4 ms·

How do they want to prevent someone from creating his own end-to-end encryption app? That's not an issue. Writing solid encryption software is very difficult o

by blfr 10y ago

How do they want to prevent someone from creating his own end-to-end encryption app? That's not an issue. Writing solid encryption software is very difficult on its own. You will hear "do not roll your own crypto" all the time from security experts. We don't live in a James Bond universe and it's beyond the reach of terrorist organisations.

satysin 10y ago
Nobody is saying write your own crypto just your own app. Plenty of excellent crypto libraries out there.
JensRex 10y ago
>do not roll your own crypto Sure, but what's to prevent someone from building something on top of OpenSSL or PGP or whatever? Can't be that hard.
tgummerer 10y ago
You don't really have to roll your own crypto to create such an app. There's always openssl and the signal protocol, which you'd only need to implement without designing anything. Sure that can go wrong as anything can, but it's far from rolling your own crypto and makes things a lot easier.
Daviey 10y ago
I think you've missed the point.. Not talking about writing own crypto.. Talking about not using applications which the western security services have ability to force backdoors. Are you suggesting gpg has been backdoored? A simple wrapper around gpg is not-beyond terrorist organisations.
orless 10y ago
You don't have to roll your own crypto to create an own end-to-end encryption app. You can use existing crypto. Writing a user interface around it is not so difficult. Beyound the reach of the terrorist organisations? We have already seen pretty sophisticated operations by relatively small crime organizations (like exploiting pseudorandom generators in casino slot machines). There's an established black market for exploits. I think writing an end-to-end encryption app is not much more difficult compared to this. What's more, it will even be perfectly legal in many countries, meaning you could legally hire professionals to do the job. Terrorist organisations won't need to esablish a development office in SV to write the app, they will only need to know how to use Tor and wire money to the app producer. Which isn't such a huge competence to ask for.
- loup-vaillant 10y ago
  > small crime organizations (like exploiting pseudorandom generators in casino slot machines) If all you do is pushing the buttons of the slot machine in the right order with the right timing, that's hardly a crime —and I don't care about court judgements to the contrary. If a slot machine has a crappy pseudo random number generator, they're just asking for it. I'd rather sue the slot machine's maker for providing a machine that's not fit for its intended purpose.
  - orless 10y ago
    It is a crime as in "unlawful act punishable by a state or other authority". You are welcome to disagree, but I'd be interested in your definition of "crime" then.
    - loup-vaillant 10y ago
      My point is, there is nothing wrong with pushing a slot machine's buttons, even if it is done in a way that defeats the RNG. The difference between this and counting cards in a game of Black Jack is, the RNG can easily be fixed to prevent this. You provided it as an example of "organized crime", and doing so heavily suggests that it is wrong. We tend to conflate "wrong" and "unlawful", and for good reason: the law is supposed to prevent wrong things from being committed. There are exceptions however, and this is one of them. I'd rather use another example if possible.
      - orless 10y ago
        My argument is that even small organized crime groups were capabale of sophisticated operations so it's absolutely not far-fetched to assume that they may be able to implement end-to-end encryption apps. Whether this "organized crime" is "wrong" does not make much difference. It might be even easier to find people to implement it as not many would have moral issues. Speaking of moral issues, cheating on casino is pretty much off limits on my personal moral compass. That the attack was possible within the normal mode of operation does not make it less of a fraud. Imagine if the casino would reverse-engineer a slot machine and find a way to abuse it within the normal mode of operation, making odds (even more) in their favor. That would be fraud, plain and simple, and I don't see why a player should be held to a different standard. You are absolutely right, not everything unlawful is wrong. But I fail to see which benefit we as a society would have by allowing exploitation of technical deficiencies in slot machines for profit. It is a crime and it is wrong in my book.
loup-vaillant 10y ago
> Writing solid encryption software is very difficult on its own. It's not. You can use existing software, reuse existing protocols, and stick to safe languages as much as possible. Even implementing your own crypto isn't all that difficult¹. I have written my own crypto library², and I can almost recommend it for production use. [1]: http://loup-vaillant.fr/articles/rolling-your-own-crypto http://loup-vaillant.fr/articles/rolling-your-own-crypto [2]: http://loup-vaillant.fr/projects/monocypher/ http://loup-vaillant.fr/projects/monocypher/
deleted 10y ago
[deleted]
dTal 10y ago
You vastly overestimate the difficulty. The reason we're commonly told not to roll our own crypto is because it's easy, and also easy to get wrong and possibly catastrophic if you do. But many perfectly serviceable algorithms are simple and public knowledge. Arguably a scenario where everyone's using their own crypto and half of it's broken is still better than everyone using the "industry standard, pre-backdoored for your convenience" version. Of course it's utterly trivial to make a one-time-pad cryptosystem, and more practical in 2017 than ever. So what if the keylength must match the message length, my phone has a 32gb uSD. That's a lot of text messages.
- brokenmachine 10y ago
  This. If we outlaw encryption, then only outlaws will have encryption.

by blfr 10y ago

satysin 10y ago

Nobody is saying write your own crypto just your own app. Plenty of excellent crypto libraries out there.

