Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Practical bruteforce of military grade AES-1024 (2021) [video]

media.ccc.de

Post reply on HN
Print view View original

31–40 of 93 posts

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#31

Post by lazide »

HWR_14 wrote: post #23
ziddoap wrote: post #10

I've yet to see a good definition of what constitutes "military grade encryption" vs. regular old encryption. It generally has the opposite effect, for me at least, in the sense that I avoid any product that advertises "military grade ". Edit: I'm not actually looking for definitions of "military grade encryption", thank-you everyone who tried to explain it though. I work in cybersec, and encryption is encryption. It…

"Military grade encryption" means that the government has signed off on the algorithms use for information up to a specific classification level. Probably the NSA, but maybe the DOD has their own department. It's certainly a vote of confidence, probably by people more educated about cryptography than you specifically, although possibly less trusted by you (in terms of skill and/or ulterior motives) than other people.…

Unless someone is specifically naming the military standard they are compliant with (and provides an auditing record!) it’s bullshit, 99.99% of the time.

Legit vendors who sell actual mil-spec equipment (except stuff that has known shitty mil-specs like entrenching tools) don’t use ‘military grade’ anywhere when they’re selling to the military. They go through procurement and identify the specific mil-spec’s they are compliant with.

Military grade is the weasel word way of implying they have done that without being able to be sued because they aren’t.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#32

Post by 2OEH8eoCRo0 »

ziddoap wrote: post #10

I've yet to see a good definition of what constitutes "military grade encryption" vs. regular old encryption. It generally has the opposite effect, for me at least, in the sense that I avoid any product that advertises "military grade ". Edit: I'm not actually looking for definitions of "military grade encryption", thank-you everyone who tried to explain it though. I work in cybersec, and encryption is encryption. It…

Perhaps it held more weight in the past? Now "military grade" encryption is cheap so everything is "military grade".

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#33

Post by vmoore »

> SanDisk, and Lexar provide encryption software for their USB keys, hard drives, and other storage products.

I'm someone who bought several Sandisk devices over the years. The first thing I do after buying and unboxing is setup LUKS[0] on the device with the Disks utility in Ubuntu. These USB flash drives usually ship with an `.exe` piece of 'security software' written to the disk, which I never execute because I don't trust their claims. I prefer battle-hardened and trusted things like LUKS, instead of proprietary products that use snake-oil terms like 'Military Grade'.

[0] https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#34

Post by lazide »

kevin_thibedeau wrote: post #15
ziddoap wrote: post #10

I've yet to see a good definition of what constitutes "military grade encryption" vs. regular old encryption. It generally has the opposite effect, for me at least, in the sense that I avoid any product that advertises "military grade ". Edit: I'm not actually looking for definitions of "military grade encryption", thank-you everyone who tried to explain it though. I work in cybersec, and encryption is encryption. It…

Nowadays it means outdated, bare minimum security so we can still certify 3DES.

Frankly it doesn’t even guarantee THAT. If they could certify it, they could list the mil-spec certification. It’s pure weasel wording.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#35

Post by 2OEH8eoCRo0 »

ajsnigrutin wrote: post #26
ziddoap wrote: post #10

I've yet to see a good definition of what constitutes "military grade encryption" vs. regular old encryption. It generally has the opposite effect, for me at least, in the sense that I avoid any product that advertises "military grade ". Edit: I'm not actually looking for definitions of "military grade encryption", thank-you everyone who tried to explain it though. I work in cybersec, and encryption is encryption. It…

> I've yet to see a good definition of what constitutes "military grade encryption" Done by the cheapest contractor :)

The cheapest contractor who meets requirements who it turns out is not up to the task causing timelines to slip and end up costing more?

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#36

Post by nomilk »

ziddoap wrote: post #10

I've yet to see a good definition of what constitutes "military grade encryption" vs. regular old encryption. It generally has the opposite effect, for me at least, in the sense that I avoid any product that advertises "military grade ". Edit: I'm not actually looking for definitions of "military grade encryption", thank-you everyone who tried to explain it though. I work in cybersec, and encryption is encryption. It…

The military is to insecure encryption what a canary is to gas in a coal mine. Hence a layperson can assume it's worthy encryption without extensive investigation and without needing to know the details of how it works. "Military grade encryption" is just the layperson's translation of "encryption" (assuming it's a strong implementation).

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#37

Post by NovemberWhiskey »

upofadown wrote: post #6
Reubensson wrote: post #2

Isn't key derivation function completely separate from aes implementation. I mean you could have used the same broken key derivation with some other aes implementation. Also aes-1024 sounds like some proprietary thingy, not something people should probably trust anyway...

The complaint is that the user supplied password is easier to guess than it could be. A fast hash is used and not very many times. So you might have to, say, use 5 words rather than, say, 3 words in your diceware generated passphrase if you want to be secure against brute force attacks. This ends up being a common usability issue whenever a user is asked to provide a passphrase for some sort of symmetrical encryption…

I mean it's worse from several points of view from the best-case implementation, other than just the grossly-insufficient iteration count.

First of all, every single devices shares a common, constant salt. Although that doesn't simplify a single instance of an attack on the key-derivation function, it permits the construction of rainbow tables to trade off storage against time and attack all devices simultaneously.

Secondly, the key-derivation function has a flawed construction. In PBKDF2, if you need more key bits than the hash function outputs, you repeat the process varying a value that's concatenated to the salt as the initial input. This means the cost to generate a key to test scales with the length of the key. In this implementation, the salt + constant is not actually an input in the hash function at all, but instead XOR'd against the result of the hash.

As a result, you get no increase in work factor at all.

There are other problems in the implementation of the actual cipher (AES-CTR is malleable, not authenticated; keys longer than 128 bits are only actually using half of the additional key bits - "AES-1024" only uses 576 bits of the generated key) but the KDF is the real problem.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#39

Post by SAI_Peregrinus »

There is no such thing as AES-1024 specified by NIST. AES is a NIST standard, it has three (and only three) variants: AES-128, AES-192, and AES-256. If you see something other than those three, it's almost certainly proprietary junk.

Note that AES is always used in a "mode of operation" to provide any sort of secure encryption. AE-secure modes are AES-SIV, AES-GCM-SIV, AES-OCB, and AES-GCM in decreasing order of safety/performance (possibly others, but those are the most well reviewed and most used). Those sometimes get noted with the key length, eg AES-256-GCM-SIV, sometimes not.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#40

Post by coffeeblack »

ziddoap wrote: post #10

I've yet to see a good definition of what constitutes "military grade encryption" vs. regular old encryption. It generally has the opposite effect, for me at least, in the sense that I avoid any product that advertises "military grade ". Edit: I'm not actually looking for definitions of "military grade encryption", thank-you everyone who tried to explain it though. I work in cybersec, and encryption is encryption. It…

Soon: “tactical encryption”
Post reply on HN