Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA Brute-Force Keysearch Machine

schneier.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: NSA Brute-Force Keysearch Machine

#21

Post by tptacek »

schoen wrote: post #17
cavanasm wrote: post #5

Earlier quoted context omitted.

I think grandparent was suggesting custom encryption algorithm (potentially less secure) to prevent use of a brute force approach that's custom made for a specific algorithm.

I thought I heard some presentation about superencipherment with AES + some cipher (maybe derived from AES) with per-session randomized S-boxes. You would include the S-boxes in the message as a sort of salt. The goal of this is that if there is a cryptanalytic attack that gives brute force a 2⁴⁰ speedup and hence attackers build custom hardware to implement it, their hardware is still not effective against the other…

Don't ever do this. The interaction of different crypto algorithms can be counterintuitive (in the sense that you won't gain what you think you're gaining), it's extraordinarily expensive in ways unbalanced against defenders, and it introduces new implementation errors that can weaken the whole system.

If you're paranoid about AES, use Chapoly (or just use Chapoly because it's in many ways more convenient to use than AES). Don't build elaborate cascades (all cascades qualify), and don't randomize S-boxes.

It is hard enough getting these systems right when you're playing exactly by the book. If you're designing a cryptosystem and you're not a professional cryptographer, the list of things you should be worried about getting wrong is very long and very scary.

Re: NSA Brute-Force Keysearch Machine

#22

Post by schoen »

tptacek wrote: post #21
schoen wrote: post #17

Earlier quoted context omitted.

I thought I heard some presentation about superencipherment with AES + some cipher (maybe derived from AES) with per-session randomized S-boxes. You would include the S-boxes in the message as a sort of salt. The goal of this is that if there is a cryptanalytic attack that gives brute force a 2⁴⁰ speedup and hence attackers build custom hardware to implement it, their hardware is still not effective against the other…

Don't ever do this. The interaction of different crypto algorithms can be counterintuitive (in the sense that you won't gain what you think you're gaining), it's extraordinarily expensive in ways unbalanced against defenders, and it introduces new implementation errors that can weaken the whole system. If you're paranoid about AES, use Chapoly (or just use Chapoly because it's in many ways more convenient to use than…

By "don't build elaborate cascades (all cascades qualify)", do you mean "no cascade construction is preferable to any other", or "every cascade is too elaborate to be worthwhile"? (The second implies the first, but the first doesn't imply the second.)

Re: NSA Brute-Force Keysearch Machine

#23

Post by jokr004 »

robert_foss wrote: post #4
sp332 wrote: post #3

Earlier quoted context omitted.

ASICs are not reprogrammable. And they're expensive to build, but the NSA apparently has the resources to build new ones at semi-regular intervals, so I don't know if switching algorithms would really slow them down that much.

Considering that it takes 1-2 years to spin custom silicon I would say that it is a viable approach.

That's not true at all. Were you paying attention to the development of bitcoin asics? Those things popped up fast once the idea spread.

Re: NSA Brute-Force Keysearch Machine

#24

Post by tptacek »

schoen wrote: post #22
tptacek wrote: post #21

Earlier quoted context omitted.

Don't ever do this. The interaction of different crypto algorithms can be counterintuitive (in the sense that you won't gain what you think you're gaining), it's extraordinarily expensive in ways unbalanced against defenders, and it introduces new implementation errors that can weaken the whole system. If you're paranoid about AES, use Chapoly (or just use Chapoly because it's in many ways more convenient to use than…

By "don't build elaborate cascades (all cascades qualify)", do you mean "no cascade construction is preferable to any other", or " every cascade is too elaborate to be worthwhile"? (The second implies the first, but the first doesn't imply the second.)

Every symmetric cipher cascade is bad.

Re: NSA Brute-Force Keysearch Machine

#25

Post by tptacek »

wand3r wrote: post #6

Schneier often has great insight but this blog post was pretty much the opposite of that. I think I recall reading the original post from the guy who found that NYU info; and I def. read the Intercept piece. Schneier's post quotes the original article and says unfortunately we don't know more. Literally over 50% of it is a quote from another article which he derides for it's lack of substance. Not sure what the point…

For better or worse --- I think, often, it's for the worse ---- Schneier has an audience that wants his reaction on all the crypto news of the day. This is his reaction to the Intercept story. In this case, by the way, I think he's dead on.

