4 ms·
How do you think they're decrypting in real time? Do you think there are backdoors in the crypto/protocols? Severe accidental flaws? How many times a speedup ar
by jefftk 7y ago
How do you think they're decrypting in real time? Do you think there are backdoors in the crypto/protocols? Severe accidental flaws? How many times a speedup are you imagining?
State of the non-TLA art is that modern https is completely impractical to break, even with enormous server farms working for years, let alone in real time.
- reaperducer 7y agoHow do you think they're decrypting in real time? I have no idea how they're doing it. But I believe it can be done simply because the intelligence agencies have the best, largest, fastest, most advanced machines that money can buy. Machines that none of us have even heard of, that are years ahead of anything any of us will ever touch in our lifetimes.
- jefftk 7y agoBack of the envelope, to see scale: to brute force SHA-256 you need to try about 2^255 combinations, so you'd need to have 2^194x (1,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000x) the hashpower of the Bitcoin network (80 EH/s). If you told me you thought they had cracked a common algorithm so they could do it in only 2^60 time that would at least be plausible. But the idea that they have hardware to straight up brute force it, though, is just impossibly wrong.
- reaperducer 7y agoI said nothing about brute forcing.
- jefftk 7y agoThat's how I read being able to do it because you have "the best, largest, fastest, most advanced machines that money can buy".
- fosco 7y agoMight be easier to steal keys... Seeing this photo makes me think that's more likely. https://blog.encrypt.me/assets/img/posts/2013/11/05/nsa_slide.jpg https://blog.encrypt.me/assets/img/posts/2013/11/05/nsa_slid... Pardon the source but I'm on mobile.
- jefftk 7y agoThat image is a shows an NSA diagram of Google's network, with the links on the "public internet" side labeled "SSL" and on the "Google cloud" side labeled "clear text". You don't have to steal keys to exploit that, you just need physical attacks against the fiber links between Google's datacenters. Google had been working on encrypting that traffic, which was then massively accelerated when they learned it was being actively exploited: https://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ https://arstechnica.com/information-technology/2013/11/googl... (Disclosure: I work at Google)
- kadoban 7y agoMy pet conspiracy theory is that at least some large governments have quantum computers of useful strength. It's probably more likely that they're just trudging along with side-channel attacks, CA fuckery, breaking into servers, and doing targeted attacks though. Cheaper and likely works well enough.
- jefftk 7y agoI'd be pretty surprised if they had quantum computers to where they could decrypt https, but it's at least possible. The more prosaic means you're describing, plus zero days and phishing (unless that's included in "targeted attacks"?), can still get them a long way.
- kadoban 7y agoYeah, zero days, phishing and coopting servers to send exploits to specific targets are what I meant by targeted attacks (and some of those overlap). You're probably right on the quantum computers of course, but I like comparing it against what was publicly know about say cryptanalysis vs what the NSA knew in the DES days, and also similar situations in the ww2 days.
- tripzilch 7y agoYou literally can't brute force SHA-256, there's a very tiny physical limit on the amount of energy it costs to flip a bit of information. Turns out that, summed over all the possibilities, that adds up to way more energy than is in the entire solar system.
- mrmonkeyman 7y agoYou vastly overestimate the power of your gov.
- dodobirdlord 7y ago> Machines that none of us have even heard of, that are years ahead of anything any of us will ever touch in our lifetimes. That's a pretty bizarre thing to believe. Who is building these machines? Intel? No other organization within the US has the lithography capabilities to manufacture cutting-edge computing hardware, much less "years ahead of anything any of us will ever touch in our lifetimes". Perhaps it's aliens?