Live data from Hacker News

Calling NSA to find your encryption key after a few bits were flipped (2010)

astroengineer.wordpress.com

11–20 of 125 posts

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#12
Bit flips are scary even on Earth.

At a previous job, we had a customer who suddenly couldn’t send us email anymore. When their IT sent us the server logs to “prove” it’s our fault, we saw that the one letter in the cached MX record was wrong. This was puzzling, until I looked at the ASCII table to verify that the difference was exactly one bit.

We never found out where in the name resolution process the bit got flipped. The problem healed itself a few days later when the DNS cache expired, so it wasn’t worth further investigation.

That really gave me pause how often random bits are wrong in other data.

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#13

Why is traffic from Voyager even encrypted? The results back are public scientific data anyway, right? And it's not like other nations (the only ones with power to transmit that far, back then) would send rogue commands without getting caught.

Voyager launched in 1977 so I find your surprise rather odd. Also it wasn't always so far from Earth that amateurs couldn't reach it.

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#15
post #12

Bit flips are scary even on Earth. At a previous job, we had a customer who suddenly couldn’t send us email anymore. When their IT sent us the server logs to “prove” it’s our fault, we saw that the one letter in the cached MX record was wrong. This was puzzling, until I looked at the ASCII table to verify that the difference was exactly one bit. We never found out where in the name resolution process the bit got flip…

Happens even on end user browsers resulting in bit-flipped domains being looked up: https://securitee.org/files/bitsquatting_www2013.pdf

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#16
post #6

Besides hardware mitigations (radiation hardening, ECC memory) what would be software mitigation techniques for this?

To protect against bit flips in car fly-by-wire systems, each signal is sent three times with the 2/3 majority making the decision. This happened after the runaway Prius fiasco that may have been caused by a gamma ray. Prior to that incident the fly-by-wire system only sent one signal.

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#17

Why is traffic from Voyager even encrypted? The results back are public scientific data anyway, right? And it's not like other nations (the only ones with power to transmit that far, back then) would send rogue commands without getting caught.

Was it? The story is about a spy satellite.

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#18
post #14

This is what worries me about the current push that all backups including the off site tape vault must be encrypted at rest. Any problem with the de-encryption and your data is toast.

This is taken care of at the filesystem level.

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#19

That's pretty fascinating. I admit I find it kind of strange that only the encryption key was affected in this way, i.e. that finding the newly-correct key proved a fix to the issues, as opposed to fixing one issue out of many linked to such an event. It made me wonder--what are the odds of that? What is the relative exposure area of the encryption key compared to the rest of the onboard assets which could have been…

They probably had to find the key to get it to accept a command to restart and reread the key from ROM.

Re: Calling NSA to find your encryption key after a few bits were flipped (2010)

#20
post #14

This is what worries me about the current push that all backups including the off site tape vault must be encrypted at rest. Any problem with the de-encryption and your data is toast.

This is taken care of at the filesystem level.

Can you explain what you mean by that?
Post reply on HN