Julian Assange: Cryptographic Call to Arms

For this reason I am fond of Jonathan Zittrain. Not that he particularly aligns with Assange but he is very good at presenting these issues in a compelling manner.

I don't at all disagree with you but for the benefit of the others I'd like to ask you, what do you mean by truth? (What do you indicate by the term of truth?)

edit: To say something is truth if it's true is too circular - as a definition it doesn't have matters that can be confirmed by others so isn't so helpful to convince them.

Assange certainly has a flair for the dramatic... but he doesn't understand encryption.

http://www.zdnet.com/blog/btl/wikileaks-insurance-file-decry...

Wikileaks has distributed AES encrypted files that it claims are full of government secrets. They have withheld the information needed to decrypt some of those files ( although some keys have leaked from wikileaks, oddly enough) as a deterrent to persecution by governments. There's just one minor problem... This is effectively publication with delay, and it forces governments to go after them hard rather than deterring them.

AES is based on computationally difficult to crack algorithms. If you assume there will be no advances in algorithms, no new types of computers, no weaknesses found in the implementation of AES, etc. then it will take a comfortingly long period of time for these files to be cracked. These assumptions are bad. Cracking algorithms are advancing rapidly. It is astronomically improbable, but not impossible that someone could come up with an efficient algorithm for factoring tomorrow that would render all factoring-based cryptography impotent overnight. The prospect of quantum computing on the horizon also places a time limit on how long these files can remain secure.

When you commit secrets to a current form of encryption based on computationally difficult problems and distribute the cypher text broadly, you have effectively published those secrets with an unknown delay.

This is why governments want Assange so badly. He's not keeping secrets to deter them, he's publishing them with a delay because he doesn't know what the heck he's doing when it comes to encryption. If he used a one-time-pad (Vernam cipher) and kept the key on his person he'd be in a far better position, but he's apparently too stupid to do this. How do you use a one-time pad?

Cipher = message XOR key (XOR = exclusive OR)

10110101... (secret message in binary)

11010111... (true random key)

--------

01100010... (ciphertext)

For this to work, Assange would have to distribute the ciphertext and keep the random key secret, perhaps on a USB key around his neck. This method of encryption has been mathematically proven to completely secure provided the key is truely random and not from a pseudo-random number generator. True random number generators can be bought for relatively cheap these days. If Assange had encrypted the files this way they would be safe from any cryptographic attack, safe from quantum computers, or anything else out there. For all time. The only thing that could unlock these files would have been his USB key. Obviously, this is not a convenient method for online transactions, since transmitting the secret gives eavesdroppers all they need to decode the ciphertext. However, for the use Assange has been putting AES to, one-time pads are perfect.

Why didn't Assange use a one-time pad? The only answer can be that, for all his bluster, he remains utterly ignorant of how encryption works. Thanks to his ignorance the governments of the world have a vested interest in taking him down. Even if someone else picks up where Assange left off, hopefully that someone will understand how encryption works.

Did you just s/RSA/AES/ ?

And you are suggesting he use a OTP?

Assange is not the one that does not know anything about cryptography here.