32 ms·
Symmetric encryption not being broken doesn't really help you if the encryption key has been exchanged using a (presumably quantum-breakable) form of asymmetric
by hendzen 10y ago
Symmetric encryption not being broken doesn't really help you if the encryption key has been exchanged using a (presumably quantum-breakable) form of asymmetric encryption. Most encryption in the wild works this way.
- praptak 10y agoOne thing you could do is to exchange the keys in a nonstandard way. Phone or whatever. Obviously still breakable but at least not by a standard dragnet.
- andai 10y agoIf you're exchanging keys in person, I suggest looking into OTP, currently the only known mathematically unbreakable form of encryption, and so simple it has been used since at least World War I.
- acjohnson55 10y agoMathematically unbreakable if your pad is truly random
- chimeracoder 10y agoSure, but if your RNG is compromised, there's no point talking about encryption in the first place.
- srssays 10y agoThat's not really the case. OTP requires a large amount of perfectly unbiased randomness, implicitly from a hardware randomness source (otherwise what you have is more accurately a stream cipher). Contrast with deriving a key using cryptographic primitives, which can accept low-quality randomness (as long as there is sufficient entropy), that can be easily and transparently collected.
- klodolph 10y agoYes, in theory OTP requires perfectly uniform uncorrelated random input. However, in practice, you can use a randomness extractor… at which point, yes, we can't prove that someone with unbounded computational power wouldn't be able to crack it. But all known computational power is bounded.
- acjohnson55 10y agoRight. So now you have to figure out how to get a secure RNG into people's hands, so they can create pads. How does that work? Genuinely curious whether there's a reasonable solution.
- tialaramex 10y agoDevices that produce a trickle of truly random numbers can be produced for a few bucks. They're included in modern CPUs, for example. But that was never the problem. The problem is, now what? To use this OTP you need to securely deliver pads to everybody you'll ever send a message to. So, OTP is practical for a handful of secret agents who'll receive messages of a few dozen words per year from a single controller, and useless for most of us in the real world. _This_ problem is why we have public key cryptography.
- eru 10y agoSnarkily: a one time pad reduces the problem of exchanging secret messages to exchanging secret keys of the same length.. The only thing that OTP buys you is that you can exchange the pads at your convenience any time before.
- andai 10y agoYou only need to meet once. With a few GB (a couple bucks in a supermarket will buy a 8GB usb stick) you can communicate in text about 16 thousand books worth of words. In other words, to deplete the pad you would have to write sixteen thousand books. I think that's pretty convenient, as far as literally unbreakable encryption goes!
- eru 10y agoOh, definitely. The convenience of being able to secure your communication in advance is great. It's just that key-sharing is basically the most complicated and vulnerable part of modern cryptography.
- deleted 10y ago[deleted]
- shshhdhs 10y agoI wouldn't use the phone for exchanging plaintext keys. You're forgetting about ECHELON, wiretaps, and the dragnets where LEA are ignoring (or purposefully misinterpreting) the law. It's really cheap to store ALL phone calls these days, and just "playback" when you get the legal search warrant.
- jacquesm 10y agoAnd it doesn't count as surveillance until someone looks at it...
- praptak 10y agoIt's only about avoiding automatic dragnet, so making a person listen to the conversation and figure out the key counts as success.
- shshhdhs 10y agoAutomatic voice transcriptions has been a technology for greater than two decades.
- dredmorbius 10y agoExchange many keys.
- bad_user 10y agoThat's understandable, since the point of asymmetric encryption is communication. But people can use symmetric encryption when it's about your own data security (i.e. you encrypt it, you decrypt it). If you're using encryption to keep your data safe (e.g. local files, full disk encryption), then you don't actually need asymmetric encryption.
