Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA Brute-Force Keysearch Machine

schneier.com

Post reply on HN
Print view View original

11–20 of 30 posts

Re: NSA Brute-Force Keysearch Machine

#11

Post by tptacek »

mikeash wrote: post #8
jhallenworld wrote: post #2

I wonder how programmable it is... Assuming it's not programmable would be an argument not to use standard encryption algorithms.

It's probably easier to use a standard algorithm in a way that can't be attacked by this machine (e.g. use AES-256 with a properly random key) than it is to create a non-standard algorithm that doesn't have vulnerabilities.

Without some secret algorithmic defect, the existence of which would moot the machine and would throw any encryption algorithm into question, no amount of compute that can be assembled under the physical limits of conventional, non-quantum computing can break a 128 bit key.

AES-128 is the norm. No NSA supercomputer should convince you to use AES-256.

Re: NSA Brute-Force Keysearch Machine

#12

Post by tptacek »

jhallenworld wrote: post #2

I wonder how programmable it is... Assuming it's not programmable would be an argument not to use standard encryption algorithms.

No, it would not be. If you're using algorithms or constructions that are physically within the reach of a conventional computer assembled for any amount of money obtainable from the treasuries of all the Five Eyes governments, you're doing something wrong. Don't use RSA-1024; don't use 1024 bit multiplicative group Diffie-Hellman, don't use RC4, and then stop worrying about NSA supercomputers.

Re: NSA Brute-Force Keysearch Machine

#13

Post by mcshicks »

robert_foss wrote: post #4
sp332 wrote: post #3

Earlier quoted context omitted.

ASICs are not reprogrammable. And they're expensive to build, but the NSA apparently has the resources to build new ones at semi-regular intervals, so I don't know if switching algorithms would really slow them down that much.

Considering that it takes 1-2 years to spin custom silicon I would say that it is a viable approach.

I think they could probably do significantly faster than that since these would presumably be a relatively low volume, single customer application, and wouldn't need the extensive testing cycle required for mass production ASICs. Which is to say it doesn't take a year from delivering a mask set to a fab to getting packaged parts.

Re: NSA Brute-Force Keysearch Machine

#14

Post by [deleted] »

tptacek wrote: post #11
mikeash wrote: post #8

Earlier quoted context omitted.

It's probably easier to use a standard algorithm in a way that can't be attacked by this machine (e.g. use AES-256 with a properly random key) than it is to create a non-standard algorithm that doesn't have vulnerabilities.

Without some secret algorithmic defect, the existence of which would moot the machine and would throw any encryption algorithm into question, no amount of compute that can be assembled under the physical limits of conventional, non-quantum computing can break a 128 bit key. AES-128 is the norm. No NSA supercomputer should convince you to use AES-256.

[deleted]

Re: NSA Brute-Force Keysearch Machine

#15

Post by schoen »

tptacek wrote: post #12
jhallenworld wrote: post #2

I wonder how programmable it is... Assuming it's not programmable would be an argument not to use standard encryption algorithms.

No, it would not be. If you're using algorithms or constructions that are physically within the reach of a conventional computer assembled for any amount of money obtainable from the treasuries of all the Five Eyes governments, you're doing something wrong. Don't use RSA-1024; don't use 1024 bit multiplicative group Diffie-Hellman, don't use RC4, and then stop worrying about NSA supercomputers.

Per our previous discussion, you should probably add hash and KDF issues to this list.

I also find supercomputers relevant to PRNGs, both on the overall PRNG security front and on the inadequate seeding front. Since CSPRNGs are not designed to be slow to calculate, supercomputers can be used to attack key generation from inadequate seeding, given some useful model of what the effective space of seeds could have been.

For instance, there are probably still many embedded systems that are initializing without anything that is reasonably called "environmental noise", and their state space is dangerously small, yet maybe still challenging for most organizations to search, depending on exactly what they initialized it with.

