Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

N.S.A. Foils Much Internet Encryption

nytimes.com

Post reply on HN
Print view View original

41–50 of 395 posts

Re: N.S.A. Foils Much Internet Encryption

#41

Post by draugadrotten »

mhurron wrote: post #10
dailyrorschach wrote: post #3

This is likely a minority view, but I have no problem with the NSA being able to break encryption, that's in fact part of their job. Decoding encryption has long been part of their mission. I also suspect they're not alone in terms of signals intelligence groups in having this capability. The issue to me has always been how and what data they access and store, and how it is used.

If the NSA can, others can. It makes the whole thing useless.

Encryption is still useful. The NSA can read your messages - but not everyone. Encryption will still protect your bank transactions and wikipedia reading. No encryption will protect you from a goverment turned Evil, and I hope you realise this. If the US government is good or evil is all a matter of perspective. War is peace, Mr O wrote, and surely there has been a lot of that going on in US foreign policy the last few decades.

Re: N.S.A. Foils Much Internet Encryption

#43

Post by dictum »

jacquesm wrote: post #33
dictum wrote: post #24

Earlier quoted context omitted.

People who intend to enter a middle school and kill kids can hide their plans and communications using 256-bit encryption. Edit: Devil's advocate.

Or they could be loners or they could meet and communicate face to face.

I suppose most people who shoot schools have no partners helping them, but at some point they may need to find information to help them carry the attacks, and encryption would help them conceal the fact that they have this information, and how much information they have.

I just think that a politician moved by the desire to do something could construe non-backdoored encryption as something that "helps the enemy."

Re: N.S.A. Foils Much Internet Encryption

#44

Post by danso »

> The documents are among more than 50,000 shared with The New York Times and ProPublica, the nonprofit news organization, by The Guardian, which has published its own article. They focus primarily on GCHQ but include thousands either from or about the N.S.A.

Is this the first time we've seen a 5-digit number to describe the number of documents Snowden has? Of course, these are just the ones used for this story...

Re: N.S.A. Foils Much Internet Encryption

#45

Post by mpyne »

w1ntermute wrote: post #17

Can someone who actually knows about encryption comment on whether it's actually physically feasible for the NSA to have actually broken, say, SSL 3.0 (which has 128 bits of entropy, IIRC) on a large scale (i.e., when you're sifting through petabytes of data on a daily basis)? And if this were really an issue, couldn't you just use 4096-bit RSA (unless they have managed to surreptitiously insert a backdoor in it)?

The protocol itself would still seem to be safe (or rather, have safe combinations of key exchange and encryption).

But it is certainly feasible that if they manage to find cracks in popular-but-old communications protocols that they are able to automatically decrypt them, or use prior key recovery successes to bootstrap fast attacks on new communications from the same host.

What would be interesting is if NSA's own "Suite B" crypto recommendations are susceptible to these risks, as that would potentially represent a rather significant break in the U.S.'s own COMSEC, and COMSEC is one of the things NSA is very specifically tasked with ensuring are safe with no backdoors for anyone to jump through.

Re: N.S.A. Foils Much Internet Encryption

#47

Post by gizmo686 »

smtddr wrote: post #21
dailyrorschach wrote: post #3

This is likely a minority view, but I have no problem with the NSA being able to break encryption, that's in fact part of their job. Decoding encryption has long been part of their mission. I also suspect they're not alone in terms of signals intelligence groups in having this capability. The issue to me has always been how and what data they access and store, and how it is used.

I have a problem with encryption being breakable, regardless of who's doing the breaking. I want encryption to be mathematically solid with the only option being brute-force older-than-age-of-earth time. When we get to quantum computing, then I don't know what we'll do...

Quantom computing cannot break all of crypto. Anything based on P!=NP is believed to be secure against quantom computing, and there are several encryption methods backed by P!=NP

Re: N.S.A. Foils Much Internet Encryption

#48

Post by quotemstr »

What's truly frightening is this line from the Guardian's article on the topic:

> The NSA describes strong decryption programs as the "price of admission for the US to maintain unrestricted access to and use of cyberspace".

What does that even mean? That statement is at the same time paranoid, arrogant, and subtly threatening. It's as if to say that without the ability to decrypt interesting traffic, the NSA would be forced to take stronger measures to curtail internet traffic.

Re: N.S.A. Foils Much Internet Encryption

#49

Post by joelhaasnoot »

kylec wrote: post #32
w1ntermute wrote: post #17

Can someone who actually knows about encryption comment on whether it's actually physically feasible for the NSA to have actually broken, say, SSL 3.0 (which has 128 bits of entropy, IIRC) on a large scale (i.e., when you're sifting through petabytes of data on a daily basis)? And if this were really an issue, couldn't you just use 4096-bit RSA (unless they have managed to surreptitiously insert a backdoor in it)?

SSL relies on a chain of trust, and it's prudent to assume that the NSA has the private keys necessary to produce valid certificates that will be accepted by the certificates that ship with Windows, OS X, Firefox, etc out of the box. So man-in-the-middle attacks are certainly within their capability and fairly hard to detect. As to whether the NSA can passively intercept and decrypt SSL traffic, I don't know, but the…

How are they hard to detect? Wouldn't solutions like certificate pinning prevent this?

Re: N.S.A. Foils Much Internet Encryption

#50

Post by lemonade »

kylec wrote: post #32
w1ntermute wrote: post #17

Can someone who actually knows about encryption comment on whether it's actually physically feasible for the NSA to have actually broken, say, SSL 3.0 (which has 128 bits of entropy, IIRC) on a large scale (i.e., when you're sifting through petabytes of data on a daily basis)? And if this were really an issue, couldn't you just use 4096-bit RSA (unless they have managed to surreptitiously insert a backdoor in it)?

SSL relies on a chain of trust, and it's prudent to assume that the NSA has the private keys necessary to produce valid certificates that will be accepted by the certificates that ship with Windows, OS X, Firefox, etc out of the box. So man-in-the-middle attacks are certainly within their capability and fairly hard to detect. As to whether the NSA can passively intercept and decrypt SSL traffic, I don't know, but the…

You want to use something like TLSpool (http://www.tlspool.org) and DANE. For a browser something like Firefox's Certificate Patrol is a great solution.
Post reply on HN