Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Times Pulls Article Blaming Encryption in Paris Terror Attack

insidesources.com

Post reply on HN
Print view View original

261–270 of 312 posts

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#261

Post by Laforet »

noselfrighteous wrote: post #257
nickbauman wrote: post #225

Earlier quoted context omitted.

The most dangerous terrorists have probably already reverted to couriers with one-time pads. One-time pads are uncrackable, yet they were used extensively before modern cryptography was even invented. They're cumbersome and constrained but very effective. No amount of mass surveillance will alter their efficacy. https://en.wikipedia.org/wiki/One-time_pad

So I read the wiki on the One-time pad and there's something I'm a little stuck on. There's a statement (paraphrasing) that the OTP is immune to cryptanalysis (brute force) because any given key translates to all possible plain-text, and the viable words all have a-priori the same likelihood. The thing I'm stuck on though, isn't it still possible to do semantic analysis on the various permutations. Basically reading…

Well no. What you are describing is basically searchig through all permissible permutations in a given search space, i.e. a thousand monkeys with typewriters. Fron time to time the system will produce something that is not gibberish, but there is no way of knowing if it is related to the true message at all.

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#262

Post by 542458 »

noselfrighteous wrote: post #257
nickbauman wrote: post #225

Earlier quoted context omitted.

The most dangerous terrorists have probably already reverted to couriers with one-time pads. One-time pads are uncrackable, yet they were used extensively before modern cryptography was even invented. They're cumbersome and constrained but very effective. No amount of mass surveillance will alter their efficacy. https://en.wikipedia.org/wiki/One-time_pad

So I read the wiki on the One-time pad and there's something I'm a little stuck on. There's a statement (paraphrasing) that the OTP is immune to cryptanalysis (brute force) because any given key translates to all possible plain-text, and the viable words all have a-priori the same likelihood. The thing I'm stuck on though, isn't it still possible to do semantic analysis on the various permutations. Basically reading…

No. What you described will work for a simple substitution cypher, but not for a one time pad. A one time pad is the same length as the message, and permutates every letter independently. Trying all keys will yield every possible plaintext. For example the phrase:

"The swallow flies at midnight"

May (with a one time pad) be encrypted into

"WD4oXOl8yO0QtD4sOf7ip0P7ScIia"

(which, incidentally, is indistinguishable from random noise)

If you just bruteforced that by xor'ing every character with every other possible character you could derive every possible message of that length, such as:

"garfield hate lasagna someday"

"men are cats why even bother?"

"pocket knives go to space yay"

etc ad infinitum

No measure of semantic analysis will help you here!

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#263

Post by noselfrighteous »

542458 wrote: post #262
noselfrighteous wrote: post #257

Earlier quoted context omitted.

So I read the wiki on the One-time pad and there's something I'm a little stuck on. There's a statement (paraphrasing) that the OTP is immune to cryptanalysis (brute force) because any given key translates to all possible plain-text, and the viable words all have a-priori the same likelihood. The thing I'm stuck on though, isn't it still possible to do semantic analysis on the various permutations. Basically reading…

No. What you described will work for a simple substitution cypher, but not for a one time pad. A one time pad is the same length as the message, and permutates every letter independently. Trying all keys will yield every possible plaintext . For example the phrase: "The swallow flies at midnight" May (with a one time pad) be encrypted into "WD4oXOl8yO0QtD4sOf7ip0P7ScIia" (which, incidentally, is indistinguishable fro…

Ahh yep, got it.

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#264

Post by bhauer »

noselfrighteous wrote: post #257
nickbauman wrote: post #225

Earlier quoted context omitted.

The most dangerous terrorists have probably already reverted to couriers with one-time pads. One-time pads are uncrackable, yet they were used extensively before modern cryptography was even invented. They're cumbersome and constrained but very effective. No amount of mass surveillance will alter their efficacy. https://en.wikipedia.org/wiki/One-time_pad

So I read the wiki on the One-time pad and there's something I'm a little stuck on. There's a statement (paraphrasing) that the OTP is immune to cryptanalysis (brute force) because any given key translates to all possible plain-text, and the viable words all have a-priori the same likelihood. The thing I'm stuck on though, isn't it still possible to do semantic analysis on the various permutations. Basically reading…

I am out of my element here, but my understanding is that since the key is equal in length to the message, there is no way for you to know whether you are simply seeing a pattern in the key or a pattern in the message.

Imagine a one time pad made for encoding numbers that used a "MOD 10" operation on each digit.

Then imagine the key is:

    6926560279774
And the message is:

    0000000000000
The output is:

    6926560279774
Alternative messages:

    1234567890123 -> 7150027069897
    1111111111111 -> 7037671370885
In all cases, the patterns that you can discern may be from my message and may be from the key. As an analyst, you can't tell.

If this were English letters rather than numbers, and you know 'e' is very common, you still can't get anywhere because each 'e' is encoded with a unique character from the key.

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#265

Post by snowwrestler »

freshhawk wrote: post #239
snowwrestler wrote: post #227

Earlier quoted context omitted.

