Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

schneier.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#41

Post by marshray »

fivethree wrote: post #39
marshray wrote: post #23

Earlier quoted context omitted.

Why would you expect a lawless organization like this to actually pay you? It might just be easier for them to say "Thanks, but we already knew that, and by the way that's ultra classified so we'll give you the option of a clean suicide."

Because the "lawless organization" is backed by the richest country in the history of the concept of money.

The money isn't the issue. The issue is that once you disclose the algorithm, your continued existence can then only represent future nation-state levels of liability.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#42

Post by gizmo686 »

nitrogen wrote: post #32
vinceguidry wrote: post #22

Earlier quoted context omitted.

If they're really trying to keep it secret, not even the NSA rank and file will know. It's all mostly need to know anyway.

Though I have no first-hand knowledge, I was under the impression that organizations like the NSA have internal peer-reviewed journals that their mathematicians can "publish" in, while remaining classified and unavailable to the public.

I have a friend who interned with the NSA in high school. Although what he did is classified, he was allowed to say that his work got published internally.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#43

Post by newman314 »

tracker1 wrote: post #24
newman314 wrote: post #21

What is not being said is "Which if any of the CAs have been compromised?" There is this ongoing conversation of "Use HTTPS" (as one of the defense mechanisms) but there is been very little discussion from what I have seen around the scenario where CAs have been compromised/backdoor'ed.

I really wish that I could mod this up a LOT ... even with TOR exit nodes + HTTPS, there's still a really good chance of things not being secure...

Compromise the CA (and possibly the pinned certs) and the keys to the bank are yours. No need to spend all that pesky time crunching numbers, factoring etc.

The most frightening thing to this is there is no good, widespread alternative...

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#44

Post by eru »

smithzvk wrote: post #33
bascule wrote: post #20

Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him: "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can." There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.

I truly don't understand why the suggestion isn't encrypt it both ways (or, more generally, many different, layered encryption schemes).

In theory, that would work. In practice, you need to be careful, because you can screw up.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#46

Post by Spooky23 »

marshray wrote: post #41
fivethree wrote: post #39

Earlier quoted context omitted.

Because the "lawless organization" is backed by the richest country in the history of the concept of money.

The money isn't the issue. The issue is that once you disclose the algorithm, your continued existence can then only represent future nation-state levels of liability.

The NSA isn't some faceless villain. They are an organization that has been consistently 10-20 years ahead of the world in many math disciplines.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#47

Post by 13throwaway »

newman314 wrote: post #21

What is not being said is "Which if any of the CAs have been compromised?" There is this ongoing conversation of "Use HTTPS" (as one of the defense mechanisms) but there is been very little discussion from what I have seen around the scenario where CAs have been compromised/backdoor'ed.

CAs do not ever see their client's encryption keys. If a CA was compromised someone could only create authentication keys for websites. This type of an attack could work on a single person. It would not work for a large group of people because this type of attack is very easy to detect (by someone who is looking for it) and very traceable.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#48

Post by anologwintermut »

bascule wrote: post #20

Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him: "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can." There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.

Schneier told people to use Tor to avoid the NSA[0]. Telling people to use Tor when Tor offers almost no anonymity guarantees against a global passive adversary (which the NSA almost certainly is), is not good advice at all. In fact, it's actively harmful since it both gives people a false sense of security and instructs the to wave a giant red flag saying I HAVE SOMETHING TO HIDE.

[0] http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#49

Post by wimbo »

hyperbovine wrote: post #19
ef4 wrote: post #15

We can and we must. I'm glad that Bruce Schneier has now had a chance to view some of the primary source documents from the Snowden leaks, because I trust him to speak frankly and I trust his technical ability. (I'm referring to http://www.schneier.com/blog/archives/2013/09/the_nsa_is_bre... , not the above link). Both he and Snowden have essentially said that we can still trust the math. Modern symmetric crypto has…

If the NSA had really broken asymmetric crypto it would imply that they were sitting on an huge unpublished result in one or more of a) complexity theory b) quantum computing c) number theory d) ?? something even more outlandish. It's difficult to imagine even them keeping a lid on that. Mathematics is not a large field nor is it by nature a secretive one. (Arguably recognition is the thing driving most mathematician…

I don't really think this is an outlandish claim, especially as it already happened with public key cryptography: http://www.zdnet.com/gchq-pioneers-on-birth-of-public-key-cr...

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#50

Post by twotwotwo »

Wow, I disagree with him about the relative security of RSA vs. ECC. First, ignoring any clues from NSA's behavior entirely, RSA attacks have gradually gotten better, and an RSA/DH-based system with 256-bit security would be very slow (3072-bit RSA keys).

Second, I really doubt NSA's recommendations for Suite B algos are head fakes, because the public justification for them makes sense and head faking doesn't. US and allied governments can't use secret algorithms everywhere, and their systems need to talk securely. And they seem to actually be using Suite B, so it would be an expensive, risky head fake to standardize your whole government around something you know can in principle be cracked (even if you think only you can currently do it). On the other hand, I think it doesn't matter to NSA much if Suite B reveals that NSA thinks 521-bit ECDH is OK; notice how it hasn't led to ubiquitous ECDH usage.

2.5th, if all the latest hints mean they're breaking tons of real traffic with a mathematical breakthrough, it's got to be in implementing RSA cracks, because most real traffic isn't using ECC. (Schneier admitted that might be possible when a "crypto breakthrough" claim came out early last year: http://www.schneier.com/blog/archives/2012/03/can_the_nsa_br...)

But there is at least one way to deal with an unresolvable uncertainty about which of two algos is badly broken. For secure one-to-one communications, you only need to establish a secure session once, then keep a secret key stashed for secrecy and authentication (auth through MACs or authenticated encryption, not signatures). So just frickin' use both: do two key negotiations, hash the results to get your key, and don't worry how slow it is because chips are fast and you only need to do this once.

Anyway, I do echo Schneier that the math is probably not the weakest point; it's consistent with experience in the world outside, where there are far more bugs and so on than algorithm failures (though algo failures happen, e.g., the 2008 MD5 SSL break). And it's consistent with all the other NSA leaks, which are mostly about non-cryptographic ways to data. Regaining some privacy looks like a long and difficult process.

Post reply on HN