Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A brief history of the U.S. trying to add backdoors into encrypted data (2016)

atlasobscura.com

Post reply on HN
Print view View original

141–150 of 207 posts

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#141

Post by _kbh_ »

EthanHeilman wrote: post #108
progbits wrote: post #19

As this is from 2016 it doesn't include this new fun revelation: > On 11 February 2020, The Washington Post, ZDF and SRF revealed that Crypto AG was secretly owned by the CIA in a highly classified partnership with West German intelligence, and the spy agencies could easily break the codes used to send encrypted messages. https://en.m.wikipedia.org/wiki/Crypto_AG

I wrote blog entry on this subject with a very similar name [0] which covers the CryptoAG story in more detail. It doesn't have the 2020 news. [0]: A Brief History of NSA Backdoors (2013), https://www.ethanheilman.com/x/12/index.html

> I wrote blog entry on this subject with a very similar name [0] which covers the CryptoAG story in more detail. It doesn't have the 2020 news. [0]: A Brief History of NSA Backdoors (2013), https://www.ethanheilman.com/x/12/index.html

Wow this is super interesting I noticed this paragraph in the text.

> 2013, Enabling for Encryption Chips: In the NSA's budget request documents released by Edward Snowden, one of the goals of the NSA's SIGINT project is to fully backdoor or "enable" certain encryption chips by the end of 201311. It is not publicly known to which encryption chips they are referring.

From what I know Cavium is one of these "SIGINT enabled" chip manufactures.

> https://www.electrospaces.net/2023/09/some-new-snippets-from...

>> "While working on documents in the Snowden archive the thesis author learned that an American fabless semiconductor CPU vendor named Cavium is listed as a successful SIGINT "enabled" CPU vendor. By chance this was the same CPU present in the thesis author's Internet router (UniFi USG3). The entire Snowden archive should be open for academic researchers to better understand more of the history of such behavior." (page 71, note 21)

> https://www.computerweekly.com/news/366552520/New-revelation...

Unfortunately the relevant text for the second is pretty long so I dont wanna quote it.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#142

Post by matheusmoreira »

jonathanyc wrote: post #68

Now the argument coming from civil society for backdoors is based on CSAM: > Heat Initiative is led by Sarah Gardner, former vice president of external affairs for the nonprofit Thorn, which works to use new technologies to combat child exploitation online and sex trafficking. In 2021, Thorn lauded Apple's plan to develop an iCloud CSAM scanning feature. Gardner said in an email to CEO Tim Cook on Wednesday, August 3…

The perfect political weapon. Anyone who opposes is automatically labeled a pedophile and child abuser. Their reputations are destroyed and they will never oppose again.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#143

Post by tjoff »

mmaunder wrote: post #43

Honorable mention for the ITAR regs that prevented Phil Zimmerman from exporting PGP 128 bit encryption until Zimmerman and MIT press printed the source as a book protected by the first amendment, exported it, and this enabled others to OCR it, and recompile it offshore. Also that ITAR enabled Thawte in South Africa (where I’m from) as a business to completely dominate sales for 128 bit SSL certs outside the US. Thaw…

> [...] and this enabled others to OCR it, and recompile it offshore.

Did it? Or did it just give them plausible deniability?

I remember playing with OCR as a kid and all the software I could get my hands on gave horrendous results, even if the input was as perfect as one could hope for.

And even today I sometimes run tesseract on perfect screenshots and it still makes weird mistakes.

Would be interesting to know if the book had any extra OCR-enabling features. I'm sure the recipients would get access to proper tools and software but OCRing source-code still seems like a nightmare back then.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#144

Post by 5350-uiop-1130 »

how likely is it that whatsapp or telegram are backdoored?

i wonder what tools do guerilla armies or drug lords use to communicate..

or maybe its better to hide in plain sight.

just use some kind of double speak that gives plausible deniability.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#145

Post by KennyBlanken »

londons_explore wrote: post #37
xyst wrote: post #31

for a long time, the US considered cryptography algos as a munition. Needed some arms license to export. Also, US tried to convince the world only 56 bits of encryption was sufficient. As SSL (I don’t think TLS was a thing back then) was becoming more mainstream, US govt only permitted banks and other entities to use DES [1] to “secure” their communications. Using anything more than 56 bits was considered illegal. ht…

Even now, if you join a discussion on crypto and say something like "Why don't we double the key length" or "Why not stack two encryption algorithms on top of one another because then if either is broken the data is still secure", you'll immediately get a bunch of negative replies from anonymous accounts saying it's unnecessary and that current crypto is plenty secure.