It's not just that federally-mandated backdoors increase the chance of compromise (although they certainly do). If the U.S. government can mandate that technology companies provide access through encryption, then so can other countries. Sovereignty is still a powerful concept under international law. So imagine if Apple, upon condition of selling iPhones within China, must provide the Chinese government with a backdo…

> I don't think that federal intelligence and law enforcement officials calling for backdoors have fully thought through the consequences I think assuming that level of incompetence is a big claim. It's simply much more likely that the actual plans/goals and the talking points and press releases about the plans/goals are mostly unrelated, as usual. You can infer that those calling for backdoors have decided that call…

It's not fair to say incompetent; I didn't say that.

Instead, look at it this way: everyone has their area of responsibility. The head of the CIA is charged with providing the best possible situational awareness for the U.S. government. He's going to make proposals and requests that will help him do that.

He's not charged with balancing all possible consequences from his requests, and he's not going to do so.

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#266

Post by tripzilch »

freshhawk wrote: post #239
snowwrestler wrote: post #227

Earlier quoted context omitted.

It's not just that federally-mandated backdoors increase the chance of compromise (although they certainly do). If the U.S. government can mandate that technology companies provide access through encryption, then so can other countries. Sovereignty is still a powerful concept under international law. So imagine if Apple, upon condition of selling iPhones within China, must provide the Chinese government with a backdo…

> I don't think that federal intelligence and law enforcement officials calling for backdoors have fully thought through the consequences I think assuming that level of incompetence is a big claim. It's simply much more likely that the actual plans/goals and the talking points and press releases about the plans/goals are mostly unrelated, as usual. You can infer that those calling for backdoors have decided that call…

> You can infer that those calling for backdoors have decided that calling for backdoors is the best thing to say, inferring anything more requires more information.

How is calling for a really bad idea because it's the best thing to say different from the level of incompetence you say is too big to assume?

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#267

Post by benchaney »

bhauer wrote: post #264
noselfrighteous wrote: post #257

Earlier quoted context omitted.

So I read the wiki on the One-time pad and there's something I'm a little stuck on. There's a statement (paraphrasing) that the OTP is immune to cryptanalysis (brute force) because any given key translates to all possible plain-text, and the viable words all have a-priori the same likelihood. The thing I'm stuck on though, isn't it still possible to do semantic analysis on the various permutations. Basically reading…

I am out of my element here, but my understanding is that since the key is equal in length to the message, there is no way for you to know whether you are simply seeing a pattern in the key or a pattern in the message. Imagine a one time pad made for encoding numbers that used a "MOD 10" operation on each digit. Then imagine the key is: 6926560279774 And the message is: 0000000000000 The output is: 6926560279774 Alte…

This is a good description, but to add on to it: If there is a pattern in the plaintext, it does not increase the probability that there is a pattern in the ciphertext. It is true that there may be patterns in the ciphertext, but they give you no information about if there is a pattern in the plaintext.

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#268

Post by TrevorJ »

mercurial wrote: post #199
TrevorJ wrote: post #174

Earlier quoted context omitted.

That's fair, I think I see where you are coming from now. I do think, however, that we have to be careful not to remove personal responsibility from the equation. Circumstances can certainly motivate behaviour but we are still responsible for our actions. Suggesting otherwise seems compassionate on the surface, but it can also be incredibly disempowering and corrosive.

I agree with you both, but I think we can argue that people can have mitigating circumstances, and that you can (and should) try to understand why it is they do what they do, rather than "Any gun in the hands of a bad man is a bad thing. Any gun in the hands of a decent person is no threat to anybody — except bad people." Life isn't a comic book.

Agreed, good point.

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#269

Post by laotzu »

WildUtah wrote: post #96

Countries fail to police immigration, promising us that it will go well and we'll all benefit. Then they demand our civil liberties so they can police the immigrants they invited. And our taxes have to rise to pay welfare to them. But don't worry; a few million more and we'll all be better off.

Howgh, my fellow native american or indigenous friend. I too grow weary of these pale face immigrants taking our land, genociding us, and telling us we'll all be better off.

Re: Times Pulls Article Blaming Encryption in Paris Terror Attack

#270

Post by tripzilch »

snowwrestler wrote: post #265
freshhawk wrote: post #239

Earlier quoted context omitted.

> I don't think that federal intelligence and law enforcement officials calling for backdoors have fully thought through the consequences I think assuming that level of incompetence is a big claim. It's simply much more likely that the actual plans/goals and the talking points and press releases about the plans/goals are mostly unrelated, as usual. You can infer that those calling for backdoors have decided that call…

It's not fair to say incompetent; I didn't say that. Instead, look at it this way: everyone has their area of responsibility. The head of the CIA is charged with providing the best possible situational awareness for the U.S. government. He's going to make proposals and requests that will help him do that. He's not charged with balancing all possible consequences from his requests, and he's not going to do so.

> He's not charged with balancing all possible consequences from his requests, and he's not going to do so.

But ... that seems like quite a level of incompetence for someone trusted with the position of Head of the CIA?

By which I mean, not charging him with that responsibility is a mistake (in gov structure), but him actually not doing so is his own incompetence, is it not?

Post reply on HN