N.S.A. Foils Much Internet Encryption • Hacker News Board

Re: N.S.A. Foils Much Internet Encryption

#191

Post by unimpressive » Thu, Sep 05, 2013, 9:03 PM UTC

m0nastic wrote: post #170

smutticus wrote: post #55

Reminds me of this: http://marc.info/?l=openbsd-tech&m=129236621626462&w=2 As someone who has been following the NSA and government monitoring of online activity for close to 15 years the Snowden leaks just keep taking the wind out of me. It's like everything that we thought might be going on was actually going on. When Theo de Raadt wrote the above mail I, like many at the time, assumed it was tinfoil hat territory.…

In that particular instance you weren't wrong[1], but that's the problem when stories like this come out, is that it makes it much harder to know what's a crazy conspiracy theory and what's real. [1] Those claims made by Greg are completely untrue. I ran the professional services group for that company and will happily attest to whomever asks that at no time did we insert a backdoor (or anything that could even be co…

>Those claims made by Greg are completely untrue. I ran the professional services group for that company and will happily attest to whomever asks that at no time did we insert a backdoor (or anything that could even be construed as such) into IPSEC.

Somehow I doubt if you did that you could tell us. You might even have to lie to be able to comment on that letter at all.

Re: N.S.A. Foils Much Internet Encryption

#192

Post by aliston » Thu, Sep 05, 2013, 9:03 PM UTC

mrb wrote: post #149

tc wrote: post #68

This is really damaging. Not only will this cause other countries to put up barriers against US (and UK) services and products, it's going to affect uptake of standards developed here. On the lighter side, a treasure hunt was just announced. Can you find one of these vulnerabilities, or evidence of the NSA having attacked a particular system to steal keys? ---- [Edit 1] Some speculation: By careful hardware design --…

I think we know very well which encryption has been foiled by the NSA. This is not speculation, but quasi-certainty: 1024-bit RSA. - Crytographers all acknowledge 1024-bit RSA is dead [1]. - Attack cost 10 years ago was estimated to be a few million USD to build a device able to crack a 1024-bit key every 12 months [2]. - "Much of" the "secure" HTTPS websites use such weak key sizes [3]. - NSA had a budget of 10.8 bi…

The article you linked to in [1] doesn't explicitly say that generalized 1024-bit RSA is dead. They found a way to exploit a special case key (Mersenne number keys). Searching around the internet, I found a bunch of articles about supposed cracks, but they all involved additional sources of information. I'm not doubting that the NSA has found ways to crack all sorts of crypto, but is there really a known way to break 1024-bit RSA without other special qualifiers?

Re: N.S.A. Foils Much Internet Encryption

#193

Post by betterunix » Thu, Sep 05, 2013, 9:03 PM UTC

tptacek wrote: post #85

You can't have read Applied Cryptography from the mid-90s and not understand this to have been NSA's M.O. from the jump. Bruce Scheier, who was quoted in the Guardian piece about the same story, is America's foremost popularizer of the notion of NSA as crypto's global passive adversary. People who build real cryptosystems have never, ever been allowed to rely on the goodwill of the NSA not to cryptanalyze their syste…

What amazes and saddens me about this, though, is that I was one of the people who thought that we could draw a line -- the NSA was obviously going to keep its cryptanalysis techniques secret, they probably listened to everything, but the idea that they were actively sabotaging cryptosystems just seemed like to far-fetched a conspiracy theory. Half their mission is to protect US communications from foreigners, and backdoors are the most obvious way to not achieve that goal.

Yet here we have proof that the NSA is truly in the business of sabotaging cryptosystems that are in general use. Those systems protect US interests as much as foreign interests, and now they are not trustworthy. Now I am left wondering -- PGP, for example, deviates from theoretical constructions of non-malleable encryption; might that have been the NSA's doing? What about the problems in various versions of TLS? Now it is hard to say what is an honest mistake and what is a deliberate effort to undermine computer security.

We are now past the point of not blaming on malice what we can attribute to stupidity, because we have evidence that there is actual malice on a grand scale. It is a truly sad day for this world...

Re: N.S.A. Foils Much Internet Encryption

#194

Post by tptacek » Thu, Sep 05, 2013, 9:03 PM UTC

gamble wrote: post #188

tptacek wrote: post #184

Earlier quoted context omitted.

What? Which documents confirm backdoors in TPM chips?

Even without naming the companies involved, it's very hard to imagine they are inserting backdoors in less-valued products while somehow missing the crown jewels of Windows and TPM.

Ah, so if we can imagine it, it must be true.

Re: N.S.A. Foils Much Internet Encryption

#195

Post by javert » Thu, Sep 05, 2013, 9:04 PM UTC

rahoulb wrote: post #81

untog wrote: post #64

Earlier quoted context omitted.

Even "your own hardware" is going to be pretty damn hard: working with chipmakers to insert back doors So you're going to need to make your own chips, too.

RMS doesn't seem such an extremist any more.

I don't agree with RMS on much, but this just goes to show that calling people "extremist" is a logical fallacy. There is only correct and incorrect, and the margin by which something deviates from a commonly accepted norm is irrelevant to judging that.

