Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

N.S.A. Foils Much Internet Encryption

nytimes.com

Post reply on HN
Print view View original

371–380 of 395 posts

Re: N.S.A. Foils Much Internet Encryption

#371

Post by tytso »

lambda wrote: post #198
magicalist wrote: post #150

Earlier quoted context omitted.

Was that really a seriously considered plan? I don't see how that would ever be a suitable /dev/random replacement. Obviously it works for /dev/urandom, but it should be added to the entropy pool for /dev/random at most.

Matt Mackall, the former maintainer of /dev/random, actually stepped down over this issue, because Linus overrode Matt and applied Intel's patch that used their hardware random number generator directly: http://comments.gmane.org/gmane.comp.security.cryptography.r... > It's worth noting that the maintainer of record (me) for the Linux RNG quit the project about two years ago precisely because Linus decided to include…

If Matt protested, he did so quietly/privately. I wasn't aware of the fact that he had stepped down until the authors of the paper described in http://factorable.net showed up and pointed out we had a really bad problem for embedded devices on the internet. I had always assumed he had gotten too busy and distracted on other interests, since I do follow LKML, and I didn't see any kind of public debate/controversy about the change to the random driver described above.

If I had to guess what happened, some intel people pushed this as a feature, probably pushing it via one of the x86 git trees, and Linus either (a) didn't notice, or (b) didn't understand the implications, and then Matt quit in a huff --- by just stopping to do work, and not even updating the entry in the MAINTAINERS file. (That didn't happen until I took over the random driver again.)

Re: N.S.A. Foils Much Internet Encryption

#372

Post by nathan_long »

anigbrowl wrote: post #284
gknoy wrote: post #172

Earlier quoted context omitted.

I think there is a fundamental difference advanced Cryptanalysis (which we always assumed they had due to hiring practices and history) and being able to break crypto by subverting infrastructure. If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they pla…

But speaking as a non-American here, what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies. All this hand-wringing is a bit like people expressing horror over the discovery that the CIA sometimes stoops to burglary or deception. I mean, in an ideal world the only way to compromise my password would be to for a beautiful lady spy to seduce me an…

>> what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies.

The NSA, as a government agency, is in the business of serving the US citizens who pay its salaries and acting in their interests. Ultimately its performance is measured by us.

My boss would fire me if I put a backdoor in his email.

Re: N.S.A. Foils Much Internet Encryption

#373

Post by nathan_long »

mpyne wrote: post #272
gknoy wrote: post #172

Earlier quoted context omitted.

I think there is a fundamental difference advanced Cryptanalysis (which we always assumed they had due to hiring practices and history) and being able to break crypto by subverting infrastructure. If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they pla…

> If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) I disagree. Certainly they'll be doing that too, but breaking crypto is hazardous to the populace independently of how it's broken, right? Either way from NSA's pe…

>> breaking crypto is hazardous to the populace independently of how it's broken, right?

Breaking crypto from the outside proves that it's breakable; if the NSA can do it, it's just a matter of time until others do.

Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere.

Quite different.

Re: N.S.A. Foils Much Internet Encryption

#374

Post by leokun »

mrb wrote: post #318
leokun wrote: post #310

Earlier quoted context omitted.

We had downtime for this, so I am 100% sure. We isolated it to the key, and reverting the cert/key back to 1024 fixed it. It was just an option on GoDaddy one of the engineers picked to generate a 2048 cert. They only offer 1024 and 2048. One key worked, the other didn't.

It must have been something else that broke it, not the key size. Android Browser definitely supports 2048-bit RSA certs. Maybe a root cert was absent from the browser (GoDaddy would be using a different root for 2048-bit certs?). Or maybe intermediate certs were missing in the certificate path. It sounds like your engineer did not spend much time trying to figure out what aspect of SSL/X.509 was actually causing the…

There were no problems with accessing the site with Chrome or other modern browsers. What you described would have been a problem with all browsers, and anyway GoDaddy supplies all the files you need in a single zip file, including the intermediate certs. We did simply revert the SSL key, once we isolated that to be the problem. There is no pressing business need for a 2048-bit key.

Re: N.S.A. Foils Much Internet Encryption

#375

Post by lambda »

tytso wrote: post #371
lambda wrote: post #198

Earlier quoted context omitted.

Matt Mackall, the former maintainer of /dev/random, actually stepped down over this issue, because Linus overrode Matt and applied Intel's patch that used their hardware random number generator directly: http://comments.gmane.org/gmane.comp.security.cryptography.r... > It's worth noting that the maintainer of record (me) for the Linux RNG quit the project about two years ago precisely because Linus decided to include…

If Matt protested, he did so quietly/privately. I wasn't aware of the fact that he had stepped down until the authors of the paper described in http://factorable.net showed up and pointed out we had a really bad problem for embedded devices on the internet. I had always assumed he had gotten too busy and distracted on other interests, since I do follow LKML, and I didn't see any kind of public debate/controversy abou…

You're right, if he did so, it must have been in private; I searched for a while to find a message on a public mailing list about it, and could not, so resorted to linking to that later message.

Regardless, I'm glad that paranoia did eventually prevail, despite Linus's original strong objections.

Re: N.S.A. Foils Much Internet Encryption

#376

Post by lambda »

growupkids wrote: post #326
lambda wrote: post #176

Earlier quoted context omitted.

Ah, yes, I wasn't trying to say they were exploiting that particular vulnerability. Just that we now have better evidence that that really was a (rather poor) attempt to subvert standards to make them easier to decrypt. The NSA seems to be really divided between SIGINT and COMSEC. COMSEC wants to provide good, strong encryption, that can help secure US government and corporate communication. SIGINT wants to be able t…

As you may well know, the NSA has its own ciphers (Suite A) it uses for top secret classified traffic, which to me is positive proof you can't trust anything they recommend (AES) - when they don't even use it themselves.

