Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

N.S.A. Foils Much Internet Encryption

nytimes.com

Post reply on HN
Print view View original

311–320 of 395 posts

Re: N.S.A. Foils Much Internet Encryption

#311

Post by tubbzor »

Everlag wrote: post #266
tubbzor wrote: post #75

Earlier quoted context omitted.

Everyone focuses on the decrypting power of quantum computing, which is warranted as it will break _modern_ cryptography (in theory). However, think about the encrypting power a quantum computer will have; being able to generate completely random keys among other facets of crypto that seem implausible with modern computers. I think it will just open the door to a whole new science of crypto we haven't reached yet.

The most concerning point is that transitional point where all of the old, quantum breakable, standards are in place when quantum systems roll around. Either everything will fall apart or we'll have wised up before hand.

We've seen this phenomenon, just on a smaller scale. When an encryption standard is compromised, people either switch to something stronger or face the consequences of essentially leaving their data in the open.

DES was an acceptable standard until the late 90s, but you'd be foolish to use it now. RSA is the accepted standard now, but it is said to fall within 5 years or so. At that point, people will either start paying for a license to use Elliptic curve encryption algos or something new will be found. It's a vicious cycle, but I certainly don't think encryption ends with quantum computing, but maybe disrupts it quite a bit for some time.

Re: N.S.A. Foils Much Internet Encryption

#312

Post by tubbzor »

chris_mahan wrote: post #140
tubbzor wrote: post #58

Earlier quoted context omitted.

If the source code/hardware diagrams are kept private you should assume backdoors, always, with everything. How is there any other way to know for sure otherwise? These government agencies are obviously dug much deeper in private industry than many expected so I wouldn't put it past them

If you see the diagram, and someone else makes the chip, how do you know the diagram matches exactly with what's on the chip? Unless you can make your own chip from the diagram, you still cannot be sure.

Very valid point, and I you're right you really would have no idea. You could check on some devices if you knew enough about hardware to compare the internals and the diagram, but that is a select few people.

This is why customer-company relationships and company integrity is becoming increasingly important, and frankly not many US companies are doing well in that regard.

Re: N.S.A. Foils Much Internet Encryption

#313

Post by mcherm »

john_b wrote: post #201
mcherm wrote: post #115

Earlier quoted context omitted.

> Speaking of which, I'm really quite frustrated how many of these recent reports about the NSA elide the technical details. Are you? Well please sign up to work for the NSA, learn the technical details, then go public with them. The reason that the NYTimes isn't publishing the technical details is because they DON'T KNOW THEM. (They might not publish them if they did.) They don't know them because Edward Snowden was…

From the article: > "Intelligence officials asked The Times and ProPublica not to publish this article, saying that it might prompt foreign targets to switch to new forms of encryption or communications that would be harder to collect or read. The news organizations removed some specific facts but decided to publish the article because of the value of a public debate about government actions that weaken the most powe…

They say that they were asked not to publish at all, but did so anyway and chose to remove some specific facts. I don't understand how you get from that to concluding that they know (and are suppressing) the particular vulnerabilities that the NSA is exploiting.

Re: N.S.A. Foils Much Internet Encryption

#314

Post by mcherm »

mcpherrinm wrote: post #133
mcherm wrote: post #109

Earlier quoted context omitted.

> Quantom computing cannot break all of crypto. Correct (except for the spelling of "Quantum"). > Anything based on P!=NP is believed to be secure against quantom computing, and there are several encryption methods backed by P!=NP Incorrect, well mostly. The deal is that there are problems that can be done in "polynomial time" (how long it takes is not exponential in the size of they key) for a normal computer (or pe…

> the ones that CANNOT be done on polynomial time is "NP". I see you've solved one of the great open problems! NP is defined as problems that a nondeterministic turing machine can solve in polynomial time. Imagine, if you will, a turing machine that when it "branches" always chooses the right path (Or: chooses "both" without overhead)

Oops... my bad. Sorry.

Re: N.S.A. Foils Much Internet Encryption

#315

Post by mcherm »

mcppherrinrinm wrote: post #305
mcpherrinm wrote: post #133

Earlier quoted context omitted.

> the ones that CANNOT be done on polynomial time is "NP". I see you've solved one of the great open problems! NP is defined as problems that a nondeterministic turing machine can solve in polynomial time. Imagine, if you will, a turing machine that when it "branches" always chooses the right path (Or: chooses "both" without overhead)

Yes, and that part of his comment would also imply P != NP: > Fortunately, there are problems which are NOT in BQP We don't know yet if NP \ BQP is non-empty (and neither do we know if BQP \ NP is non-empty).

But we do know that BQP \ P is non-empty, which is what I was trying to say. In fact, factoring large integers lies in BQP \ P, and is also the basis of some commonly used encryption algorithms.