We all need to resist the urge to judge pages linked from HN in the context of "worthy of the front page of Hacker News". Sometimes authors are writing explicitly to that kind of audience, but often, as in this case, they're not. In the context of the service Schneier is trying to provide, this is a solid and useful post.

Re: NSA Brute-Force Keysearch Machine

#26

Post by pvg »

yeukhon wrote: post #19
nyolfen wrote: post #16

Earlier quoted context omitted.

> When I was reading the news article, I thought to myself, should they really be publishing classified information? are you not familiar with the intercept? it was initally created mainly to publish snowden documents > wouldn't that consider a crime just like leaking to Wiki Leaks? we have freedom of the press in america

Freedom of press does not mean you can just report on classified information without consequences. You can't just go into Google office and start leaking an NDA project. In this circumstances, sure, the document was available publicly. But since it has been hidden, wouldn't further distribution considered illegal?

Freedom of press does not mean you can just report on classified information without consequences.

In the US, you effectively can, assuming you are actually the press and have the means of defending yourself. While there are laws on the books that supposedly limit this in various ways, they are generally not invoked - notice the government typically asks papers to delay publishing classified information they may have received.

Re: NSA Brute-Force Keysearch Machine

#27

Post by kevin_thibedeau »

robert_foss wrote: post #4
sp332 wrote: post #3

Earlier quoted context omitted.

ASICs are not reprogrammable. And they're expensive to build, but the NSA apparently has the resources to build new ones at semi-regular intervals, so I don't know if switching algorithms would really slow them down that much.

Considering that it takes 1-2 years to spin custom silicon I would say that it is a viable approach.

Gate arrays can be pumped out in weeks to days if you control the fab.

Re: NSA Brute-Force Keysearch Machine

#28

Post by _qbxp »

tptacek wrote: post #24
schoen wrote: post #22

Earlier quoted context omitted.

By "don't build elaborate cascades (all cascades qualify)", do you mean "no cascade construction is preferable to any other", or " every cascade is too elaborate to be worthwhile"? (The second implies the first, but the first doesn't imply the second.)

Every symmetric cipher cascade is bad.

So the cascading cypher options (AES-Serpent-Blowfish) for VeraCrypt volumes are less safe than a simple AES encrypted volume?

Serious question. I know nothing about crypto, just assumed "more is better, but slower".

Re: NSA Brute-Force Keysearch Machine

#29

Post by tptacek »

_qbxp wrote: post #28
tptacek wrote: post #24

Earlier quoted context omitted.

Every symmetric cipher cascade is bad.

So the cascading cypher options (AES-Serpent-Blowfish) for VeraCrypt volumes are less safe than a simple AES encrypted volume? Serious question. I know nothing about crypto, just assumed "more is better, but slower".

Anything that uses Blowfish since 2010 is incompetently designed (Blowfish has an 8-byte block size).

AES-Serpent is probably not less safe than AES; it's just not necessarily as much more safe as you'd expect.

A much bigger concern than which precise ciphers you're using is which block cipher mode you're operating under; Truecrypt/Veracrypt uses XTS --- like most disk encryption --- which (among other things) isn't authenticated.

The funniest thing about TC/VC's cascades is that the keys are derived from passwords anyways: a giant clunking complicated block cipher cascade resting on top of a low-entry password secret. It's just a silly design.

Re: NSA Brute-Force Keysearch Machine

#30

Post by wakkaflokka »

tptacek wrote: post #29
_qbxp wrote: post #28

Earlier quoted context omitted.

So the cascading cypher options (AES-Serpent-Blowfish) for VeraCrypt volumes are less safe than a simple AES encrypted volume? Serious question. I know nothing about crypto, just assumed "more is better, but slower".

Anything that uses Blowfish since 2010 is incompetently designed (Blowfish has an 8-byte block size). AES-Serpent is probably not less safe than AES; it's just not necessarily as much more safe as you'd expect. A much bigger concern than which precise ciphers you're using is which block cipher mode you're operating under; Truecrypt/Veracrypt uses XTS --- like most disk encryption --- which (among other things) isn't…

What would be your ultimate recommendation on storing sensitive data, if not TC/VC?
Post reply on HN