I'll do you one better.

The head of security for Golang, a google employee, was also part of the TLS 1.3 committee and in Golang, it's impossible by design to disable specific ciphers in TLS 1.3

The prick actually had the nerve to assert that TLS 1.3's security is so good this should never be necessary, and that even if it were, they'll just patch it and everyone can upgrade.

So someone releases a 0-day exploit for a specific TLS cipher. Now you have to wait until a patch is released and upgrade your production environment to fix it - all the while your pants are down. That's assuming you're running a current version in production and you don't have to test for bugs or performance issues upgrading to a current release.

Heaven fucking forbid you hear a cipher is exploitable and be able to push a config change within minutes of your team hearing about it.

I'd place 50/50 odds on it being a bribe by the NSA vs sheer ego.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#146

Post by KennyBlanken »

5350-uiop-1130 wrote: post #144

how likely is it that whatsapp or telegram are backdoored? i wonder what tools do guerilla armies or drug lords use to communicate.. or maybe its better to hide in plain sight. just use some kind of double speak that gives plausible deniability.

Telegram is a poster-child for sketchy security.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#147

Post by AtlasBarfed »

keepamovin wrote: post #92

I was so curious about the origins of the SHA algorithms that I made a FOIA to NSA about SHA-0 ^0, as I wanted to understand how it was developed and requested all internal communications, diagrams, papers and so on responsive to that. Interestingly I found that after I got a reply (rough summary: you are a corporate requester, this is overly broad, it will be very expensive ) I could no longer access the NSA website…

They probably have someone specifically assigned to crack every device you use.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#148

Post by crotchfire »

monero-xmr wrote: post #133
Geisterde wrote: post #88

Earlier quoted context omitted.

Well, I think that would sevearly inhibit future development. Scaling on bitcoin has been a delicate game of optimizing every bit that gets recorded, but also support future developments that dont even exist yet, there is no undo button either. New signature schemas and clevar cryptography tricks can do quite a bit, but when you slap another layer of cryptography on you will inevitably make things worse in the long r…

The real security of Bitcoin is the choice of secp256k1. Basically unused before Bitcoin, but chosen specifically because he was more confident it wasn’t backdoored. https://bitcoin.stackexchange.com/a/83623

And ed25519 was out of the question, since -- being brand new -- its use would have given away the fact that DJB was among the group of people who presented themselves as Satoshi Nakamoto.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#149

Post by AtlasBarfed »

hunglee2 wrote: post #55

the biggest threat to a citizens privacy is always your own government.

I kinda disagree, because the government, even now, can be shamed and outraged.

Corporations however? They are, by design, utterly amoral.

So the modern state is that corporations are hoovering all your data they can for "ad research and optimization". I think I read recently that facebook has thousands of companies involved in the customer data supply chain?

And if those companies have your data, it's not that YOUR government has it guaranteed. It's that ALL governments have your data.

Re: A brief history of the U.S. trying to add backdoors into encrypted data (2016)

#150

Post by voldacar »

matheusmoreira wrote: post #139
loughnane wrote: post #39

Earlier quoted context omitted.

Yeah, this lives in the back of my mind too. I run debian on 11th gen intel, but with the non-free blobs included to make life easier. I've been meaning to try it without them, but it's too tempting to just get things 'up' instead of hacking on it.

There's little we can do about it short of running ancient libreboot computers. We'll never be truly free until we have the technology to manufacture free computer chips at home, just like we can make free software at home.

There's the talos II, if you can afford it.
Post reply on HN