at libsodium if you want a decent example of what a modern library looks like.

And stay away from anything that mentions the words NIST, FIPS, or any other government acronym. You aren't going to find modern, well-engineered, simple crypto in anything catering to that market. It's always hideously overcomplicated and rife with chances for bugs.