4 ms·

https://arstechnica.com/information-technology/2012/06/flame-crypto-breakthrough/ https://arstechnica.com/information-technology/2012/06/flame... Sounds like "

https://arstechnica.com/information-technology/2012/06/flame-crypto-breakthrough/ https://arstechnica.com/information-technology/2012/06/flame... Sounds like "super-secret cryptanalysis" to me. That was 2012 and Schneier was writing in 2014. I wonder what would qualify as magic to him?

JoachimSchipper 9y ago
On one hand, that is ahead of the state-of-the-art; on the other hand, that advance was foreseen. Scary as hell, but no paradigm-breaking sorcery.
- SiempreViernes 9y ago
  How is it ahead of state of the art when it was deployed a full year after MD5 was supposed to be removed because practical exploits had been released?
  - dfox 9y ago
    IIRC Mikle had demonstrated practical X.509 certificate forgery by reusing the original Wang's collision few weeks after Wang's result was published.
dbasedweeb 9y ago
Any sufficiently advanced technology is indistinguishable from magic.
SiempreViernes 9y ago
A new collision attack 6 years after the first public example counts as magic? In the press release[0] by the authors of the discovery they describe the backstory: > The first cryptographic collision attack against the cryptographic hash function MD5 was invented by Xiaoyun Wang et al. in 2004, which however did not pose a serious immediate threat due to technical limitations. Subsequently, we have devised a more flexible collision attack against MD5 in 2007, a so-called chosen-prefix collision attack. This posed a greater threat due to the removal of the most important technical limitation. Finally, we refined our attack in 2008 and used it to construct a rogue Certification Authority, thereby demonstrating a serious vulnerability in internet security. Our demonstration convinced Microsoft and various governments to raise the security standards for Certification Authorities, by disallowing the use of MD5-based signatures effective 15 January 2009. Flame was probably deployed around February 2010 and the practical attack was announced May 2007, giving 2.5 years for finding a variant and make and debug the malware. Seems reasonable if you have good cryptographers and development team, since the collision is fairly well contained functionality that doesn't block other parts of the project. Generally I would reserve the term "magic" for secret crypto that is better than state of the art, a new variant of state of the art is simply impressive. [0]: https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-...
mikeash 9y ago
SHA-0 is another good example. It was withdrawn and replaced with the tweaked SHA-1 for no apparent reason. Years later techniques were discovered that the tweak defended against. DES also defended against a technique that wasn’t developed in the public until two decades later. That technique was originally developed at IBM and NSA merely convinced them to keep it secret, so I’m not sure how that qualifies. Edit: Schneier has written about these before, of course. I wonder if his point here is not that the NSA was always boring, but rather that its lead is way less impressive than it once was.
- monocasa 9y ago
  Also the Diffie-Hellman attack that we only knew about because of Snowden. https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf
  - tialaramex 9y ago
    Did you have a link that somehow relates this to Snowden?
    - bangonkeyboard 9y ago
      Section 4.2 of that selfsame link.
      - tialaramex 9y ago
        Thanks, nobody to blame for not seeing that but me.

JoachimSchipper 9y ago

On one hand, that is ahead of the state-of-the-art; on the other hand, that advance was foreseen. Scary as hell, but no paradigm-breaking sorcery.

SiempreViernes 9y ago
How is it ahead of state of the art when it was deployed a full year after MD5 was supposed to be removed because practical exploits had been released?
- dfox 9y ago
  IIRC Mikle had demonstrated practical X.509 certificate forgery by reusing the original Wang's collision few weeks after Wang's result was published.

dbasedweeb 9y ago

Any sufficiently advanced technology is indistinguishable from magic.

SiempreViernes 9y ago

A new collision attack 6 years after the first public example counts as magic? In the press release[0] by the authors of the discovery they describe the backstory: > The first cryptographic collision attack against the cryptographic hash function MD5 was invented by Xiaoyun Wang et al. in 2004, which however did not pose a serious immediate threat due to technical limitations. Subsequently, we have devised a more flexible collision attack against MD5 in 2007, a so-called chosen-prefix collision attack. This posed a greater threat due to the removal of the most important technical limitation. Finally, we refined our attack in 2008 and used it to construct a rogue Certification Authority, thereby demonstrating a serious vulnerability in internet security. Our demonstration convinced Microsoft and various governments to raise the security standards for Certification Authorities, by disallowing the use of MD5-based signatures effective 15 January 2009. Flame was probably deployed around February 2010 and the practical attack was announced May 2007, giving 2.5 years for finding a variant and make and debug the malware. Seems reasonable if you have good cryptographers and development team, since the collision is fairly well contained functionality that doesn't block other parts of the project. Generally I would reserve the term "magic" for secret crypto that is better than state of the art, a new variant of state of the art is simply impressive. [0]: https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-...

mikeash 9y ago

SHA-0 is another good example. It was withdrawn and replaced with the tweaked SHA-1 for no apparent reason. Years later techniques were discovered that the tweak defended against. DES also defended against a technique that wasn’t developed in the public until two decades later. That technique was originally developed at IBM and NSA merely convinced them to keep it secret, so I’m not sure how that qualifies. Edit: Schneier has written about these before, of course. I wonder if his point here is not that the NSA was always boring, but rather that its lead is way less impressive than it once was.

monocasa 9y ago
Also the Diffie-Hellman attack that we only knew about because of Snowden. https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf
- tialaramex 9y ago
  Did you have a link that somehow relates this to Snowden?
  - bangonkeyboard 9y ago
    Section 4.2 of that selfsame link.
    - tialaramex 9y ago
      Thanks, nobody to blame for not seeing that but me.