4 ms·

This story doesn't make any sense at all. Surely Blackberry isn't stupid enough to use a "single encryption/decryption key" for all their messages.

jlgaddis 11y ago
The linked article on Motherboard [0] expands on this a little bit: > BlackBerry (formerly RIM) encrypts all messages sent between consumer phones, known as PIN-to-PIN or BBM messages, using a single “global encryption key” that’s loaded onto every handset during manufacturing. With this one key, any and all messages sent between consumer BlackBerry phones can be decrypted and read. In contrast, Business Enterprise Servers allow corporations to use their own encryption key, which not even BlackBerry can access. [0]: http://motherboard.vice.com/read/rcmp-blackberry-project-clemenza-global-encryption-key-canada http://motherboard.vice.com/read/rcmp-blackberry-project-cle...
- ghshephard 11y ago
  Right - that's the part that I have a really hard time believing. Even having a single decryption key per device seems insane - isn't it pretty standard practice to frequently rotate your session key? I'm wondering if this was something that Blackberry was doing back in the early 90s, and, as the state of the art advanced, they never upgraded their systems. It really sounds terribly insecure to me.
  - coldcode 11y ago
    How are these people still in business?
    - elthran 11y ago
      Corporate inertia mostly
    - chopin 11y ago
      RSA (the company) is still as well... The company I work for is still using their key-fobs for VPN access.
  - mschuster91 11y ago
    > I'm wondering if this was something that Blackberry was doing back in the early 90s, and, as the state of the art advanced, they never upgraded their systems. It's called backwards compatibility... though that's not really an excuse.
  - misnome 11y ago
    Couldn't the message could have the "real" encryption key encrypted with the private blackberry key, thus allowing them to access it if required?
neerdowell 11y ago
BBM's security paper: https://help.blackberry.com/en/bbm-security/latest/bbm-security-pdf/BBM-Security_Note-1336480397548-en.pdf https://help.blackberry.com/en/bbm-security/latest/bbm-secur... [PDF] Check out the bottom of page 7, and the diagrams on page 8.
bmh_ca 11y ago
This is the company that used PBKDF2 with a single iteration: http://security.stackexchange.com/questions/5985 http://security.stackexchange.com/questions/5985 Security is not exactly their forte.

jlgaddis 11y ago

The linked article on Motherboard [0] expands on this a little bit: > BlackBerry (formerly RIM) encrypts all messages sent between consumer phones, known as PIN-to-PIN or BBM messages, using a single “global encryption key” that’s loaded onto every handset during manufacturing. With this one key, any and all messages sent between consumer BlackBerry phones can be decrypted and read. In contrast, Business Enterprise Servers allow corporations to use their own encryption key, which not even BlackBerry can access. [0]: http://motherboard.vice.com/read/rcmp-blackberry-project-clemenza-global-encryption-key-canada http://motherboard.vice.com/read/rcmp-blackberry-project-cle...

ghshephard 11y ago
Right - that's the part that I have a really hard time believing. Even having a single decryption key per device seems insane - isn't it pretty standard practice to frequently rotate your session key? I'm wondering if this was something that Blackberry was doing back in the early 90s, and, as the state of the art advanced, they never upgraded their systems. It really sounds terribly insecure to me.
- coldcode 11y ago
  How are these people still in business?
  - elthran 11y ago
    Corporate inertia mostly
  - chopin 11y ago
    RSA (the company) is still as well... The company I work for is still using their key-fobs for VPN access.
- mschuster91 11y ago
  > I'm wondering if this was something that Blackberry was doing back in the early 90s, and, as the state of the art advanced, they never upgraded their systems. It's called backwards compatibility... though that's not really an excuse.
- misnome 11y ago
  Couldn't the message could have the "real" encryption key encrypted with the private blackberry key, thus allowing them to access it if required?

neerdowell 11y ago

BBM's security paper: https://help.blackberry.com/en/bbm-security/latest/bbm-security-pdf/BBM-Security_Note-1336480397548-en.pdf https://help.blackberry.com/en/bbm-security/latest/bbm-secur... [PDF] Check out the bottom of page 7, and the diagrams on page 8.

bmh_ca 11y ago

This is the company that used PBKDF2 with a single iteration: http://security.stackexchange.com/questions/5985 http://security.stackexchange.com/questions/5985 Security is not exactly their forte.