Re: N.S.A. Foils Much Internet Encryption

#316

Post by tptacek »

dekz wrote: post #300
meowface wrote: post #261

Earlier quoted context omitted.

Would you say that using a browser like Chrome and using TLS 1.2 with 2048-bit RSA keys and AES, is likely to be safe for many years to come?

That question cannot be answered, sorry. Cryptographically it is sound today. But that point is entirely moot if the NSA has the CA private key, or has access to your computer. Do you think it's easier to discover attacks on AES or court order CA's? You need to trust your OS, Chrome cryptography implementation, AES and RSA, and the end point, its OS and its possible role as a mute puppet, oh and don't forget everyone…

The point is not mooted if NSA has compromised a CA, because Chrome does more than simply trusting the CAs.

Re: N.S.A. Foils Much Internet Encryption

#317

Post by mcppherrinrinm »

mcherm wrote: post #315
mcppherrinrinm wrote: post #305

Earlier quoted context omitted.

Yes, and that part of his comment would also imply P != NP: > Fortunately, there are problems which are NOT in BQP We don't know yet if NP \ BQP is non-empty (and neither do we know if BQP \ NP is non-empty).

But we do know that BQP \ P is non-empty, which is what I was trying to say. In fact, factoring large integers lies in BQP \ P, and is also the basis of some commonly used encryption algorithms.

No, we don't know that either. For all we know, we could have BQP = P: today, we don't know any algorithm in P to factor integers, but that's not a proof that it doesn't exist. If we had such a proof, as mcpherrinm points out this would directly lead to a proof that P != NP (since we DO know that factoring is in NP).

Also, I don't mean to pile on, but this wasn't what you were trying to say in the paragraph I quoted: in that paragraph, you said that we just had to pick problems outside BQP to make cryptography work despite quantum computers. I don't know if that's what you had in mind, but for such an algorithm to be tractable, it should at least be in NP (nobody with a deterministic computer wants to spend an exponential amount of time establishing an SSL connection): so the mathematical statement is whether NP \ BQP is non-empty. Did I miss something?

Re: N.S.A. Foils Much Internet Encryption

#318

Post by mrb »

leokun wrote: post #310
mrb wrote: post #297

Earlier quoted context omitted.

I have written lots of Java code accessing HTTPS sites with 2048 or 3072-bit RSA. This is perfectly supported. You do not even need the Unlimited Strength Jurisdiction Policy Files to use such RSA key sizes (other algorithms are restricted). I can't comment on Android Browser on Google TV, but I very highly doubt it fails to support 2048-bit RSA keys. If that was the case, half the HTTPS websites would be unbrowsable…

We had downtime for this, so I am 100% sure. We isolated it to the key, and reverting the cert/key back to 1024 fixed it. It was just an option on GoDaddy one of the engineers picked to generate a 2048 cert. They only offer 1024 and 2048. One key worked, the other didn't.

It must have been something else that broke it, not the key size. Android Browser definitely supports 2048-bit RSA certs. Maybe a root cert was absent from the browser (GoDaddy would be using a different root for 2048-bit certs?). Or maybe intermediate certs were missing in the certificate path. It sounds like your engineer did not spend much time trying to figure out what aspect of SSL/X.509 was actually causing the problem.

Re: N.S.A. Foils Much Internet Encryption

#319

Post by bigiain »

jacquesm wrote: post #33
dictum wrote: post #24

Earlier quoted context omitted.

People who intend to enter a middle school and kill kids can hide their plans and communications using 256-bit encryption. Edit: Devil's advocate.

Or they could be loners or they could meet and communicate face to face.

You're right. That's why I'm introducing a bill to make it illegal to have a conversation without a certified government agent (or authorized private contractor) present. To improve citizen's security, a rider on the bill will also make it illegal to talk about, write about, or represent in interpretive dance the existence of those agents.

:-/

Re: N.S.A. Foils Much Internet Encryption

#320

Post by betterunix »

anigbrowl wrote: post #299
betterunix wrote: post #222

Earlier quoted context omitted.

No, but now we cannot just assume that cryptosystems are being developed in good faith or that mistakes are not actually covert sabotage. We need to check these systems before we put our trust in them.

But why would you ever have assumed this? I mean, I don't really care whether something was a mistake in good faith or covert sabotage; the useful question is whether something is secure or not as far as I can tell. Assessing the motivations is a complete waste of my time as an individual.

It does matter if the NSA is actively sabotaging our cryptosystems. If people are making mistakes we can solve the problem as a community by improving the techniques we use to develop, document, and test cryptosystems. If we are dealing with people who are deliberately weakening our cryptosystems, it will be harder to push better techniques because our adversary will push back against them, or sabotage the techniques themselves.
Post reply on HN