4 ms·

it was not his opinion; he mentioned in an interview that when analysts would try to pass along pgp-encrypted messages for cryptanalysis they would be rebuffed,

it was not his opinion; he mentioned in an interview that when analysts would try to pass along pgp-encrypted messages for cryptanalysis they would be rebuffed, as an example to demonstrate that there is properly-implemented strong cryptography resists scrutiny by nsa. here is documentation: https://twitter.com/Snowden/status/878686842631139334 https://twitter.com/Snowden/status/878686842631139334

tptacek 7y ago
Your expectation, then, would have been that if NSA had a cryptological capability unknown to the academic literature, it would have put it "on tap" for analysts to call on at random?
- nyolfen 7y ago
  who else is it for?
  - deleted 7y ago
    [deleted]
  - tptacek 7y ago
    So that's a "yes"? Presumably you think, similarly, that if NSA, say, breaks all elliptic curve discrete log crypto, a random analyst inside NSA will be able to submit a ticket and break random crypto? No, I don't think that's how it works. A class break in a core cryptography primitive or even a major break in a particular crypto format would be one of the most closely protected SIGINT secrets in the country; the number of people who would be exposed to even knowledge of its existence would be very low.
    - nyolfen 7y ago
      agee was a mere case officer and knew about minerva, wrote about it in the book he published in the 70s. snowden had access to documentation for dozens or hundreds of projects, many of which were much more damaging to leak (eg technical details for xkeyscore) than a pgp attack. nsa breaks things so their analysts can decrypt intelligence. it's not much use if your people can't use it.
      - pvg 7y ago
        agee was a mere case officer and knew about minerva, wrote about it in the book he published in the 70s. Agee was higher up in the intelligence hierarchy than Snowden and the MINERVA secret, while a fairly big deal, is not nearly as big of a deal as 'NSA can break some kinds of modern crypto' would be. More importantly, I think you're misreading what the new writeups on this story say about Agee's knowledge. He doesn't mention MINERVA and didn't know anything about the BND-CIA joint infiltration of the company. Here's what he writes in Inside the Company: The National Security Agency cannot break this code system mathematically but they can do so if sensitive recordings can be obtained of the vibrations of the encrypting machine when the discs clack to a stop. The recordings are processed through an oscilloscope and other machines which reveal the disc settings. Knowing the settings, NSA can put the encoded messages, which are intercepted through the commercial companies, into their own identical machines with identical settings, and the clear text message comes out. Although the Swiss manufacturer when selling the machine emphasizes the need to use it inside a sound-proof room on a table isolated by foam rubber, we hope this particular code clerk is careless. If we can discover the settings on this machine in Montevideo, NSA will be able to read the encrypted UAR messages on the entire circuit to which their Montevideo Embassy pertains.
    - sneak 7y ago
      To further your point, even Snowden didn’t have access to the documents that tell us precisely what BULLRUN is able to do, or how. (The speculation is, of course, with reasonable circumstantial support, is that it is a ~$1B program that has brute-forced the most common 1024 DH group in use.) We simply don’t have the hard data, it is (educated) speculation based on what information we do have. Even the existence of the program is TS. Its capabilities remain secret, due to the exact system you describe.
      - maqp 7y ago
        Most keys are at least 2048 bits nowadays. Bullrun's not about breaking modern key sizes that much is sure.
dsl 7y ago
I read it as the opposite. "No decrypt available for _this_ PGP encrypted message." You don't write an error message that way unless the code has a success case as well.
- sneak 7y ago
  The NSA has likely harvested and cached thousands of PGP secret keys from passive monitoring of internet links public and private (Google famously failed to use encryption on internal WAN links for a long time), active exploitation of host and workstation systems, and bulk exfiltration of nonpublic data from service providers (think stored records: emails and files). (Unrelated: As well as TLS long term keys, passwords, hashes, usernames, and any other kind of metadata or secrets that may be useful one day in the future, if nothing more than for dictionary attack prefix/suffix fodder.) I wouldn’t be surprised if they have some more creative secret key sources too: stolen and glitched smart cards, laptops that disappeared out of targets’ cars, tossed offices via evil maid, dumpster diving, all of it, including some I probably haven’t thought of because I’m a computer nerd and not a military intelligence cloak-and-dagger type. Put all the recovered secrets into a big ol’ database, because disk is cheap and keys are small. Keep it for all time, Just In Case. Of course, there is a request system frontending this capability. There are many PGP messages they can decrypt, simply because they slurped up the specific private keys for those messages at some point, and simply saved every secret key, hash, or password that they ever saw, as a general organizational policy. That doesn’t mean they have broken PGP.
  - maqp 7y ago
    Plus there's the good old endpoint hacking for key exfiltration Snowden said the NSA was doing every single day.