Re: NSA Brute-Force Keysearch Machine

#16

Post by nyolfen »

yeukhon wrote: post #9

"Unfortunately, the Intercept decided not to publish most of the document, so all of those people with "a Ph.D. in a related field" can't read and understand WindsorGreen's capabilities. What sorts of key lengths can the machine brute force? Is it optimized for symmetric or asymmetric cryptanalysis? Random brute force or dictionary attacks? We have no idea." When I was reading the news article, I thought to myself, s…

> When I was reading the news article, I thought to myself, should they really be publishing classified information?

are you not familiar with the intercept? it was initally created mainly to publish snowden documents

> wouldn't that consider a crime just like leaking to Wiki Leaks?

we have freedom of the press in america

Re: NSA Brute-Force Keysearch Machine

#17

Post by schoen »

cavanasm wrote: post #5
sp332 wrote: post #3

Earlier quoted context omitted.

ASICs are not reprogrammable. And they're expensive to build, but the NSA apparently has the resources to build new ones at semi-regular intervals, so I don't know if switching algorithms would really slow them down that much.

I think grandparent was suggesting custom encryption algorithm (potentially less secure) to prevent use of a brute force approach that's custom made for a specific algorithm.

I thought I heard some presentation about superencipherment with AES + some cipher (maybe derived from AES) with per-session randomized S-boxes. You would include the S-boxes in the message as a sort of salt.

The goal of this is that if there is a cryptanalytic attack that gives brute force a 2⁴⁰ speedup and hence attackers build custom hardware to implement it, their hardware is still not effective against the other cipher and they have to do something different (maybe hard to characterize how difficult the different thing would be anticipated to be).

Re: NSA Brute-Force Keysearch Machine

#18

Post by tptacek »

schoen wrote: post #15
tptacek wrote: post #12

Earlier quoted context omitted.

No, it would not be. If you're using algorithms or constructions that are physically within the reach of a conventional computer assembled for any amount of money obtainable from the treasuries of all the Five Eyes governments, you're doing something wrong. Don't use RSA-1024; don't use 1024 bit multiplicative group Diffie-Hellman, don't use RC4, and then stop worrying about NSA supercomputers.

Per our previous discussion, you should probably add hash and KDF issues to this list. I also find supercomputers relevant to PRNGs, both on the overall PRNG security front and on the inadequate seeding front. Since CSPRNGs are not designed to be slow to calculate, supercomputers can be used to attack key generation from inadequate seeding, given some useful model of what the effective space of seeds could have been.…

The embedded systems cold start entropy problem is a good point I hadn't thought about before.

Of course (not that you disagree), if you have this problem, you have it with or without NSA supercomputers!

I don't think CryptGenRandom or urandom on general-purpose computers is a viable target for this, though, regardless of how "fast" the CSPRNG is.

Re: NSA Brute-Force Keysearch Machine

#19

Post by yeukhon »

nyolfen wrote: post #16
yeukhon wrote: post #9

"Unfortunately, the Intercept decided not to publish most of the document, so all of those people with "a Ph.D. in a related field" can't read and understand WindsorGreen's capabilities. What sorts of key lengths can the machine brute force? Is it optimized for symmetric or asymmetric cryptanalysis? Random brute force or dictionary attacks? We have no idea." When I was reading the news article, I thought to myself, s…

> When I was reading the news article, I thought to myself, should they really be publishing classified information? are you not familiar with the intercept? it was initally created mainly to publish snowden documents > wouldn't that consider a crime just like leaking to Wiki Leaks? we have freedom of the press in america

Freedom of press does not mean you can just report on classified information without consequences. You can't just go into Google office and start leaking an NDA project. In this circumstances, sure, the document was available publicly. But since it has been hidden, wouldn't further distribution considered illegal?

Re: NSA Brute-Force Keysearch Machine

#20

Post by tptacek »

yeukhon wrote: post #19
nyolfen wrote: post #16

Earlier quoted context omitted.

> When I was reading the news article, I thought to myself, should they really be publishing classified information? are you not familiar with the intercept? it was initally created mainly to publish snowden documents > wouldn't that consider a crime just like leaking to Wiki Leaks? we have freedom of the press in america

Freedom of press does not mean you can just report on classified information without consequences. You can't just go into Google office and start leaking an NDA project. In this circumstances, sure, the document was available publicly. But since it has been hidden, wouldn't further distribution considered illegal?

Unlawful, in the NDA case. It's not illegal to break a contract.
Post reply on HN