Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

N.S.A. Foils Much Internet Encryption

nytimes.com

Post reply on HN
Print view View original

21–30 of 395 posts

Re: N.S.A. Foils Much Internet Encryption

#21

Post by smtddr »

dailyrorschach wrote: post #3

This is likely a minority view, but I have no problem with the NSA being able to break encryption, that's in fact part of their job. Decoding encryption has long been part of their mission. I also suspect they're not alone in terms of signals intelligence groups in having this capability. The issue to me has always been how and what data they access and store, and how it is used.

I have a problem with encryption being breakable, regardless of who's doing the breaking. I want encryption to be mathematically solid with the only option being brute-force older-than-age-of-earth time. When we get to quantum computing, then I don't know what we'll do...

Re: N.S.A. Foils Much Internet Encryption

#22

Post by mindslight »

I feel like these kinds of articles are meant to induce a sense of hopelessness regarding the ability to push back against the NSA.

If it turns out one way functions actually don't exist, I'll give in and learn to love big brother. Withstanding that, I'll continue considering communications freedom (and all that it implies) as our manifest right and view these types of breaks as implementation errors.

Re: N.S.A. Foils Much Internet Encryption

#24

Post by dictum »

cromwellian wrote: post #14
16s wrote: post #5

Normal people don't need 256-bit symmetric encryption. That's assault encryption and should only be used on the battlefield. 40-bits is enough and anything over that should be banned. I'm only joking, but the same argument is used against other technologies that governments seek to control/dominate. Edit: Skipjack was 80-bits I think. It was used in Clipper Phones: http://en.wikipedia.org/wiki/Skipjack_(cipher)

People don't take a 256-bit cryptoalgorithm into a middle school and kill kids with it, so I don't think the analogy works exactly. Maybe if you print it out on paper, or use a floppy disk or CD, you could cut a few people.

People who intend to enter a middle school and kill kids can hide their plans and communications using 256-bit encryption.

Edit: Devil's advocate.

Re: N.S.A. Foils Much Internet Encryption

#25

Post by jonknee »

w1ntermute wrote: post #17

Can someone who actually knows about encryption comment on whether it's actually physically feasible for the NSA to have actually broken, say, SSL 3.0 (which has 128 bits of entropy, IIRC) on a large scale (i.e., when you're sifting through petabytes of data on a daily basis)? And if this were really an issue, couldn't you just use 4096-bit RSA (unless they have managed to surreptitiously insert a backdoor in it)?

Brute force is only required if there isn't a vulnerability (either in the algorithm or that the NSA has a key).

> Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.”

> N.S.A. documents show that the agency maintains an internal database of encryption keys for specific commercial products, called a Key Provisioning Service, which can automatically decode many messages. If the necessary key is not in the collection, a request goes to the separate Key Recovery Service, which tries to obtain it.

Re: N.S.A. Foils Much Internet Encryption

#26

Post by patdennis »

Achshar wrote: post #12

So does this means they have broken or fund a bug in RSA, fast enough computers to brute force or solved the P versus NP problem. In decreasing chances of possibility. I am also an encryption noob, so I gather that if they have broken a crypto then my 4096 bit files will be no more secure than 1024 bit ones. Right?

If they solved P vs NP... well. Yeah. That would be interesting.

Re: N.S.A. Foils Much Internet Encryption

#29

Post by untog »

Because strong encryption can be so effective, classified N.S.A. documents make clear, the agency’s success depends on working with Internet companies — by getting their voluntary collaboration, forcing their cooperation with court orders or surreptitiously stealing their encryption keys or altering their software or hardware.

That's the money quote there- the NSA hasn't cracked encryption. They've just put back doors in.

And we can't even be that angry at the (e.g.) Microsoft execs that authorise the back doors- they potentially face jail time if they resist NSA requests. All the while presumably not able to talk about the requests publicly.

EDIT: and the really fun part - did you know the former head of the NSA serves on the board of directors for Motorola Solutions? http://en.wikipedia.org/wiki/Michael_Hayden_(general)

Re: N.S.A. Foils Much Internet Encryption

#30

Post by pfortuny »

w1ntermute wrote: post #17

Can someone who actually knows about encryption comment on whether it's actually physically feasible for the NSA to have actually broken, say, SSL 3.0 (which has 128 bits of entropy, IIRC) on a large scale (i.e., when you're sifting through petabytes of data on a daily basis)? And if this were really an issue, couldn't you just use 4096-bit RSA (unless they have managed to surreptitiously insert a backdoor in it)?

It might be but it is highly dubious. However, they MIGHT have put some effort into "plugging" each implementation and planting a subtle bug in them. You never can tell.

It is not somuch the protocol what matters but the implementations.

Imagine they "rig" all those beatiful hardware RNG. Could you tell the difference?

Are you sure renowned developer X van Y is not an NSA mole?

Post reply on HN