tptacek 7y ago

Your expectation, then, would have been that if NSA had a cryptological capability unknown to the academic literature, it would have put it "on tap" for analysts to call on at random?

nyolfen 7y ago
who else is it for?
- deleted 7y ago
  [deleted]
- tptacek 7y ago
  So that's a "yes"? Presumably you think, similarly, that if NSA, say, breaks all elliptic curve discrete log crypto, a random analyst inside NSA will be able to submit a ticket and break random crypto? No, I don't think that's how it works. A class break in a core cryptography primitive or even a major break in a particular crypto format would be one of the most closely protected SIGINT secrets in the country; the number of people who would be exposed to even knowledge of its existence would be very low.
  - nyolfen 7y ago
    agee was a mere case officer and knew about minerva, wrote about it in the book he published in the 70s. snowden had access to documentation for dozens or hundreds of projects, many of which were much more damaging to leak (eg technical details for xkeyscore) than a pgp attack. nsa breaks things so their analysts can decrypt intelligence. it's not much use if your people can't use it.
    - pvg 7y ago
      agee was a mere case officer and knew about minerva, wrote about it in the book he published in the 70s. Agee was higher up in the intelligence hierarchy than Snowden and the MINERVA secret, while a fairly big deal, is not nearly as big of a deal as 'NSA can break some kinds of modern crypto' would be. More importantly, I think you're misreading what the new writeups on this story say about Agee's knowledge. He doesn't mention MINERVA and didn't know anything about the BND-CIA joint infiltration of the company. Here's what he writes in Inside the Company: The National Security Agency cannot break this code system mathematically but they can do so if sensitive recordings can be obtained of the vibrations of the encrypting machine when the discs clack to a stop. The recordings are processed through an oscilloscope and other machines which reveal the disc settings. Knowing the settings, NSA can put the encoded messages, which are intercepted through the commercial companies, into their own identical machines with identical settings, and the clear text message comes out. Although the Swiss manufacturer when selling the machine emphasizes the need to use it inside a sound-proof room on a table isolated by foam rubber, we hope this particular code clerk is careless. If we can discover the settings on this machine in Montevideo, NSA will be able to read the encrypted UAR messages on the entire circuit to which their Montevideo Embassy pertains.
  - sneak 7y ago
    To further your point, even Snowden didn’t have access to the documents that tell us precisely what BULLRUN is able to do, or how. (The speculation is, of course, with reasonable circumstantial support, is that it is a ~$1B program that has brute-forced the most common 1024 DH group in use.) We simply don’t have the hard data, it is (educated) speculation based on what information we do have. Even the existence of the program is TS. Its capabilities remain secret, due to the exact system you describe.
    - maqp 7y ago
      Most keys are at least 2048 bits nowadays. Bullrun's not about breaking modern key sizes that much is sure.

dsl 7y ago

I read it as the opposite. "No decrypt available for _this_ PGP encrypted message." You don't write an error message that way unless the code has a success case as well.

sneak 7y ago
The NSA has likely harvested and cached thousands of PGP secret keys from passive monitoring of internet links public and private (Google famously failed to use encryption on internal WAN links for a long time), active exploitation of host and workstation systems, and bulk exfiltration of nonpublic data from service providers (think stored records: emails and files). (Unrelated: As well as TLS long term keys, passwords, hashes, usernames, and any other kind of metadata or secrets that may be useful one day in the future, if nothing more than for dictionary attack prefix/suffix fodder.) I wouldn’t be surprised if they have some more creative secret key sources too: stolen and glitched smart cards, laptops that disappeared out of targets’ cars, tossed offices via evil maid, dumpster diving, all of it, including some I probably haven’t thought of because I’m a computer nerd and not a military intelligence cloak-and-dagger type. Put all the recovered secrets into a big ol’ database, because disk is cheap and keys are small. Keep it for all time, Just In Case. Of course, there is a request system frontending this capability. There are many PGP messages they can decrypt, simply because they slurped up the specific private keys for those messages at some point, and simply saved every secret key, hash, or password that they ever saw, as a general organizational policy. That doesn’t mean they have broken PGP.
- maqp 7y ago
  Plus there's the good old endpoint hacking for key exfiltration Snowden said the NSA was doing every single day.