Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA's Backdoor in Dual EC

twitter.com

Post reply on HN
Print view View original

51–60 of 95 posts

Re: The NSA's Backdoor in Dual EC

#51

Post by tzs »

dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

> The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil.

Uhm...isn't the whole basis of modern cryptography the idea that you can have keys that only the good guys know? Every time you use an HTTPS site for example you are relying on the existence of keys that only the good guys know. Every time you use an end to end encrypted messaging system you are relying on the existence of keys that only the good guys know.

The issue with backdoors is not keeping keys secret. It is keeping others from also installing backdoors.

Re: The NSA's Backdoor in Dual EC

#52

Post by sangnoir »

marcan_42 wrote: post #16
jokoon wrote: post #13

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography. I've heard the NSA is one of the biggest employer of math people. At that point, I'm guessing some form of obscurity might somehow be a better idea to protect data from the NSA, or at least it would force NSA employees to analyze some obfuscated data, buying more time than just using mainstre…

This has nothing to do with brain power. This was a deliberately backdoored algorithm that any cryptographer familiar with elliptic curve cryptography could've come up with. It wasn't even good or clever, seeing as people saw through it almost immediately. The only thing it had going for it is it was plausibly deniable and that allowed the US government to force people to implement it, since nobody could prove the NS…

> The NSA doesn't break real crypto any more, they just find or make software bugs.

They still can, and do break crypto. The Snowden papers (IIRC) mentioned that NSA factored a bunch of primes by throwing ridiculous amounts of compute at it: billions of dollars.

With that,they could break schemes with no forward secrecy at their leisure (from all the historical internet traffic they had gathered), and they could decrypt ~30% of all "secure" internet connections in real time at the time,IIRC

Re: The NSA's Backdoor in Dual EC

#53

Post by GuB-42 »

Do we have some kind of proof about the backdoor?

It has been quite a while since security researchers publish about a potential backdoor in Dual_EC_DRBG, and even without the backdoor, they found it rather weak. It was even before it was a standard.

Then, there is mentions of the NSA intent on backdooring encryption standards, and the surprising push for making that dubious algorithm a standard.

It makes the scenario of a NSA backdoor very likely, but strong suspicion is not a proof, and yet, all these articles make it into a fact, did I miss something or do they jump to conclusions. Not saying they didn't do it, they most likely did, but if I get accused of a crime one day, I hope that the court will be held to higher standards.

And there is many things I don't get about that story. Dual_EC_DRBG was suspicious from day one, I can't imagine an enemy of the US using it except to transmit misinformation, no need for leaks, the very existence of the algorithm is enough. If the story is true (it is a NSA backdoor), then it is really a show of incompetence (like the whole mess with Snowden, really), or maybe part of the plan of a mastermind, I bet on the former.

Re: The NSA's Backdoor in Dual EC

#54

Post by samuel »

gzer0 wrote: post #40

Searching for the text "strcmp" finds a static string that is referenced in the sub_ED7D94 function. Looking at the strings output, we can see some interesting string references, including auth_admin_ssh_special and auth_admin_internal. Searching for auth_admin_internal finds the sub_13DBEC function. This function has a strcmp call that is not present in the 6.3.0r19b firmware: The argument to the strcmp call is [1]…

That's one of them, and the least interesting of both. I remember that the other one was way more concealed and involved a global variable or something like that and it didn't seemed that the code was doing what was actually doing.

There was an amazing blog entry which explained it, but can't find it right now.

Edit: I don't think this was the one I read, but it's similar. https://cryptologie.net/article/316/junipers-backdoor/

Basically, Dual EC was chained to another PRNG, so the output should have been robust to crypto vulnerabilities discovered in any of both. The thing is: the second one was never called, because the for's index(a global variable) was set to 32 inside a function call, so the loop never run.

Re: The NSA's Backdoor in Dual EC

#55

Post by tgbugs »

Huh. I had not though of the rekeying issues before. Glaringly obvious in hindsight. The question of "how can you ensure that this system will not be rekeyed to respond to someone else" is a great one. The best answer is "there is nothing that can be rekeyed."

Re: The NSA's Backdoor in Dual EC

#56

Post by tsimionescu »

jokoon wrote: post #13

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography. I've heard the NSA is one of the biggest employer of math people. At that point, I'm guessing some form of obscurity might somehow be a better idea to protect data from the NSA, or at least it would force NSA employees to analyze some obfuscated data, buying more time than just using mainstre…

> In the end, I don't think nobody has good enough reason to hide stuff from the US government, at least that's my opinion, as long as the US gov is not too evil or not too corrupt. As long as other dangerous governments or criminals can't do too much cyber damage, things are fine.

Such a bizarre take. The US government is one of the most belligerent and feared governments in the world, with a known track record of starting wars, toppling democratic governements that are opposed to them, ignoring international law, prioritizing US corporations over any local peoples. China and Russia aren't even half as scary to the vast majority of the planet.

Re: The NSA's Backdoor in Dual EC

#58

Post by marcan_42 »

dylan604 wrote: post #48
marcan_42 wrote: post #30

Earlier quoted context omitted.

Putting together primitives in a way that doesn't have subtle flaws is not trivial. Many a standard have been vulnerable due to this. You think you can do better? We do have simple, well engineered, and sometimes even probably secure constructions. Look at libsodium if you want a decent example of what a modern library looks like. And stay away from anything that mentions the words NIST, FIPS, or any other government…

>and sometimes even probably secure constructions Probably doesn't make me feel secure. Did you mean properly?

Sorry, that was a typo, I meant provably. As in constructions that have been proven to be secure assuming the underlying primitives are secure.

Re: The NSA's Backdoor in Dual EC

#59

Post by dylan604 »

tzs wrote: post #51
dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

> The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. Uhm...isn't the whole basis of modern cryptography the idea that you can have keys that only the good guys know? Every time you use an HTTPS site for example you are relying on the existence of keys that only the good guys know. Every time you use an end to end encrypted messaging system you are relyi…

I'm thinking you're not understanding the problem correctly. Backdoors mean that people with that access can read things without having the shared keys. You and I exchange keys so we can communicate privately. Because only you and I have those keys, nobody else can read those messages. However, because the TLAs have backdoor access, you and I and the TLAs can read the messages. However, you and I don't know that or at least we're unaware when it is occurring (because we read things like HN and are at least aware of backdoors). Now, bad actor #1 discovers the backdoor and jimmies the lock, and now they can read our "private" messages. Then bad actor #2 comes along and releases to the public how to use the backdoor on anyone's private messages, and now nothing is private and the crypto is a waste of energy. Then the TLAs come along and make it illegal to distrubte code that allows access to the backdoors and someone releases a new t-shirt.

The rest of the world sits back and says "I told you so".

Re: The NSA's Backdoor in Dual EC

#60

Post by dylan604 »

marcan_42 wrote: post #58
dylan604 wrote: post #48

Earlier quoted context omitted.

>and sometimes even probably secure constructions Probably doesn't make me feel secure. Did you mean properly?

Sorry, that was a typo, I meant provably . As in constructions that have been proven to be secure assuming the underlying primitives are secure.

I like provably better than properly. Now I feel warm and fuzzy.
Post reply on HN