4 ms·

I agree, it is probably intentional, but I think it remains to be proven that it was malicious? Maybe 40 bit was seen as sufficient at the time, but are there

I agree, it is probably intentional, but I think it remains to be proven that it was malicious? Maybe 40 bit was seen as sufficient at the time, but are there any engineering reasons to actually shorten the key intentionally, does it improve the transfer rate in any way? I can't think of any, but I'm no expert, so maybe somebody else can chime in?

raphlinus 5y ago
Depending on your definition of "malicious," I think it clears that bar. The problem is not making a good-faith argument that 40 bits was sufficient (which was done for some extent for export-approved 40 bit SSL), but that it misleads people into believing that it's 64 bit encryption while it only has 40 bits of strength for people who are in on the backdoor. And as far as the other half of your question, no, there's no possible benefit (other than to the backdoor owners) from a smaller keyspace, as it goes through the motion of encrypting with the larger one.
- fragbait65 5y ago
  Thanks for the explanation!
- deleted 5y ago
  [deleted]
slownews45 5y ago
At the time 40 bits was not considered a backdoor, it was considered a weakness that would allow folks like NSA (with big budgets and intercept capabilities) to wiretap the way they had other communication approaches. Some situations, rather than designing new codecs, they would just weaken key gen side. The IBM effort there was public to allow for easier export, but also an approach that could be used to hide the weakness which in other settings may have been beneficial. It's possible however that folks involved understood what was going on to a degree but that it was seen as necessary to avoid export / import restrictions. More recently I think places like China ask that the holders of key material be located in country and make the full keys available or accessible to their security services. Not sure how AWS squares that circle unless they outsource their data centers in China to a third party that can then expose the keys for China to use.
- gnfargbl 5y ago
  > Not sure how AWS squares that circle unless they outsource their data centers in China to a third party that can then expose the keys for China to use. If you check something like the Public Suffix List [1], you will notice that Amazon maintains separate com.cn domains for several of its services in China. Amazon doesn't appear to do that for any other country. It follows that AWS in China might well be isolated from AWS elsewhere. [1] https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
- xyzzy123 5y ago
  AWS KMS is a regional service but China is still extra special. With KMS actually the only thing that prevents encrypt/decrypt from anywhere on the Internet is the access control logic of the service. AWS of course hold the private keys for ACM certs too and could provide them upon request. (Side note: the KMS "BYOK" functionality is almost completely useless). Realistically you should expect any cloud-hosted infrastructure to be fully transparent to relevant authorities. This is usually not a business problem.
- pugz 5y ago
  > Not sure how AWS squares that circle unless they outsource their data centers in China to a third party that can then expose the keys for China to use. This is in fact precisely what they do. The Beijing region is operated by Sinnet and the Ningxia region is operated by NWCD. It's documented here: https://www.amazonaws.cn/en/about-aws/china/ https://www.amazonaws.cn/en/about-aws/china/
corty 5y ago
40bits was "export level" encryption, i.e. stuff you could safely export to foreign enemy countries. Because western secret services were certain they could decrypt that if necessary. So this is malicious without a doubt.
- cestith 5y ago
  Indeed. The question is where the malice lies. If I make a product for US use and export use, am I malicious by telling export customers that I'll only support a weaker key by US law? Or it the malice in the US requiring that? Can we expect companies, especially international conglomerates, to give up on potential markets because to protest a law?
  - corty 5y ago
    Far simpler: An entity (here: the US) is malicious towards its enemies, makes malicious laws and commits malicious deeds to harm them. All the others are just proxies for that maliciousness (provided they don't have their own separate agenda there).
  - mananaysiempre 5y ago
    OK, try this one: If I make a product for global use and Russian use, am I malicious for telling Russian customers that I’ll cut out information on homosexuality by Russian law? Or is the malice in Russia requiring that? Can we expect companies, especially international conglomerates, to give up on potential markets in order to protest a law? (This is not a caricature, this is more or less what a couple of Russian acquaintances working on YouTube at Google tell me. One could also say the same, mutatis mutandis, for China or India or Saudi Arabia, but I know much less about what’s happening there. Also intentionally not the most outrageous example, only the one that hopefully hits closest to home for a Western audience.)
    - cestith 5y ago
      I see the similarities. However, there's a difference between selling a technical solution and publishing social information. There's also a vast difference between doing special work to appease one target country so you can sell there compared to choosing whether or not to lose the entire world outside your home country because you can offer some protection but not the best protection to foreign buyers. 40 bits was not nearly as easy to break in 1998 as it is now.
yarg 5y ago
I don't necessarily think that you're wrong - but it's a moot point since the consequences are the same. For example, I don't think James Comey was acting with malicious intent calling for universal crypto back-doors; I do however think that he was dangerously naïve and deeply wrong-headed. No back-door will ever remain unbreached and by baking vulnerabilities into the specification you're paving the way for malicious manufacturers to exfiltrate your network's communications as they see fit. There's a reason that 5G rollouts have national security implications and they could've been largely avoided (metadata aside).

