Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA's Backdoor in Dual EC

twitter.com

Post reply on HN
Print view View original

11–20 of 95 posts

Re: The NSA's Backdoor in Dual EC

#11

Post by khuey »

dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

The attackers didn't get the keys to the back door. They actually replaced the entire door with a new door that they made, which went unnoticed (by Juniper) for 3 years, locking out the owners of the original back door too. It's a rather impressive attack.

Re: The NSA's Backdoor in Dual EC

#12

Post by khuey »

perihelions wrote: post #8

I don't understand the significance of the Dual EC vulnerabilities here. The attackers had write access to the target's crypto code, and altered it to their convenience. What cryptosystem is secure against that threat model? That the "re-keying" edit fits in 32 bytes is a neat math trick, but doesn't seem to me like a central issue. What am I misunderstanding? > "In practice this would simply mean hacking into a majo…

The implication here is that the "change a 32 byte constant that nobody knows the provenance of to begin with" thing is what allowed this to fly under the radar for 3 years compared to an "if (attacker) { give_root(); }"-style insertion.

Re: The NSA's Backdoor in Dual EC

#13

Post by jokoon »

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography.

I've heard the NSA is one of the biggest employer of math people.

At that point, I'm guessing some form of obscurity might somehow be a better idea to protect data from the NSA, or at least it would force NSA employees to analyze some obfuscated data, buying more time than just using mainstream methods.

In the end, I don't think nobody has good enough reason to hide stuff from the US government, at least that's my opinion, as long as the US gov is not too evil or not too corrupt. As long as other dangerous governments or criminals can't do too much cyber damage, things are fine.

I'm still curious if ML can create new kinds of cryptography.

Maybe a time will come where China/Russia will have enough expertise to break good enough crypto, and then the cyber battlefield will really change.

Re: The NSA's Backdoor in Dual EC

#14

Post by tinus_hn »

perihelions wrote: post #8

I don't understand the significance of the Dual EC vulnerabilities here. The attackers had write access to the target's crypto code, and altered it to their convenience. What cryptosystem is secure against that threat model? That the "re-keying" edit fits in 32 bytes is a neat math trick, but doesn't seem to me like a central issue. What am I misunderstanding? > "In practice this would simply mean hacking into a majo…

Now do this without anyone noticing!

Re: The NSA's Backdoor in Dual EC

#15

Post by bob1029 »

ackbar03 wrote: post #10
bob1029 wrote: post #4

Calling out the cryptographic community on this has always resulted in becoming tarred & feathered in my experience. "How dare you question these experts? You are not a cryptographer." No, I am not. But, I understand information theory and people. I don't need an ivory tower credential to call out potential bullshit or leverage my own intuition. This kind of nonsense also makes me wonder how many of those "dont roll…

Then you my friend are free to roll your own crypto

Just so we are clear, rolling my own crypto doesnt necessarily involve reinventing SHA256 and AES from scratch.

It just means using these primitives directly rather than farming out and allowing others to select the underlying methods for you.

I use Microsoft's cryptographic implementations, but I don't let them pick the method for me. I don't think this is unreasonable if you have some experience in the space.

Re: The NSA's Backdoor in Dual EC

#16

Post by marcan_42 »

jokoon wrote: post #13

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography. I've heard the NSA is one of the biggest employer of math people. At that point, I'm guessing some form of obscurity might somehow be a better idea to protect data from the NSA, or at least it would force NSA employees to analyze some obfuscated data, buying more time than just using mainstre…

This has nothing to do with brain power. This was a deliberately backdoored algorithm that any cryptographer familiar with elliptic curve cryptography could've come up with. It wasn't even good or clever, seeing as people saw through it almost immediately. The only thing it had going for it is it was plausibly deniable and that allowed the US government to force people to implement it, since nobody could prove the NSA really had the secret keys.

Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography. If they could, they wouldn't need to try to push through blatant backdoors like this.

If you want to be safe from the NSA, use well-vetted, simple, auditable cryptography tools. The NSA doesn't break real crypto any more, they just find or make software bugs.

The only "thing the NSA has probably broken" that comes to mind in the modern crypto world is when people realized that you could do a one time mass computation for fixed parameters for n-bit Diffie-Hellman and then use the result to decrypt any communications that that used them, efficiently... which was a bit of a problem when tons of software around the world was using default parameters, often 1024-bit, which is in "the NSA can almost certainly break it" range. I remember when that happened, I went through all my servers and re-generated my own dh parameters for OpenSSL, at 4096 bits. But this wasn't a particularly mind blowing idea, it was more like an "oh shit" moment since everyone knew the NSA had the storage/compute budget to actually carry out this attack. But anyone serious about crypto shouldn't have been using 1024-bit DH anyway; it was just a failure of the ecosystem that nobody had proactively deprecated such small sizes.

Re: The NSA's Backdoor in Dual EC

#17

Post by yk »

perihelions wrote: post #8

I don't understand the significance of the Dual EC vulnerabilities here. The attackers had write access to the target's crypto code, and altered it to their convenience. What cryptosystem is secure against that threat model? That the "re-keying" edit fits in 32 bytes is a neat math trick, but doesn't seem to me like a central issue. What am I misunderstanding? > "In practice this would simply mean hacking into a majo…

It's the kind of hack that survives a security audit. There is no leaked data or anything, it is just that afterwards the crypto works precisely as the standard intended.

Re: The NSA's Backdoor in Dual EC

#18

Post by [deleted] »

khuey wrote: post #12
perihelions wrote: post #8

I don't understand the significance of the Dual EC vulnerabilities here. The attackers had write access to the target's crypto code, and altered it to their convenience. What cryptosystem is secure against that threat model? That the "re-keying" edit fits in 32 bytes is a neat math trick, but doesn't seem to me like a central issue. What am I misunderstanding? > "In practice this would simply mean hacking into a majo…

The implication here is that the "change a 32 byte constant that nobody knows the provenance of to begin with" thing is what allowed this to fly under the radar for 3 years compared to an "if (attacker) { give_root(); }"-style insertion.

[deleted]

Re: The NSA's Backdoor in Dual EC

#19

Post by marcan_42 »

khuey wrote: post #11
dylan604 wrote: post #7

The entire concept of a backdoor that only the good guys have the keys too is so moroinic as to make my blood boil. The TSA locks were picked because a photo of the keys were posted online. The NSA forced an encryption method that they knew how to defeat got pwned. Yet the backdoor method still gets bandied about like it's the one thing to save us when it is exactly what will sink us.

The attackers didn't get the keys to the back door. They actually replaced the entire door with a new door that they made, which went unnoticed (by Juniper) for 3 years, locking out the owners of the original back door too. It's a rather impressive attack.

No, the attackers just re-pinned the backdoor lock cylinder that the NSA put on their "secure" door. That's why nobody noticed. The NSA conveniently left them a door with a backdoor they could hijack in a way that is effectively invisible.

Replacing the whole door would've been like replacing the entire DRBG, which would've much more likely raised alarms.

Post reply on HN