Live data from Hacker News

NSA-proof encryption exists. Why doesn’t anyone use it?

washingtonpost.com

21–30 of 138 posts

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#21
I have a question that perhaps a cryptography expert could answer for me.

My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known. This indicates to me that top secret technology is probably somewhere around 15-20 years ahead of what the general public knows about. This may be less true today than it was back then since nowadays the equipment and factories to develop state-of-the-art technology run in the billions of dollars.

Where I'm going with this: is it reasonable to assume that "future technology" 20 years from now could crack AES-256 or PGP? If so, it seems reasonable to me that the NSA could already crack today's encryption for high-priority data. Add that to the fact that they tend to hire the very best experts in the field (mathematicians and cryptographers) and it doesn't seem entirely unreasonable to me that their decryption technologies are pretty good. Of course, I'm not talking about better technology in a brute-force sense; it would still be impossible to crack 256-bit encryption. I'm talking about algorithmic weaknesses.

But then again, I have only a basic knowledge of cryptography. Would any experts like to comment?

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#22
post #14
post #2

Why doesn't anyone use it? The FIRST question is: Is it really a solution? The answer to that: NO, see: https://news.ycombinator.com/item?id=5879308

This simply isn't true. Even if you (with likely a few orders of magnitude margin) overestimate total world computing capacity at 1e21 decryption operations per second it's going to take you about age-of-the-universe seconds to brute force a single 128 bit key. No amount of money or supposed 'exponential technology growth' is going to let any government brute force these anytime soon. And those are the smallest symme…

Compute power is far from the most effective brute force method to get someone's encryption key. Other means include; rendition, waterboarding, jail, similar threats and keyloggers.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#23
post #14

Earlier quoted context omitted.

This simply isn't true. Even if you (with likely a few orders of magnitude margin) overestimate total world computing capacity at 1e21 decryption operations per second it's going to take you about age-of-the-universe seconds to brute force a single 128 bit key. No amount of money or supposed 'exponential technology growth' is going to let any government brute force these anytime soon. And those are the smallest symme…

Can you back these calculations up with a known scientific source?

@aryastark - What's the nature of AES 128 & Co., meaning: Who can and cannot discover flaws? Is this like open source where the whole world can watch or is this somehow a closed thing like Windows, MacOS, etc.?

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#24
post #14

Earlier quoted context omitted.

This simply isn't true. Even if you (with likely a few orders of magnitude margin) overestimate total world computing capacity at 1e21 decryption operations per second it's going to take you about age-of-the-universe seconds to brute force a single 128 bit key. No amount of money or supposed 'exponential technology growth' is going to let any government brute force these anytime soon. And those are the smallest symme…

Can you back these calculations up with a known scientific source?

http://arxiv.org/pdf/quant-ph/9908043.pdf

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#25
> NSA-proof encryption exists.

Yup. Except it's not that easy.

Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans.

Data in transit that is intercepted, if configured correctly, is almost certainly safe. No one will be able to immediately decrypt it because of the strong encryption.

So are you safe?

Probably not. The next step that government would take would be to raid your friend Bob's apartment, arrest him, and take his hard disk. His OTR key (and, if using Pidgin, account credentials in plaintext if stored) is plainly available on the disk. You now have the private key.

But what if he used Truecrypt or PGP full-disk encryption? His data would be safe from decryption then, right?

Sort of. If they're trying to break the actual encryption, they'd likely be unable to do so. Unfortunately, the weak point for Truecrypt disks or volumes isn't the crypto... it's the passphrase. The passphrase can be brute-forced significantly more easily than breaking the encryption itself. Furthermore, as xkcd so accurately pointed out, a hostile government will throw you in prison (or, worse, hit you repeatedly with a wrench) until you divulge your passphrase and data.

Encryption is great, and I encourage everyone to use reliably strong crypto. Will that keep your data safe from the criminals that stole your work laptop? Absolutely. Will it keep your data safe from the NSA? You're kidding yourself.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#26
post #18

Earlier quoted context omitted.

Client-side, with a passphrase. A backup could be stored on the server or in your dropbox or wherever you'd like. It would be important, as part of the onboarding process, to communicate the need to keep the key safe and what happens to your old emails should you lose it. As for using js for public key encryption, I've implemented it for a client and didn't have much trouble. There are libraries that workaround the u…

If you're doing public key crypto on the client side in javascript, then the client side JS must necessarily have access to the private key (unless you have a TPM _and_ browser hooks to use it). This means that suddenly the private key is vulnerable to any XSS attacker that can inject itself into the same origin as your javascript crypto code.

Fair point. XSS likely wouldn't be a problem in the case of a desktop email client. But in the case of a Gmail or Outlook.com frontend, I can see how you would be concerned about something in the js served up by Google or MS capturing the private key and sending it to the server.

That said, couldn't this be mitigated by having a strong passphrase on the private key? How hard is the wrapper to attack?

Also, couldn't security researchers easily monitor the packets on this process and sound the alarm should they find that the js served up by Google or Microsoft suddenly starts sending private keys to the server?

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#27
post #4

Earlier quoted context omitted.

And where is the private key stored? On Google or Microsoft's server? What then would be the point? (I assume you'll answer that it'll be done client-side, but JavaScript cryptography is a whole mess of fail. But that's a separate issue.)

And if it is stored client-side, what happens when the user inevitably loses their key? You and I might have backups in multiple places, and on an encrypted USB stick in a bank vault, but my dad doesn't, and the next time he spills wine on his laptop, there goes literally all of his e-mail.

Why not simply make the cryptographically secure service opt-in?

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#28
post #3

From the article: "And while most types of software get more user-friendly over time, user-friendly cryptography seems to be intrinsically difficult. Experts are not much closer to solving the problem today than they were two decades ago." I'm not sure I agree that user-friendly cryptography is "intrinsically difficult." It doesn't seem like it would be hard for email clients and even the Gmail frontend to pop up a m…

Not so. Nothing stops Linux distros defaulting to mail and file systems that encrypt everything by default, but the reality is that most people can't be bothred. I certainly can't, and I don't feel like putting myself out to encrypt everything in order to make it popular. As has been pointed out, the metadata of who you email and phone, while not probative in the same fashion as the contents of calls and emails, are nevertheless a significant source of data, and encryption won't alter that without major changes to the architecture of mail.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#29
Because the vast majority of people like privacy in theory but not enough to spend the hour it would take to learn how to encrypt their email and documents.

Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? This isn't to excuse anything illegal the US gov't might be doing, but if it matters as much to people as they say you'd think they'd have at least taken some immediate action.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#30

I have a question that perhaps a cryptography expert could answer for me. My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known.…

This has come up in the past on HN. As I understand it the newspaper story is bull. As for advancements in technology the answer is likely no - producing that technology requires an entire toolchain/industry that the NSA is unlikely to replicate with its size. The only shot the NSA has at pulling ahead of us is with entirely mathematical things like crypto (which they did at least in the 70s with differential cryptanalysis). With math you can simply hire a bunch of smart people and throw them in a room together which is much less capital intensive than the massive, fundamental research needed to advance technology ahead of the industry.
Post reply on HN