raphlinus 5y ago

Depending on your definition of "malicious," I think it clears that bar. The problem is not making a good-faith argument that 40 bits was sufficient (which was done for some extent for export-approved 40 bit SSL), but that it misleads people into believing that it's 64 bit encryption while it only has 40 bits of strength for people who are in on the backdoor. And as far as the other half of your question, no, there's no possible benefit (other than to the backdoor owners) from a smaller keyspace, as it goes through the motion of encrypting with the larger one.

fragbait65 5y ago
Thanks for the explanation!
deleted 5y ago
[deleted]

slownews45 5y ago

At the time 40 bits was not considered a backdoor, it was considered a weakness that would allow folks like NSA (with big budgets and intercept capabilities) to wiretap the way they had other communication approaches. Some situations, rather than designing new codecs, they would just weaken key gen side. The IBM effort there was public to allow for easier export, but also an approach that could be used to hide the weakness which in other settings may have been beneficial. It's possible however that folks involved understood what was going on to a degree but that it was seen as necessary to avoid export / import restrictions. More recently I think places like China ask that the holders of key material be located in country and make the full keys available or accessible to their security services. Not sure how AWS squares that circle unless they outsource their data centers in China to a third party that can then expose the keys for China to use.

gnfargbl 5y ago
> Not sure how AWS squares that circle unless they outsource their data centers in China to a third party that can then expose the keys for China to use. If you check something like the Public Suffix List [1], you will notice that Amazon maintains separate com.cn domains for several of its services in China. Amazon doesn't appear to do that for any other country. It follows that AWS in China might well be isolated from AWS elsewhere. [1] https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
xyzzy123 5y ago
AWS KMS is a regional service but China is still extra special. With KMS actually the only thing that prevents encrypt/decrypt from anywhere on the Internet is the access control logic of the service. AWS of course hold the private keys for ACM certs too and could provide them upon request. (Side note: the KMS "BYOK" functionality is almost completely useless). Realistically you should expect any cloud-hosted infrastructure to be fully transparent to relevant authorities. This is usually not a business problem.
pugz 5y ago
> Not sure how AWS squares that circle unless they outsource their data centers in China to a third party that can then expose the keys for China to use. This is in fact precisely what they do. The Beijing region is operated by Sinnet and the Ningxia region is operated by NWCD. It's documented here: https://www.amazonaws.cn/en/about-aws/china/ https://www.amazonaws.cn/en/about-aws/china/

corty 5y ago

40bits was "export level" encryption, i.e. stuff you could safely export to foreign enemy countries. Because western secret services were certain they could decrypt that if necessary. So this is malicious without a doubt.

cestith 5y ago
Indeed. The question is where the malice lies. If I make a product for US use and export use, am I malicious by telling export customers that I'll only support a weaker key by US law? Or it the malice in the US requiring that? Can we expect companies, especially international conglomerates, to give up on potential markets because to protest a law?
- corty 5y ago
  Far simpler: An entity (here: the US) is malicious towards its enemies, makes malicious laws and commits malicious deeds to harm them. All the others are just proxies for that maliciousness (provided they don't have their own separate agenda there).
- mananaysiempre 5y ago
  OK, try this one: If I make a product for global use and Russian use, am I malicious for telling Russian customers that I’ll cut out information on homosexuality by Russian law? Or is the malice in Russia requiring that? Can we expect companies, especially international conglomerates, to give up on potential markets in order to protest a law? (This is not a caricature, this is more or less what a couple of Russian acquaintances working on YouTube at Google tell me. One could also say the same, mutatis mutandis, for China or India or Saudi Arabia, but I know much less about what’s happening there. Also intentionally not the most outrageous example, only the one that hopefully hits closest to home for a Western audience.)
  - cestith 5y ago
    I see the similarities. However, there's a difference between selling a technical solution and publishing social information. There's also a vast difference between doing special work to appease one target country so you can sell there compared to choosing whether or not to lose the entire world outside your home country because you can offer some protection but not the best protection to foreign buyers. 40 bits was not nearly as easy to break in 1998 as it is now.

yarg 5y ago

I don't necessarily think that you're wrong - but it's a moot point since the consequences are the same. For example, I don't think James Comey was acting with malicious intent calling for universal crypto back-doors; I do however think that he was dangerously naïve and deeply wrong-headed. No back-door will ever remain unbreached and by baking vulnerabilities into the specification you're paving the way for malicious manufacturers to exfiltrate your network's communications as they see fit. There's a reason that 5G rollouts have national security implications and they could've been largely avoided (metadata aside).