- hendzen 10y agoAgreed. However, the kind of mass surveillance people are worried about isn't really concerned with personal data at rest. That data already requires targeted surveillance to get at. Additionally... unless you generated all the bytes you are encrypting yourself without transmitting them over a network at any time... e.g. video/pictures you took yourself and then stored to your own encrypted disk, your data could be compromised by quantum-breakable encrypted communication protocols at the time of transmission. I would wager that most data worth surveilling goes over the network at some point using TLS.
- rocqua 10y agoThere is still tremendous value in symmetric encryption for off-site storage, especially cloud-based storage. This allows storage to be off-loaded wherever without needing the storage location to be trusted. All that needs to be stored locally is the key. Done right, this means quantum won't get you access to dropbox-like stuff. (Dropbox itself probably doesn't work like that, it'll store the symmetric keys server side somehow.)
- mikepurvis 10y agoDropbox de-duplicates your files with other users who have the same ones, and are capable of serving them all to you through a web site. There's no encryption there at all, except TLS in transit.
- smaddox 10y agoFound that hard to believe, so I googled it. Not positive this is a trustworthy source, but it sounds like Dropbox does use encryption for files at rest and in motion: https://www.virtru.com/blog/dropbox-encryption/ https://www.virtru.com/blog/dropbox-encryption/
- y7 10y agoTrue. Note that some "post-quantum" key exchange schemes already exist (based on lattice cryptography, for which there are no known poly-time quantum attacks), e.g. https://eprint.iacr.org/2015/1092 https://eprint.iacr.org/2015/1092 . But I haven't heard of it being used anywhere.
- da-bacon 10y agoGoogle has been experimenting with it in chrome https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html?m=1 https://security.googleblog.com/2016/07/experimenting-with-p... though it is just an experiment in Canary.
- Filligree 10y agoThe sad truth is, until we've spent a lot more time analysing and attacking those algorithms, they aren't as secure as what we've got.
- hackcasual 10y agoGoogle's canary test also does regular ECDH requiring it to be broken as well
- matthewaveryusa 10y agoThere's an extremely simple method which is to onion multiple algorithms. If you want to add the promised security features of a new algorithm that hasn't been battle-tested it's well worth the effort.
- Cyph0n 10y agoTLS implements PFS (perfect forward secrecy) by generating an ephemeral asymmetric key pair for the session, usually through DH. In other words, breaking the session key pair will only reveal the plaintext of the current session for the current client. No previous communication is broken, so the NSA would have to traverse the history for each client.
- falcolas 10y agoAnd for a target of interest, given quantum computing, it would not really provide any real protections. I could see how recalculating the key would be well worth it, if you really want the data.
- Cyph0n 10y agoAgreed, it won't help much in that case.
- yellowMoneky 10y agoThis case is a targeted breach of confidentiality not unlike a phone wire tap, still not allowing bulk surveillance. Not bad altogether.
- sorz 10y agoI saw that strongSwan had already supported two post-quantum key exchange algorithms (NTRU and NewHope) for IPSec IKEv2. Good. https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2CipherSuites#Post-Quantum-Key-Exchange-using-NTRU-Encryption https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2Ci...
- effie 10y agoIf IPSec is a complicated, commitee-designed and NSA interfered technology, and moreover not recommended by information security researchers, isn't a detail such as support for post-quantum algorithms irrelevant? http://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html http://www.mail-archive.com/cryptography@metzdowd.com/msg123... https://www.schneier.com/academic/paperfiles/paper-ipsec.pdf https://www.schneier.com/academic/paperfiles/paper-ipsec.pdf
- andai 10y agoFrom Schneier's IPSec paper Conclusions We are of two minds about IPsec. On the one hand, IPsec is far better than any IP security protocol that has come before: Microsoft PPTP, L2TP, etc. On the other hand, we do not believe that it will ever result in a secure operational system. It is far too complex, and the complexity has lead to a large number of ambiguities, contradictions, inefficiencies, and weaknesses. It has been very hard work to perform any kind of security analysis; we do not feel that we fully understand the system, let alone have fully analyzed it.