JensRex 10y ago

>do not roll your own crypto Sure, but what's to prevent someone from building something on top of OpenSSL or PGP or whatever? Can't be that hard.

tgummerer 10y ago

You don't really have to roll your own crypto to create such an app. There's always openssl and the signal protocol, which you'd only need to implement without designing anything. Sure that can go wrong as anything can, but it's far from rolling your own crypto and makes things a lot easier.

Daviey 10y ago

I think you've missed the point.. Not talking about writing own crypto.. Talking about not using applications which the western security services have ability to force backdoors. Are you suggesting gpg has been backdoored? A simple wrapper around gpg is not-beyond terrorist organisations.

orless 10y ago

You don't have to roll your own crypto to create an own end-to-end encryption app. You can use existing crypto. Writing a user interface around it is not so difficult. Beyound the reach of the terrorist organisations? We have already seen pretty sophisticated operations by relatively small crime organizations (like exploiting pseudorandom generators in casino slot machines). There's an established black market for exploits. I think writing an end-to-end encryption app is not much more difficult compared to this. What's more, it will even be perfectly legal in many countries, meaning you could legally hire professionals to do the job. Terrorist organisations won't need to esablish a development office in SV to write the app, they will only need to know how to use Tor and wire money to the app producer. Which isn't such a huge competence to ask for.

loup-vaillant 10y ago
> small crime organizations (like exploiting pseudorandom generators in casino slot machines) If all you do is pushing the buttons of the slot machine in the right order with the right timing, that's hardly a crime —and I don't care about court judgements to the contrary. If a slot machine has a crappy pseudo random number generator, they're just asking for it. I'd rather sue the slot machine's maker for providing a machine that's not fit for its intended purpose.
- orless 10y ago
  It is a crime as in "unlawful act punishable by a state or other authority". You are welcome to disagree, but I'd be interested in your definition of "crime" then.
  - loup-vaillant 10y ago
    My point is, there is nothing wrong with pushing a slot machine's buttons, even if it is done in a way that defeats the RNG. The difference between this and counting cards in a game of Black Jack is, the RNG can easily be fixed to prevent this. You provided it as an example of "organized crime", and doing so heavily suggests that it is wrong. We tend to conflate "wrong" and "unlawful", and for good reason: the law is supposed to prevent wrong things from being committed. There are exceptions however, and this is one of them. I'd rather use another example if possible.
    - orless 10y ago
      My argument is that even small organized crime groups were capabale of sophisticated operations so it's absolutely not far-fetched to assume that they may be able to implement end-to-end encryption apps. Whether this "organized crime" is "wrong" does not make much difference. It might be even easier to find people to implement it as not many would have moral issues. Speaking of moral issues, cheating on casino is pretty much off limits on my personal moral compass. That the attack was possible within the normal mode of operation does not make it less of a fraud. Imagine if the casino would reverse-engineer a slot machine and find a way to abuse it within the normal mode of operation, making odds (even more) in their favor. That would be fraud, plain and simple, and I don't see why a player should be held to a different standard. You are absolutely right, not everything unlawful is wrong. But I fail to see which benefit we as a society would have by allowing exploitation of technical deficiencies in slot machines for profit. It is a crime and it is wrong in my book.

loup-vaillant 10y ago

> Writing solid encryption software is very difficult on its own. It's not. You can use existing software, reuse existing protocols, and stick to safe languages as much as possible. Even implementing your own crypto isn't all that difficult¹. I have written my own crypto library², and I can almost recommend it for production use. [1]: http://loup-vaillant.fr/articles/rolling-your-own-crypto http://loup-vaillant.fr/articles/rolling-your-own-crypto [2]: http://loup-vaillant.fr/projects/monocypher/ http://loup-vaillant.fr/projects/monocypher/

deleted 10y ago

[deleted]

dTal 10y ago

You vastly overestimate the difficulty. The reason we're commonly told not to roll our own crypto is because it's easy, and also easy to get wrong and possibly catastrophic if you do. But many perfectly serviceable algorithms are simple and public knowledge. Arguably a scenario where everyone's using their own crypto and half of it's broken is still better than everyone using the "industry standard, pre-backdoored for your convenience" version. Of course it's utterly trivial to make a one-time-pad cryptosystem, and more practical in 2017 than ever. So what if the keylength must match the message length, my phone has a 32gb uSD. That's a lot of text messages.

brokenmachine 10y ago
This. If we outlaw encryption, then only outlaws will have encryption.