Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA's Backdoor in Dual EC

twitter.com

Post reply on HN
Print view View original

41–50 of 95 posts

Re: The NSA's Backdoor in Dual EC

#41

Post by soraminazuki »

khuey wrote: post #11
dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

The attackers didn't get the keys to the back door. They actually replaced the entire door with a new door that they made, which went unnoticed (by Juniper) for 3 years, locking out the owners of the original back door too. It's a rather impressive attack.

From the original link:

> In practice this would simply mean hacking into a major firewall manufacturer’s poorly-secured source code repository, changing 32 bytes of data, and then waiting for the windfall when a huge number of VPN connections suddenly became easy to decrypt. And that’s what happened. 10/

I would definitely not describe replacing 32 bytes as "replacing an entire door."

Re: The NSA's Backdoor in Dual EC

#42

Post by krylon »

Y_Y wrote: post #3

> the field is called computer security; not computer optimism I'd like to go even further and propose the following terms: * computer wishful thinking * security by credulity * zero-skepticism proof

"zero-skepticism proof" is an amazing name. Don't mind if I borrow that from time to time. ;-)

Re: The NSA's Backdoor in Dual EC

#43

Post by reaperducer »

krylon wrote: post #42
Y_Y wrote: post #3

> the field is called computer security; not computer optimism I'd like to go even further and propose the following terms: * computer wishful thinking * security by credulity * zero-skepticism proof

"zero-skepticism proof" is an amazing name. Don't mind if I borrow that from time to time. ;-)

That's the name of my Rage Against the Machine tribute band.

Re: The NSA's Backdoor in Dual EC

#44

Post by [deleted] »

dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

[deleted]

Re: The NSA's Backdoor in Dual EC

#45

Post by dylan604 »

teawrecks wrote: post #36
JumpCrisscross wrote: post #34

Earlier quoted context omitted.

> What does twitter offer that other platforms don't? Its audience.

Twitter has made it too annoying to use their site without an account. I'm no longer part of that audience.

I'm sure Twitter sheds a tear for you and I not being there, but laugh all the way to the bank for the millions that are.

Re: The NSA's Backdoor in Dual EC

#46

Post by dylan604 »

jokoon wrote: post #13

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography. I've heard the NSA is one of the biggest employer of math people. At that point, I'm guessing some form of obscurity might somehow be a better idea to protect data from the NSA, or at least it would force NSA employees to analyze some obfuscated data, buying more time than just using mainstre…

>I've heard the NSA is one of the biggest employer of math people.

What are the other options for pure maths people? Academia? Does that really pay any better, plus, depending on your teaching level, there's a good chance you're just a babysitter. A cush gov't job probably sounds pretty good where you will actively be using your skills on a daily basis.

Are there FAANG opportunties for math people at the same level as gov't?

Re: The NSA's Backdoor in Dual EC

#47

Post by dylan604 »

sjaak wrote: post #26
marcan_42 wrote: post #16

Earlier quoted context omitted.

This has nothing to do with brain power. This was a deliberately backdoored algorithm that any cryptographer familiar with elliptic curve cryptography could've come up with. It wasn't even good or clever, seeing as people saw through it almost immediately. The only thing it had going for it is it was plausibly deniable and that allowed the US government to force people to implement it, since nobody could prove the NS…

> Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography. Unless they're one step ahead here and they want us to think that which is why they add backdoors knowing that years later that knowledge will become public, giving us all a reason to think they cannot break modern crypto.

or taking the false flag further to be able to say that all crypto is weak and has flaws, so mights as well forgoe it. sure would make everyone's job easier.

Re: The NSA's Backdoor in Dual EC

#48

Post by dylan604 »

marcan_42 wrote: post #30
bob1029 wrote: post #15

Earlier quoted context omitted.

Just so we are clear, rolling my own crypto doesnt necessarily involve reinventing SHA256 and AES from scratch. It just means using these primitives directly rather than farming out and allowing others to select the underlying methods for you. I use Microsoft's cryptographic implementations, but I don't let them pick the method for me. I don't think this is unreasonable if you have some experience in the space.

Putting together primitives in a way that doesn't have subtle flaws is not trivial. Many a standard have been vulnerable due to this. You think you can do better? We do have simple, well engineered, and sometimes even probably secure constructions. Look at libsodium if you want a decent example of what a modern library looks like. And stay away from anything that mentions the words NIST, FIPS, or any other government…

>and sometimes even probably secure constructions

Probably doesn't make me feel secure. Did you mean properly?

Re: The NSA's Backdoor in Dual EC

#49

Post by atatatat »

sjaak wrote: post #26
marcan_42 wrote: post #16

Earlier quoted context omitted.

This has nothing to do with brain power. This was a deliberately backdoored algorithm that any cryptographer familiar with elliptic curve cryptography could've come up with. It wasn't even good or clever, seeing as people saw through it almost immediately. The only thing it had going for it is it was plausibly deniable and that allowed the US government to force people to implement it, since nobody could prove the NS…

> Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography. Unless they're one step ahead here and they want us to think that which is why they add backdoors knowing that years later that knowledge will become public, giving us all a reason to think they cannot break modern crypto.

Tinfoil acts as a receiver...

Re: The NSA's Backdoor in Dual EC

#50

Post by cryptonector »

perihelions wrote: post #8

I don't understand the significance of the Dual EC vulnerabilities here. The attackers had write access to the target's crypto code, and altered it to their convenience. What cryptosystem is secure against that threat model? That the "re-keying" edit fits in 32 bytes is a neat math trick, but doesn't seem to me like a central issue. What am I misunderstanding? > "In practice this would simply mean hacking into a majo…

The way Dual_EC works, to exploit it you need a TLS extension that has the server send "large nonces", which you use along with knowledge of the backdoor key to recover RNG state and so recover the server's Diffie-Hellman keys.

Now, if the backdoor is in place but no one was using it, no one would know if the public backdoor key got changed. But the attacker gets to decrypt all these sessions. OTOH, if NSA was trying to use the backdoor and noticed it wasn't working, they might start looking into it and find the hack.

So being able to make a very small source code change (32 bytes of public key material in this case) that has this impact is fantastic because that change is small enough that no one might have notice for a long time (which is apparently what actually happened).

But you're right, if you can change the source code then you can add a backdoor anyways, so Dual_EC being backdoored is not what was fatal to the Juniper systems. What was fatal to them is that they had poor internal security.

Still, an intentional backdoor key is plausibly -likely even- easier to replace than a backdoor is to add. So this is a decent argument against intentional backdoors. But it's not really a devastating argument against intentional backdoors.

Intentional backdoors are bad for political reasons too -- or good, maybe, depending on your point of view. Intentional backdoors are bad because the key to the backdoor can leak, and when that happens it can be very hard to fix -- this is devastating to security of the backdoored system, so I think it is a devastating argument against intentional backdoors, especially for a backdoor where exploitation is passive, like Dual_EC.

Dual_EC was a fine covert key escrow system for U.S. government systems, but there was no need to make it covert if it was only for that.

EDIT: But the real problem with Dual_EC is that it's terribly slow. /s

Post reply on HN