11–20 of 164 posts
I don't get it, unless Snowden's published his public key somewhere and Wired has some really, really important information for him?
From http://www.gnupg.org/gph/en/manual/x110.html "A public and private key each have a specific role when encrypting and decrypting documents. A public key may be thought of as an open safe. When a correspondent encrypts a document using a public key, that document is put in the safe, the safe shut, and the combination lock spun several times. The corresponding private key is the combination that can reopen the safe…
In a world where the US government is scanning all your electronic communications, and (we'll next discover) searching your OS X- and Windows-based computers at will, how do you, as a practical matter, keep your private key "private"?
I'm not a crypto type but I believe what you want is a password-based key derivation function such as scrypt, the output of which you can then use as the symmetric key to encrypt/decrypt the private key. (This might even be what GPG/SSH does for you; I'm not at all sure)
I can't tell what key the message is encrypted for. They may have used --hidden-recipient
$ gpg -vvv -d letter-to-snowden.txt
gpg: using character set `utf-8'
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/documentation/faqs.html for more information
gpg: armor: BEGIN PGP MESSAGE
gpg: armor header: Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
gpg: armor header: Comment: GPGTools - http://gpgtools.org
:pubkey enc packet: version 3, algo 1, keyid 5B50940B79DEBE35
data: [4096 bits]
gpg: public key is 79DEBE35
:encrypted data packet:
length: unknown
mdc_method: 2
gpg: encrypted with RSA key, ID 79DEBE35
gpg: decryption failed: secret key not available # gpg --list-packets /tmp/snowden.asc
:pubkey enc packet: version 3, algo 1, keyid 5B50940B79DEBE35
data: [4096 bits]
:encrypted data packet:
length: unknown
mdc_method: 2
gpg: encrypted with 4096-bit RSA key, ID 79DEBE35, created 2013-05-20
"Verax (Informed Democracy Front)"
EDIT: Also, a pretty safe way to carry an interview would be VPN + Tor + Bitmessage.
EDIT2: Users sneak and tlb claim Tor isn't safe because of timing attacks. Read below.
Earlier quoted context omitted.
More likely that it's a publicity stunt, raising awareness of strong encryption that the NSA (probably) can't crack yet.
yeah, I was wondering about how strong GPG was. Back in the day, i.e. the 90's, the assumption was it would take years for then-current NSA supercomputers to factor the keys. Nowadays, with all sorts of new attacks, analyses, and cheap as hell compute time, I would wager that time requirement has gone significantly down.
For a back-of-the-envelope cost estimate, I'm going to assume that there have been no major theoretical breakthroughs in the last couple of years, and that the machines they used were roughly equivalent to an EC2 "medium" instance. That puts the cost of breaking a 768-bit key, using spot instances for cost-efficiency, at about US$200k.
That sounds small, but encryption/decryption are still reasonably efficient with larger keys, while factorization becomes vastly harder. Breaking a 2048-bit key would take something like 200 quadrillion dollars worth of CPU time. A 4096-bit key, like the one used for this message, would be vastly more secure than that.
From http://www.gnupg.org/gph/en/manual/x110.html "A public and private key each have a specific role when encrypting and decrypting documents. A public key may be thought of as an open safe. When a correspondent encrypts a document using a public key, that document is put in the safe, the safe shut, and the combination lock spun several times. The corresponding private key is the combination that can reopen the safe…
In a world where the US government is scanning all your electronic communications, and (we'll next discover) searching your OS X- and Windows-based computers at will, how do you, as a practical matter, keep your private key "private"?
Most people using software only solutions won't ever have their keys stolen, but that's because nobody tried to steal them. The compromise of a client os is inevitable if targeted by a competent actor, given enough time.
Smartcards and HSM's may not be infallible, but their rate of compromise appears to be negligable at best and an extremely rare capability for an offensive team to have access to.
Smartcards are surprisingly cheap and easy to work with, and due to their simplicity and long history are quite secure. The only real attack on them involves physical access and causes obvious physical damage that'd be impossible to miss.
I don't get it, unless Snowden's published his public key somewhere and Wired has some really, really important information for him?
The reason you would advertise a page like this is to get lots of people to visit it. It gives Snowden the ability to look like any of the other (tens?) of thousands of people who visit the URL in the next little while.
Also, there's no other way to get the message to Snowden unless you give it publicity. If he browses the Internet for news, he will find there's a message from Wired for him.
I don't get it, unless Snowden's published his public key somewhere and Wired has some really, really important information for him?
More likely that it's a publicity stunt, raising awareness of strong encryption that the NSA (probably) can't crack yet.
$ gpg --keyserver pgp.mit.edu --recv-keys 79DEBE35
$ gpg --encrypt --sign --armor --recipient 79DEBE35
[1]: http://www.washingtonpost.com/world/national-security/code-n...
*assuming you believe the key is authentic