Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA-proof encryption exists. Why doesn’t anyone use it?

washingtonpost.com

Post reply on HN
Print view View original

31–40 of 138 posts

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#31

Post by glurgh »

kimlelly wrote: post #17
glurgh wrote: post #14

Earlier quoted context omitted.

This simply isn't true. Even if you (with likely a few orders of magnitude margin) overestimate total world computing capacity at 1e21 decryption operations per second it's going to take you about age-of-the-universe seconds to brute force a single 128 bit key. No amount of money or supposed 'exponential technology growth' is going to let any government brute force these anytime soon. And those are the smallest symme…

Can you back these calculations up with a known scientific source?

Sure. A 128 bit key is 2^128 or 3.4e38.

Numbers about total world computing power (most of it probably stuck in GPUs doing windows animations and playing Call of Duty) bandied about are in the Ne18ish ops/sec range, age of the universe is in the 4e17 range.

And I have a great deal of margin by treating a 'decrypt and verify' operation as a 'basic operation' and using a completely preposterous time period like the age of the universe instead of say, 10,000 years. Nobody is brute-forcing 128 bit keys anytime soon, that's a pretty basic mathematical and physical given. But if you're particularly paranoid, you can just as easily use 256 bit keys - nobody is brute-forcing those until we hit the singularity and become a galaxy-encompassing brain. Even then it might give us a serious, millennia-long headache.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#32

Post by glurgh »

njharman wrote: post #22
glurgh wrote: post #14

Earlier quoted context omitted.

This simply isn't true. Even if you (with likely a few orders of magnitude margin) overestimate total world computing capacity at 1e21 decryption operations per second it's going to take you about age-of-the-universe seconds to brute force a single 128 bit key. No amount of money or supposed 'exponential technology growth' is going to let any government brute force these anytime soon. And those are the smallest symme…

Compute power is far from the most effective brute force method to get someone's encryption key. Other means include; rendition, waterboarding, jail, similar threats and keyloggers.

The OP's contention was that government computational resources and the progress of technology itself make currently-available, robust encryption technology worthless. This is inaccurate.

The fact that someone can beat a key out of you is not what is usually meant by 'brute forcing' a key, in a cryptographic context.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#33

Post by tsahyt »

david_shaw wrote: post #25

> NSA-proof encryption exists. Yup. Except it's not that easy. Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans. Data in transit that is intercepted, if configured correctly, is almost certainly…

Weren't there cases of the government forcing people to give them their passphrase in the US already? Somehow I seem to remember something like this very vaguely.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#34

Post by Xcelerate »

lordgilman wrote: post #30
Xcelerate wrote: post #21

I have a question that perhaps a cryptography expert could answer for me. My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known.…

This has come up in the past on HN. As I understand it the newspaper story is bull. As for advancements in technology the answer is likely no - producing that technology requires an entire toolchain/industry that the NSA is unlikely to replicate with its size. The only shot the NSA has at pulling ahead of us is with entirely mathematical things like crypto (which they did at least in the 70s with differential cryptan…

> As I understand it the newspaper story is bull

Could you clarify what you mean by this?

And yeah, I should have been more clear in my original question; I was lumping mathematical advances under "technology".

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#35

Post by unimpressive »

crazy1van wrote: post #29

Because the vast majority of people like privacy in theory but not enough to spend the hour it would take to learn how to encrypt their email and documents. Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? This isn't to excuse anything illegal the US gov't might be doing, but if it matters as much to people as they say you'd think they'd have at…

>Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email?

I would think that most HN users would be willing to encrypt their email, but know they can't convince their friends/family/etc to do so. Encryption takes two to tango.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#36

Post by cube13 »

lordgilman wrote: post #30
Xcelerate wrote: post #21

I have a question that perhaps a cryptography expert could answer for me. My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known.…

This has come up in the past on HN. As I understand it the newspaper story is bull. As for advancements in technology the answer is likely no - producing that technology requires an entire toolchain/industry that the NSA is unlikely to replicate with its size. The only shot the NSA has at pulling ahead of us is with entirely mathematical things like crypto (which they did at least in the 70s with differential cryptan…

>This has come up in the past on HN. As I understand it the newspaper story is bull.

Pretty much. The same effect that causes stars to twinkle limits the resolution of space-based spy satellites imagery of the ground.

http://en.wikipedia.org/wiki/Astronomical_seeing

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#37

Post by Vivtek »

bdamm wrote: post #13

Intelligence-community-proof is somewhat of a fallacy. You can make it more expensive for the NSA to get your email, because then you're forcing them (or another arm of the government) to penetrate your client and extract the key there. And, all you have done is make damn sure they keep your metadata records. Somewhere I read that sending encrypted email is an automatic flag, in the same category as using words that…

To make it truly effective, you'd be sending your true message steganographically encoded in otherwise unexceptional text about business matters.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#38

Post by glurgh »

kimlelly wrote: post #23
kimlelly wrote: post #17

Earlier quoted context omitted.

Can you back these calculations up with a known scientific source?

@aryastark - What's the nature of AES 128 & Co., meaning: Who can and cannot discover flaws? Is this like open source where the whole world can watch or is this somehow a closed thing like Windows, MacOS, etc.?

These are openly available, highly reviewed algorithms - their adoption as standards, too, is done by a process of open competition. And it's probably safe to say that the amount of research and analysis being done on them in the open exceeds that done in secret by government agencies by a wide margin.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#39

Post by crazy1van »

unimpressive wrote: post #35
crazy1van wrote: post #29

Because the vast majority of people like privacy in theory but not enough to spend the hour it would take to learn how to encrypt their email and documents. Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? This isn't to excuse anything illegal the US gov't might be doing, but if it matters as much to people as they say you'd think they'd have at…

>Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? I would think that most HN users would be willing to encrypt their email, but know they can't convince their friends/family/etc to do so. Encryption takes two to tango.

I'd like to think that's true, but I doubt it. I bet tons of HN users run in the same circles as other HN users and communicate regularly, but never even consider encrypting their emails.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#40

Post by aryastark »

kimlelly wrote: post #23
kimlelly wrote: post #17

Earlier quoted context omitted.

Can you back these calculations up with a known scientific source?

@aryastark - What's the nature of AES 128 & Co., meaning: Who can and cannot discover flaws? Is this like open source where the whole world can watch or is this somehow a closed thing like Windows, MacOS, etc.?

Correct. The AES family of algorithms are public knowledge, not proprietary. They are open for scrutiny by mathematicians and crypto experts across the world.

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

Post reply on HN