3 ms·

Does this matter? We (not just IT people, everyone in the world) always lack the imagination of what could happen, and every time we're caught off guard by the

by euske 9y ago

Does this matter? We (not just IT people, everyone in the world) always lack the imagination of what could happen, and every time we're caught off guard by the creativity of malicious people. Sometimes a government is to blame, but eventually it's just us. Again, security is a process and a never-ending game of arms race. When you stop playing, they'll get the best of you. (Disclaimer: this is for the sake of argument. I'm actually a laid-back person and against government surveillance and stuff.)

lordofmoria 9y ago
I would argue that usually it doesn’t matter because of the reasons you mentioned, but in this particular case it really did. The US government, and the NSA in particular, made it a matter of explicit policy to delay and discourage commercial crypto research and development in the US. Off hand, I’d guess this delayed crypto by 10 years. Imagine if 10 years ago, we had today’s understanding of crypto. I’d wager TLS would look better. I’ve been reading Crypto by Steven Levy, it’s on exactly this topic, and I’m astounded by how actively the NSA discouraged commercial research, and how early on it happened: mid-1970s.
- mashedvikings 9y ago
  One of the greatest heroes we have to thank are Diffie and Hellman who put up a fight when US government went against their research on public key cryptography. But I suppose the reason NSA was delaying was they had to develop a workaround for the encryption. Remember, while public key crypto got strong in 1996 when the key lengths ended Tailored Access Operations (NSA's hacking team) was created in 1998, before DES was replaced with AES in 2001. Now obviously it's not that simple. Phasing out weak standards has taken very long. Personally, I would love to understand what goes on in the heads of developers who still use age old primitives like MD5 and RSA-1280 (iMessage).
  - acqq 9y ago
    > I suppose the reason NSA was delaying was they had to develop a workaround for the encryption No. Their primary purpose was never to protect anybody else but their own operations (the concept "Nobody but us" is older and broader than Wikipedia currently knows https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS ) especially not "common citizens". The NSA is mainly a military institution. Had they been able to get by with nobody being allowed to use crypto but they, they would have done that and continue doing. Bonus: this is directly from the NSA: https://www.nsa.gov/resources/everyone/digital-media-center/publications/cryptokids/assets/files/ck-bio-sam.pdf https://www.nsa.gov/resources/everyone/digital-media-center/... Covered here: https://www.dailydot.com/layer8/cryptokids-nsa-foia/ https://www.dailydot.com/layer8/cryptokids-nsa-foia/
- acqq 9y ago
  To help other possible readers: it's "Crypto: How the Code Rebels Beat the Government -- Saving Privacy in the Digital Age" by Steven Levy, from 2001.
  - geerlingguy 9y ago
    Strong recommendation to read this book; it's a pretty approachable introduction to modern cryptography and the people we have to thank for where we are today.
adrianratnapala 9y ago
> Sometimes a government is to blame, but eventually it's just us. What do you mean? The tendency for bad guys to exploit bugs is really important. But the fact that a government deliberately broke security for everyone is an additional thing, not a special case. And its worthwhile noting that it is a failure mode we can expect from governments. The US had a realistic concern that opposing nations would use strong crypto against them. The trouble was that they put that concern above all the other consequences that followed from their laws. The policy makers probably couldn't even imagine most of those consequences. It is in the nature of legislation that it can amplify whatever particular concern captures the political imagination without having to consider the broader picture.

by euske 9y ago

lordofmoria 9y ago

I would argue that usually it doesn’t matter because of the reasons you mentioned, but in this particular case it really did. The US government, and the NSA in particular, made it a matter of explicit policy to delay and discourage commercial crypto research and development in the US. Off hand, I’d guess this delayed crypto by 10 years. Imagine if 10 years ago, we had today’s understanding of crypto. I’d wager TLS would look better. I’ve been reading Crypto by Steven Levy, it’s on exactly this topic, and I’m astounded by how actively the NSA discouraged commercial research, and how early on it happened: mid-1970s.

mashedvikings 9y ago
One of the greatest heroes we have to thank are Diffie and Hellman who put up a fight when US government went against their research on public key cryptography. But I suppose the reason NSA was delaying was they had to develop a workaround for the encryption. Remember, while public key crypto got strong in 1996 when the key lengths ended Tailored Access Operations (NSA's hacking team) was created in 1998, before DES was replaced with AES in 2001. Now obviously it's not that simple. Phasing out weak standards has taken very long. Personally, I would love to understand what goes on in the heads of developers who still use age old primitives like MD5 and RSA-1280 (iMessage).
- acqq 9y ago
  > I suppose the reason NSA was delaying was they had to develop a workaround for the encryption No. Their primary purpose was never to protect anybody else but their own operations (the concept "Nobody but us" is older and broader than Wikipedia currently knows https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS ) especially not "common citizens". The NSA is mainly a military institution. Had they been able to get by with nobody being allowed to use crypto but they, they would have done that and continue doing. Bonus: this is directly from the NSA: https://www.nsa.gov/resources/everyone/digital-media-center/publications/cryptokids/assets/files/ck-bio-sam.pdf https://www.nsa.gov/resources/everyone/digital-media-center/... Covered here: https://www.dailydot.com/layer8/cryptokids-nsa-foia/ https://www.dailydot.com/layer8/cryptokids-nsa-foia/
acqq 9y ago
To help other possible readers: it's "Crypto: How the Code Rebels Beat the Government -- Saving Privacy in the Digital Age" by Steven Levy, from 2001.
- geerlingguy 9y ago
  Strong recommendation to read this book; it's a pretty approachable introduction to modern cryptography and the people we have to thank for where we are today.

adrianratnapala 9y ago

> Sometimes a government is to blame, but eventually it's just us. What do you mean? The tendency for bad guys to exploit bugs is really important. But the fact that a government deliberately broke security for everyone is an additional thing, not a special case. And its worthwhile noting that it is a failure mode we can expect from governments. The US had a realistic concern that opposing nations would use strong crypto against them. The trouble was that they put that concern above all the other consequences that followed from their laws. The policy makers probably couldn't even imagine most of those consequences. It is in the nature of legislation that it can amplify whatever particular concern captures the political imagination without having to consider the broader picture.