4 ms·

> Skype's encryption algorithm is not, itself, broken Skype's encryption has not been cracked, but it is broken in the sense that it preserves exploitable stru

> Skype's encryption algorithm is not, itself, broken Skype's encryption has not been cracked, but it is broken in the sense that it preserves exploitable structure in the ciphertext. The ciphertext should be essentially random, shouldn't it?

JoachimSchipper 15y ago
The ciphertext is "essentially random"; the amount of ciphertext (per second) isn't. Encryption will keep your wife from reading your letters, but if you send a hundred letters a month to the new girl at work she might still get suspicious. Encryption does not promise to prevent that.
- ksolanki 15y ago
  unless you use steganography to hide the existence of communication itself (see http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography ).
  - borism 15y ago
    Steganography doesn't hide existence of communication, it hides/obscures existence of messages in it. Important distinction.
    - ksolanki 15y ago
      Steganography hides the existence of covert communication. The message is hidden in an innocuous looking host (say a picture or video that noone would get suspicious about). So in that sense, the existence of actual communication is not known to a third party. I did a PhD theses on this topic :)
- JabavuAdams 15y ago
  The essential difference is that this is a stream, not discrete messages. Yes, I know that at the IP or UDP level a stream consists of discrete datagrams, but this is not how users think of streaming media. It's like a developer arguing that a project was completed exactly to spec, when the spec isn't what the client wanted, and the dev didn't make any real effort to understand what the client wanted. You could always trade latency for security by batching more of the stream and encrypting larger blocks.
peterwwillis 15y ago
> Skype's encryption has not been cracked I wouldn't be too sure about that. http://cryptolib.com/ciphers/skype/ http://cryptolib.com/ciphers/skype/ http://techcrunch.com/2010/07/08/skypes-innermost-security-layers-claimed-to-be-reverse-engineered/ http://techcrunch.com/2010/07/08/skypes-innermost-security-l... I never actually took the time to use it and I couldn't find any record of any details being revealed after 29c3, but it looks solid enough and one guy on a blog claimed to have written a python library using this C code and was able to get some PoC to work.
- JoachimSchipper 15y ago
  They discovered the algorithm used, but that doesn't allow them to read the data - they'll need to actually crack the encryption first.

JoachimSchipper 15y ago

The ciphertext is "essentially random"; the amount of ciphertext (per second) isn't. Encryption will keep your wife from reading your letters, but if you send a hundred letters a month to the new girl at work she might still get suspicious. Encryption does not promise to prevent that.

ksolanki 15y ago
unless you use steganography to hide the existence of communication itself (see http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography ).
- borism 15y ago
  Steganography doesn't hide existence of communication, it hides/obscures existence of messages in it. Important distinction.
  - ksolanki 15y ago
    Steganography hides the existence of covert communication. The message is hidden in an innocuous looking host (say a picture or video that noone would get suspicious about). So in that sense, the existence of actual communication is not known to a third party. I did a PhD theses on this topic :)
JabavuAdams 15y ago
The essential difference is that this is a stream, not discrete messages. Yes, I know that at the IP or UDP level a stream consists of discrete datagrams, but this is not how users think of streaming media. It's like a developer arguing that a project was completed exactly to spec, when the spec isn't what the client wanted, and the dev didn't make any real effort to understand what the client wanted. You could always trade latency for security by batching more of the stream and encrypting larger blocks.

peterwwillis 15y ago

> Skype's encryption has not been cracked I wouldn't be too sure about that. http://cryptolib.com/ciphers/skype/ http://cryptolib.com/ciphers/skype/ http://techcrunch.com/2010/07/08/skypes-innermost-security-layers-claimed-to-be-reverse-engineered/ http://techcrunch.com/2010/07/08/skypes-innermost-security-l... I never actually took the time to use it and I couldn't find any record of any details being revealed after 29c3, but it looks solid enough and one guy on a blog claimed to have written a python library using this C code and was able to get some PoC to work.

JoachimSchipper 15y ago
They discovered the algorithm used, but that doesn't allow them to read the data - they'll need to actually crack the encryption first.