Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA-proof encryption exists. Why doesn’t anyone use it?

washingtonpost.com

Post reply on HN
Print view View original

71–80 of 138 posts

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#71

Post by y0ghur7_xxx »

maaku wrote: post #4
aasarava wrote: post #3

From the article: "And while most types of software get more user-friendly over time, user-friendly cryptography seems to be intrinsically difficult. Experts are not much closer to solving the problem today than they were two decades ago." I'm not sure I agree that user-friendly cryptography is "intrinsically difficult." It doesn't seem like it would be hard for email clients and even the Gmail frontend to pop up a m…

And where is the private key stored? On Google or Microsoft's server? What then would be the point? (I assume you'll answer that it'll be done client-side, but JavaScript cryptography is a whole mess of fail. But that's a separate issue.)

> And where is the private key stored?

Securely in the Browser, and not directly accessible by js, just like a TMP chip or a smartcard. Could that be a solution?

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#72

Post by marssaxman »

Xcelerate wrote: post #34
lordgilman wrote: post #30

Earlier quoted context omitted.

This has come up in the past on HN. As I understand it the newspaper story is bull. As for advancements in technology the answer is likely no - producing that technology requires an entire toolchain/industry that the NSA is unlikely to replicate with its size. The only shot the NSA has at pulling ahead of us is with entirely mathematical things like crypto (which they did at least in the 70s with differential cryptan…

> As I understand it the newspaper story is bull Could you clarify what you mean by this? And yeah, I should have been more clear in my original question; I was lumping mathematical advances under "technology".

The resolution of a lens at a given wavelength is determined by its diameter (Rayleigh function). We know how big the launch vehicles are, so we can estimate the largest size a spy satellite's mirror could be, and we can use that to compute the maximum resolution a satellite could have; it turns out to be something around 5-10 cm. In order to resolve a newspaper from near-earth orbit, you'd need a lens bigger than the ISS, and if such an object existed it would be one of the brightest objects in the sky.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#73

Post by tmzt »

zobzu wrote: post #70

Its not about convenience. its about money. Like everything really. Using GPG/PGP for example (which IMO is the best solution) is nice. It has a good, convenient design. The clients, UI, etc are terrible. Theyre extremely inconvenient. That can be fixed. This needs some time and a little dedication. Nobody will pay for a product that has proper, easy, fast PGP support across the board. Nobody. Since it's not a trivia…

You could build a Chrome (or Firefox) extension that added GPG/PGP/SMIME to Gmail, you would have to intercept the emails before they were stored as drafts in order to protect the message in the inbox. You could use a plugin or native client to interface with the OS or desktop environment's keystore to keep the private key out of Javascript. The key passphrase could double as the passphrase for symmetrically encrypting the message stored in the inbox.

Add to this a keyserver for automatically discovering public keys of contacts and you have a "good" solution between interested parties, without compromising recoverability of the majority of your messages.

You could do the same for Gtalk/Hangouts chats with OTR.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#74

Post by ryan-c »

tlrobinson wrote: post #49
david_shaw wrote: post #25

> NSA-proof encryption exists. Yup. Except it's not that easy. Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans. Data in transit that is intercepted, if configured correctly, is almost certainly…

Ah, the old rubber-hose cryptanalysis https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis However, according to https://en.wikipedia.org/wiki/Perfect_forward_secrecy OTR does provide "perfect forward secrecy as well as deniable encryption". Doesn't that provide some protection against rubber-hose cryptanalysis?

Perfect Forward Secrecy means that even if you want to you cannot decrypt old messages, since the keys used are ephemeral and destroyed at the end of the session.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#75

Post by foobarbazqux »

david_shaw wrote: post #25

> NSA-proof encryption exists. Yup. Except it's not that easy. Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans. Data in transit that is intercepted, if configured correctly, is almost certainly…

> The passphrase can be brute-forced significantly more easily than breaking the encryption itself.

Doesn't brute forcing this depend on the strength of the passphrase? For large enough N, if neither can be done in the next N years, does it really matter if it's significantly easier? Isn't there a non-negligible likelihood that in the next N years we'll figure out ways to break stronger forms of encryption but we won't figure out how to brute force strong passphrases efficiently?

