221–230 of 270 posts
Nope, that was about setting precedent using a case that is very hard to argue against morally, so that they can erode privacy and protections on a wider scale.
Earlier quoted context omitted.
True. Note that some "post-quantum" key exchange schemes already exist (based on lattice cryptography, for which there are no known poly-time quantum attacks), e.g. https://eprint.iacr.org/2015/1092 . But I haven't heard of it being used anywhere.
The sad truth is, until we've spent a lot more time analysing and attacking those algorithms, they aren't as secure as what we've got.
Earlier quoted context omitted.
I've never heard of such technique, what does onioning do?
Use of new encryption algorithm on the ciphertext encrypted by the old algorithm.
There could be double-tree PKI, where nodes in the tree are represented by two key pairs in different kinds of key spaces, with the different signatures terminating in two ephemeral key pairs, which are then used for key derivation, and the subsequent secret perhaps concatenated and boosted into a higher key space? The complexity would be mind boggling. And, weaknesses in one half of the tree could translate into a security reduction on the final symmetric key, so it would have to be way over powered to be effective.
Not a simple problem to solve.
Another thing is important: trust. As a naive user I have no idea what's going on on my phone, hardware or software wise We are essentially trusting these companies with everything. Encryption is no good if Apple and Google provide backdoors to their systems to the CIA or NSA.
Encryption in transit defeats dragnet surveillance. Forcing the NSA et al to actually break into the phones they're interested in substantially reduces the amount of information they can actually collect. They can't just tap internet backbones and read everything, like they do with plaintext communication.
Earlier quoted context omitted.
Mathematically unbreakable if your pad is truly random
Sure, but if your RNG is compromised, there's no point talking about encryption in the first place.
Earlier quoted context omitted.
Sure, but if your RNG is compromised, there's no point talking about encryption in the first place.
Right. So now you have to figure out how to get a secure RNG into people's hands, so they can create pads. How does that work? Genuinely curious whether there's a reasonable solution.
But that was never the problem. The problem is, now what? To use this OTP you need to securely deliver pads to everybody you'll ever send a message to. So, OTP is practical for a handful of secret agents who'll receive messages of a few dozen words per year from a single controller, and useless for most of us in the real world.
_This_ problem is why we have public key cryptography.
Earlier quoted context omitted.
I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".
Then my notebook is 'airgapped'. It connects to internet via wifi :). More seriously, if it connects through non popular means (such as a protocol over sound) it is just security through obscurity.
But don't you think he has a point if he's talking about a simple, single-purpose device like an arduino - say - that can't connect to the internet, but allows keyboard entry of plaintext, then encrypts it, sends ciphertext to a PC via audio?
I which case I think there are some advantages in using audio; if the device used wifi / ethernet / USB then you have to trust a lot of code to be exploit free:
- ethernet driver code - wifi chip firmware - kernel network code - USB drivers etc
Whereas if he's written his own simple bytes-to-audio converter in a few hundred lines of code that can be audited, then I can be be more easily convinced that it's not possible for an adversary to remotely install a keylogger or extract keys from my little encryption device.
Does it? Maybe it's a huge false flag campaign. You should always operate under the assumption that "they" can see everything they want to see on your internet connected device if they deem you important enough. For example, what's with that one news story about government agencies being unable to break TrueCrypt. How did that get out? Sounds like a huge bullshit campaign to me, aimed at creating trust in TrueCrypt!…