3 ms·

The Five Eyes governments have access to Layer 2 and 3 encryptors for site-to-site protection rated by their security services to be way more secure than most s

The Five Eyes governments have access to Layer 2 and 3 encryptors for site-to-site protection rated by their security services to be way more secure than most stuff out there. They also have ability to do constant transmission of packets to hide metadata. Only Defense organizations are allowed to buy them. They can buy and deploy them if concerned about untrusted intermediaries. When they don't usually means something else is the problem.

JumpCrisscross 7y ago
> Only Defense organizations are allowed to buy them Source? Encryption has not been treated as a munition by the United States since the 90s.
- nickpsecurity 7y ago
  That's incorrect and a different issue. I'll address it, too, though. The first are systems made to NSA's Type 1 abd TEMPEST certifications. They have requirements for RNG's, assuring implementations, failing safe, side channel mitigation, etc. NSA puts them through rigorous pentesting. If NSA cant hack it, then it gets approved to protect Defense assets. There's strong controls on handling the hardware and key systems. Feel free to try to buy NSA's Inline Media Encryptor or General Dynamics Type 1 encryptors. They'll tell you that you can't buy it. Go try. Ask them for a HAIPE implementation while you're at it. I hope you prove me wrong. Far as export, I looked into that in 2014. I found that only a few things, like mass market and ecommerce, got reclassified. High-assurance systems (EAL6/7) they couldnt hack were still munitions. So were custom crypto and some other things. People got fooled: NSA reclassified just the stuff they'd be able to hack anyway. Big progress but not what people thought. https://www.schneier.com/blog/archives/2014/11/the_return_of_c.html#c6682917 https://www.schneier.com/blog/archives/2014/11/the_return_of... They tried to pull more crap about a year after I wrote that: https://www.computerworld.com/article/2925339/us-proposes-tighter-export-rules-for-computer-security-tools.html https://www.computerworld.com/article/2925339/us-proposes-ti... I don't know what current state of affairs is. I assume they've set it up where they can deny selectively if they feel the need to. So far, most "security" products are too insecure for them to need to do that.

JumpCrisscross 7y ago

> Only Defense organizations are allowed to buy them Source? Encryption has not been treated as a munition by the United States since the 90s.

nickpsecurity 7y ago
That's incorrect and a different issue. I'll address it, too, though. The first are systems made to NSA's Type 1 abd TEMPEST certifications. They have requirements for RNG's, assuring implementations, failing safe, side channel mitigation, etc. NSA puts them through rigorous pentesting. If NSA cant hack it, then it gets approved to protect Defense assets. There's strong controls on handling the hardware and key systems. Feel free to try to buy NSA's Inline Media Encryptor or General Dynamics Type 1 encryptors. They'll tell you that you can't buy it. Go try. Ask them for a HAIPE implementation while you're at it. I hope you prove me wrong. Far as export, I looked into that in 2014. I found that only a few things, like mass market and ecommerce, got reclassified. High-assurance systems (EAL6/7) they couldnt hack were still munitions. So were custom crypto and some other things. People got fooled: NSA reclassified just the stuff they'd be able to hack anyway. Big progress but not what people thought. https://www.schneier.com/blog/archives/2014/11/the_return_of_c.html#c6682917 https://www.schneier.com/blog/archives/2014/11/the_return_of... They tried to pull more crap about a year after I wrote that: https://www.computerworld.com/article/2925339/us-proposes-tighter-export-rules-for-computer-security-tools.html https://www.computerworld.com/article/2925339/us-proposes-ti... I don't know what current state of affairs is. I assume they've set it up where they can deny selectively if they feel the need to. So far, most "security" products are too insecure for them to need to do that.