I'm not sure that Suite A is actually stronger than Suite B. In fact, it may be weaker, for practical reasons (efficiency of encrypting high-bandwidth streams in resource-constrained devices), and so they are relying on an additional layer of security-through-obscurity to help keep it safe for longer.

There is some information known about some of the algorithms. Wikipedia has pages on BATON https://en.wikipedia.org/wiki/BATON and SAVILLE https://en.wikipedia.org/wiki/SAVILLE. You may notice that these are frequently used for hardware implementation in radios, smart cards, encrypting video streams, etc; devices that are probably fairly resource constrained, and would be hard to replace with new hardware if attacked.

If you look at the description of BATON, it has a 96 bit Electronic Code Book mode. Yes, ECB, the one that is famous for leaking information, as you can tell which blocks are identical and get a good deal of information out of that.

But even with fairly efficient hardware implementations, adversaries have been able to use off-the-shelf software to intercept Predator drone video feeds because encryption was disabled for performance reasons: http://www.cnn.com/2009/US/12/17/drone.video.hacked/index.ht...

The NSA has approved both Suite A and Suite B for top-secret material. I really don't think that they have any worries about the security of Suite B (though as Schneier points out, you may want to be a bit paranoid about their elliptic curves, as it's possible that they have ways of breaking particular curves that other people don't, like they did with the Dual EC DRBG that they promoted). I suspect that Suite A is around for legacy reasons, as they have been implementing it for longer than Suite B has existed and many of the implementations are in hardware or otherwise difficult to update.

Re: N.S.A. Foils Much Internet Encryption

#377

Post by lambda »

Daniel_Newby wrote: post #332
lambda wrote: post #176

Earlier quoted context omitted.

Ah, yes, I wasn't trying to say they were exploiting that particular vulnerability. Just that we now have better evidence that that really was a (rather poor) attempt to subvert standards to make them easier to decrypt. The NSA seems to be really divided between SIGINT and COMSEC. COMSEC wants to provide good, strong encryption, that can help secure US government and corporate communication. SIGINT wants to be able t…

> The NSA seems to be really divided between SIGINT and COMSEC. Anybody care to guess which group was responsible for the FUBAR that gave Snowden the keys to the kingdom?

Heh. It would be funny if people in COMSEC actually allowed this material to be leaked because they were disgusted about SIGINT putting so many vulnerabilities into publicly available crypto, and wanted to let it be revealed to stop that practice.

Unlikely, though. More likely that Snowden was just acting on his own. And he didn't really have "the keys to the kingdom"; just more access to a fileserver that had lots of PowerPoints on it than he should have had. If you note, almost everything that has leaked so far is PowerPoints where various branches of the NSA describe to each other and other government agencies what capabilities they have, but not the actual details of those capabilities. He probably had access to some fileserver used by the higher level executives at the NSA, but they do compartmentalize information and as they mentioned were very secretive about exactly what those vulnerabilities consist of, so there's a good chance that he didn't have access to systems where that was described.

Re: N.S.A. Foils Much Internet Encryption

#378

Post by mpyne »

nathan_long wrote: post #373
mpyne wrote: post #272

Earlier quoted context omitted.

> If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) I disagree. Certainly they'll be doing that too, but breaking crypto is hazardous to the populace independently of how it's broken, right? Either way from NSA's pe…

>> breaking crypto is hazardous to the populace independently of how it's broken, right? Breaking crypto from the outside proves that it's breakable; if the NSA can do it, it's just a matter of time until others do. Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere. Quite different.

> Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere

Well, that does depend on how they weaken it. If it gets weakened such that it goes from "impossible" to "nation-states can crack" then there's still only 3-4 agencies in the whole world that could decrypt.

But that would also tend to preclude passive wideranging cryptanalysis, which is what I'm sure NSA would prefer to be able to do.

Re: N.S.A. Foils Much Internet Encryption

#379

Post by mpyne »

nathan_long wrote: post #372
anigbrowl wrote: post #284

Earlier quoted context omitted.

But speaking as a non-American here, what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies. All this hand-wringing is a bit like people expressing horror over the discovery that the CIA sometimes stoops to burglary or deception. I mean, in an ideal world the only way to compromise my password would be to for a beautiful lady spy to seduce me an…

>> what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies. The NSA, as a government agency, is in the business of serving the US citizens who pay its salaries and acting in their interests. Ultimately its performance is measured by us. My boss would fire me if I put a backdoor in his email.

> My boss would fire me if I put a backdoor in his email.

Then why is it OK for Snowden to do the same to his employer?

Re: N.S.A. Foils Much Internet Encryption

#380

Post by mpyne »

phaemon wrote: post #368
GabrielF00 wrote: post #342

Earlier quoted context omitted.

Completely off-base. The US has, by longstanding tradition, had a more expansive attitude towards free speech than Europe. Consider blasphemy laws in the UK, which were only abolished in 2008 but would never have been constitutional in the US. Consider laws against Holocaust denial or displaying Nazi symbols in continental Europe that would be unconstitutional in the US. In Germany you can be arrested for displaying…

> The US has, by longstanding tradition, had a more expansive attitude towards free speech than Europe...Consider laws against Holocaust denial or displaying Nazi symbols in continental Europe that would be unconstitutional in the US. In Germany you can be arrested for displaying a swastika. These laws were included in the German constitution following the "denazification" of Germany by the USA, where Nazi symbols we…

> The laws against Holocaust denial and Nazi symbols were pretty much forced by the USA.

So why doesn't German remove the laws now that they've served their wartime reconstruction purpose?

And that is why they were put in, the same reason that even in the U.S. free speech was curtailed in many areas during the American Civil War.

Post reply on HN