Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

schneier.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#51

Post by twotwotwo »

bascule wrote: post #20

Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him: "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can." There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.

Agree. The notion that they can break ECC but not RSA

1) means they're suggesting insecure algos for protecting top-secret data and know it

2) doesn't fit with the hints that maybe lots of traffic is being decrypted through some mathematical breakthrough[1], because for that you'd want to break RSA, not ECC

3) just seems odd, since knowing only the public attacks, a) RSA often has the narrowest security margin of any link in the chain in deplaoyed systems (e.g., RSA using a 1024-bit key thought to be worth ~80 bits vs. the symmetric algo using 128/256-bit keys) and b) RSA attacks, and not ECC attacks, have slowly gotten better.

[1] Not sure I believe those hints, but let's roll with the assumption.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#52

Post by NegativeK »

hyperbovine wrote: post #19
ef4 wrote: post #15

We can and we must. I'm glad that Bruce Schneier has now had a chance to view some of the primary source documents from the Snowden leaks, because I trust him to speak frankly and I trust his technical ability. (I'm referring to http://www.schneier.com/blog/archives/2013/09/the_nsa_is_bre... , not the above link). Both he and Snowden have essentially said that we can still trust the math. Modern symmetric crypto has…

If the NSA had really broken asymmetric crypto it would imply that they were sitting on an huge unpublished result in one or more of a) complexity theory b) quantum computing c) number theory d) ?? something even more outlandish. It's difficult to imagine even them keeping a lid on that. Mathematics is not a large field nor is it by nature a secretive one. (Arguably recognition is the thing driving most mathematician…

RSA has plenty of mathematical gotchas that, if you don't know about them, will lead to a weaker implementation.

If the NSA hasn't demolished public key crypto, it still seems reasonable to assume that they've made sure a significant implementation vulnerability (that looks like normal crypto give and take) has been inserted.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#53

Post by lostlogin »

Debugreality wrote: post #25

Here is an interesting startup idea that may be a step towards a solution. Setup an organization that gives a tick of approval similar to ISO quality standards but for NSA Free software. It would involve selling your logo to business that meet a defined list of processes and practices to harden their software against 3rd party spying and security flaws. Then you can preform audits and sell your logo on a yearly basis…

I misread your post as saying >iOS quality. I'm not sure what that would mean, however I was about to post saying good luck getting that onto the AppStore.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#54

Post by lostlogin »

nitrogen wrote: post #32
vinceguidry wrote: post #22

Earlier quoted context omitted.

If they're really trying to keep it secret, not even the NSA rank and file will know. It's all mostly need to know anyway.

Though I have no first-hand knowledge, I was under the impression that organizations like the NSA have internal peer-reviewed journals that their mathematicians can "publish" in, while remaining classified and unavailable to the public.

This is basically just a small step worse than many professions. Once you hit the pay wall on journal articles you want to read, how many people pay to go through?

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#55

Post by harrytuttle »

anologwintermut wrote: post #48
bascule wrote: post #20

Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him: "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can." There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.

Schneier told people to use Tor to avoid the NSA[0]. Telling people to use Tor when Tor offers almost no anonymity guarantees against a global passive adversary (which the NSA almost certainly is), is not good advice at all. In fact, it's actively harmful since it both gives people a false sense of security and instructs the to wave a giant red flag saying I HAVE SOMETHING TO HIDE. [0] http://www.theguardian.com/worl…

I noticed this as well.

A big single public voice with a public reputation profile is not trustworthy if you ask me.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#56

Post by oleganza »

twotwotwo wrote: post #50

Wow, I disagree with him about the relative security of RSA vs. ECC. First, ignoring any clues from NSA's behavior entirely, RSA attacks have gradually gotten better, and an RSA/DH-based system with 256-bit security would be very slow (3072-bit RSA keys). Second, I really doubt NSA's recommendations for Suite B algos are head fakes, because the public justification for them makes sense and head faking doesn't. US and…

Correction: 256-bit security is provided by 15360-bit RSA keys and 512-bit ECC keys. 3072-bit RSA key provides 128 bits of security.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#57

Post by lucian1900 »

smithzvk wrote: post #33
bascule wrote: post #20

Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him: "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can." There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.

I truly don't understand why the suggestion isn't encrypt it both ways (or, more generally, many different, layered encryption schemes).

Encrypting twice is not guaranteed to not make the end result easier to attack than either of the two single methods.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#58

Post by smithzvk »

lucian1900 wrote: post #57
smithzvk wrote: post #33

Earlier quoted context omitted.

I truly don't understand why the suggestion isn't encrypt it both ways (or, more generally, many different, layered encryption schemes).

Encrypting twice is not guaranteed to not make the end result easier to attack than either of the two single methods.

Right, but that is the point. If you think that the NSA has some magic machine that might break one of the common encryption schemes, but you don't know which, then pick five different encryption schemes. A layered encryption scheme is only as weak as its strongest layer.

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#59

Post by lucian1900 »

smithzvk wrote: post #58
lucian1900 wrote: post #57

Earlier quoted context omitted.

Encrypting twice is not guaranteed to not make the end result easier to attack than either of the two single methods.

Right, but that is the point. If you think that the NSA has some magic machine that might break one of the common encryption schemes, but you don't know which, then pick five different encryption schemes. A layered encryption scheme is only as weak as its strongest layer.

My comment was a bit hard to read. Layered encryption is not guaranteed to be only as weak as its strongest layer. It's possible for layering to enable side-channel attacks.

Encryption is hard :(

Re: How Advanced Is the NSA's Cryptanalysis, and Can We Resist It?

#60

Post by nothingspecial »

anologwintermut wrote: post #48
bascule wrote: post #20

Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him: "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can." There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.

Schneier told people to use Tor to avoid the NSA[0]. Telling people to use Tor when Tor offers almost no anonymity guarantees against a global passive adversary (which the NSA almost certainly is), is not good advice at all. In fact, it's actively harmful since it both gives people a false sense of security and instructs the to wave a giant red flag saying I HAVE SOMETHING TO HIDE. [0] http://www.theguardian.com/worl…

If everyone used Tor they wouldn't stand out individually, and I think it's fair to assume Schneier offered his suggestions in that sense.
Post reply on HN