Re: N.S.A. Foils Much Internet Encryption

#196

Post by venomsnake » Thu, Sep 05, 2013, 9:06 PM UTC

lambda wrote: post #131

> A 2010 document calls for “a new approach for opportunistic decryption, rather than targeted.” By that year, a Bullrun briefing document claims that the agency had developed “groundbreaking capabilities” against encrypted Web chats and phone calls. Its successes against Secure Sockets Layer and virtual private networks were gaining momentum. This paragraph interests me the most. For one, it's clear that their goal…

As Snowden showed you need only one rogue admin most of the times to get what you want

Re: N.S.A. Foils Much Internet Encryption

#197

Post by tptacek » Thu, Sep 05, 2013, 9:06 PM UTC

betterunix wrote: post #193

tptacek wrote: post #85

You can't have read Applied Cryptography from the mid-90s and not understand this to have been NSA's M.O. from the jump. Bruce Scheier, who was quoted in the Guardian piece about the same story, is America's foremost popularizer of the notion of NSA as crypto's global passive adversary. People who build real cryptosystems have never, ever been allowed to rely on the goodwill of the NSA not to cryptanalyze their syste…

What amazes and saddens me about this, though, is that I was one of the people who thought that we could draw a line -- the NSA was obviously going to keep its cryptanalysis techniques secret, they probably listened to everything, but the idea that they were actively sabotaging cryptosystems just seemed like to far-fetched a conspiracy theory. Half their mission is to protect US communications from foreigners, and ba…

No, that's not NSA's doing. PGP predates the theoretical constructions you're referring to. Bellare/Namprempre was something like 5 years after the first "modern" PGP (IIRC the original PGP used a terribly broken cipher of Zimmerman's own design). Also, malleability is not a particularly lucrative capability for NSA to have, even if you want to assume that the integrity mechanisms in PGP are broken.

Re: N.S.A. Foils Much Internet Encryption

#198

Post by lambda » Thu, Sep 05, 2013, 9:08 PM UTC

magicalist wrote: post #150

tytso wrote: post #87

I am so glad I resisted pressure from engineers working at Intel to let /dev/random in Linux rely blindly on the output of the RDRAND instructure. Relying solely on an implementation sealed inside a chip and which is impossible to audit is a BAD idea. Quoting from the article... "By this year, the Sigint Enabling Project had found ways inside some of the encryption chips that scramble information for businesses and g…

Was that really a seriously considered plan? I don't see how that would ever be a suitable /dev/random replacement. Obviously it works for /dev/urandom, but it should be added to the entropy pool for /dev/random at most.

Matt Mackall, the former maintainer of /dev/random, actually stepped down over this issue, because Linus overrode Matt and applied Intel's patch that used their hardware random number generator directly:

http://comments.gmane.org/gmane.comp.security.cryptography.r...

> It's worth noting that the maintainer of record (me) for the Linux RNG quit the project about two years ago precisely because Linus decided to include a patch from Intel to allow their unauditable RdRand to bypass the entropy pool over my strenuous objections.

> From a quick skim of current sources, much of that has recently been rolled back (/dev/random, notably) but kernel-internal entropy users like sequence numbers and address-space randomization appear to still be exposed to raw RdRand output.

Ted Ts'o later reverted this, separating out Intel's hardware random number generation into a separate function that could be used to seed the entropy pool but wouldn't be trusted directly as the main kernel source of random numbers:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...

Re: N.S.A. Foils Much Internet Encryption

#199

Post by [deleted] » Thu, Sep 05, 2013, 9:09 PM UTC

csense wrote: post #162

> In effect, facing the N.S.A.’s relentless advance, [Lavabit] surrendered I disagree with this characterization. Surrendering to the NSA would be Google/Facebook/Microsoft's approach of unconditional cooperation. Lavabit's refusal to work with the NSA -- even though apparently the only alternative was shutting down their business or going to jail -- is more along the lines of a scorched earth retreat (destroying you…

[deleted]

Re: N.S.A. Foils Much Internet Encryption

#200

Post by lambda » Thu, Sep 05, 2013, 9:09 PM UTC

tptacek wrote: post #186

lambda wrote: post #176

Earlier quoted context omitted.

Ah, yes, I wasn't trying to say they were exploiting that particular vulnerability. Just that we now have better evidence that that really was a (rather poor) attempt to subvert standards to make them easier to decrypt. The NSA seems to be really divided between SIGINT and COMSEC. COMSEC wants to provide good, strong encryption, that can help secure US government and corporate communication. SIGINT wants to be able t…

Nitpick: they changed DES's S-boxes. DSA doesn't have S-boxes. Skepticism about NSA's involvement in any crypto standard (a decade ago!) led NIST to document precisely the mechanism used to generate DSA's parameters. I think maybe it's the fact that I started in the industry during the era of Clipper that stuff like this doesn't faze me much.

Gah. I even noticed that typo while writing it, then forgot about it after having edited another part of my comment. Yes, I meant DES, not DSA.