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#76

Post by maaku »

y0ghur7_xxx wrote: post #71
maaku wrote: post #4

Earlier quoted context omitted.

And where is the private key stored? On Google or Microsoft's server? What then would be the point? (I assume you'll answer that it'll be done client-side, but JavaScript cryptography is a whole mess of fail. But that's a separate issue.)

> And where is the private key stored? Securely in the Browser, and not directly accessible by js, just like a TMP chip or a smartcard. Could that be a solution?

Potentially, yes. But now we're back to technology/software which doesn't yet exist. If you create it I would use it, though.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#77

Post by maaku »

dllthomas wrote: post #62
nathan_long wrote: post #16

Earlier quoted context omitted.

>> with a passphrase that is the users responsibility. And there's the rub. "What do you mean, I can't ever see my data again? Why can't you reset my password?" We know that true security means only the user has the key. But users don't all want that responsibility.

Key escrow services?

See: Clipper.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#78

Post by maaku »

sweis wrote: post #64
ohazi wrote: post #45

Earlier quoted context omitted.

This is the real reason why cryptography hasn't caught on. It's opt-in by nature - No matter how hard you try, you can't send someone an encrypted message if they don't have a public key for you to use.

Actually, yes you can. Check out identity-based encryption and Voltage Security. It's currently in use by Wells Fargo, ADP, and other large enterprise customers. The catch there is that IBE requires a centralized, trusted key-issuing service where you need to enroll to receive your message. If that's compromised, then game over.

...which is another way of saying they shifted the problem without actually solving it.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#79

Post by maaku »

kniht wrote: post #41
aasarava wrote: post #26

Earlier quoted context omitted.

Fair point. XSS likely wouldn't be a problem in the case of a desktop email client. But in the case of a Gmail or Outlook.com frontend, I can see how you would be concerned about something in the js served up by Google or MS capturing the private key and sending it to the server. That said, couldn't this be mitigated by having a strong passphrase on the private key? How hard is the wrapper to attack? Also, couldn't s…

AFAIK a strong key passphrase would be effective at protecting the private key while it's at rest (stolen laptop / hard drive). However as soon as the private key is pulled into memory for a signing or encryption operation the passphrase doesn't matter as the raw key is needed at that point. As for your second question, there are techniques that perform static and dynamic analysis on javascript to try and detect ille…

Also, this isn't a hypothetical attack. Basically the same setup is used for client-side bitcoin wallets, and there have been reports of thefts (stolen keys).

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#80

Post by betterunix »

Xcelerate wrote: post #21

I have a question that perhaps a cryptography expert could answer for me. My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known.…

"Where I'm going with this: is it reasonable to assume that "future technology" 20 years from now could crack AES-256 or PGP?"

There are a few related issues here, and so the answer is a bit complicated.

The only evidence for the security of AES is heuristic, based on testing the output of the cipher to check for properties that secure block ciphers should have. Some new attack strategy could completely undermine AES. Similarly, PGP relies on block ciphers and hash functions that are based on such evidence.

On the other hand, public key cryptography has proofs of security under certain assumptions about the complexity of certain problems. A proof that P != NP is necessary to prove that PKE is secure, but it is not sufficient on its own and we do not even have that much.

Now, assuming that (a) the heuristic evidence for AES and various hash functions is a reliable indicator of security and (b) that the assumptions are computation complexity are correct, then both AES and PGP can be used essentially indefinitely. The reason is that your key size can continue to increase -- for AES, you can iterate the cipher (e.g. "triple AES"), and for PGP you can keep making your keys larger (16384-bit ElGamal?), and you will always be able to stay ahead of your opponent. There are issues with this approach, of course -- it would take a lot of computing power to actually use 16384-bit ElGamal, and eventually it would become impractical, which is why there is so much interest in elliptic curve crypto (which allows shorter keys to be used for the same level of security).

So the answer is, "Yes, from one perspective, No from the other."

Post reply on HN