6 ms·

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography. I've heard the NSA is one of the

by jokoon 5y ago

The amount of brain power that the NSA is using is staggering, it is not surprising they have such upper hand on cryptography. I've heard the NSA is one of the biggest employer of math people. At that point, I'm guessing some form of obscurity might somehow be a better idea to protect data from the NSA, or at least it would force NSA employees to analyze some obfuscated data, buying more time than just using mainstream methods. In the end, I don't think nobody has good enough reason to hide stuff from the US government, at least that's my opinion, as long as the US gov is not too evil or not too corrupt. As long as other dangerous governments or criminals can't do too much cyber damage, things are fine. I'm still curious if ML can create new kinds of cryptography. Maybe a time will come where China/Russia will have enough expertise to break good enough crypto, and then the cyber battlefield will really change.

marcan_42 5y ago
This has nothing to do with brain power. This was a deliberately backdoored algorithm that any cryptographer familiar with elliptic curve cryptography could've come up with. It wasn't even good or clever, seeing as people saw through it almost immediately. The only thing it had going for it is it was plausibly deniable and that allowed the US government to force people to implement it, since nobody could prove the NSA really had the secret keys. Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography. If they could, they wouldn't need to try to push through blatant backdoors like this. If you want to be safe from the NSA, use well-vetted, simple, auditable cryptography tools. The NSA doesn't break real crypto any more, they just find or make software bugs. The only "thing the NSA has probably broken" that comes to mind in the modern crypto world is when people realized that you could do a one time mass computation for fixed parameters for n-bit Diffie-Hellman and then use the result to decrypt any communications that that used them, efficiently... which was a bit of a problem when tons of software around the world was using default parameters, often 1024-bit, which is in "the NSA can almost certainly break it" range. I remember when that happened, I went through all my servers and re-generated my own dh parameters for OpenSSL, at 4096 bits. But this wasn't a particularly mind blowing idea, it was more like an "oh shit" moment since everyone knew the NSA had the storage/compute budget to actually carry out this attack. But anyone serious about crypto shouldn't have been using 1024-bit DH anyway; it was just a failure of the ecosystem that nobody had proactively deprecated such small sizes.
- sjaak 5y ago
  > Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography. Unless they're one step ahead here and they want us to think that which is why they add backdoors knowing that years later that knowledge will become public, giving us all a reason to think they cannot break modern crypto. <takes off his tinfoil hat>
  - dylan604 5y ago
    or taking the false flag further to be able to say that all crypto is weak and has flaws, so mights as well forgoe it. sure would make everyone's job easier.
  - atatatat 5y ago
    Tinfoil acts as a receiver...
- sangnoir 5y ago
  > The NSA doesn't break real crypto any more, they just find or make software bugs. They still can, and do break crypto. The Snowden papers (IIRC) mentioned that NSA factored a bunch of primes by throwing ridiculous amounts of compute at it: billions of dollars. With that,they could break schemes with no forward secrecy at their leisure (from all the historical internet traffic they had gathered), and they could decrypt ~30% of all "secure" internet connections in real time at the time,IIRC
  - marcan_42 5y ago
    You're describing the Diffie-Hellman story I mentioned (in a somewhat confusing way; forward secrecy isn't involved here, this isn't about breaking RSA TLS keys, and in fact DH is used in connections with forward secrecy). Again, that only works for 1024 bit DH schemes. The NSA can't factor 2048 bit keys, and they definitely can't factor 4096 bit keys. These aren't unknown capabilities; it's pretty easy to get an order of magnitude estimate on how much compute power the NSA has (spoiler alert: Google has more).
  - 5y ago
dylan604 5y ago
>I've heard the NSA is one of the biggest employer of math people. What are the other options for pure maths people? Academia? Does that really pay any better, plus, depending on your teaching level, there's a good chance you're just a babysitter. A cush gov't job probably sounds pretty good where you will actively be using your skills on a daily basis. Are there FAANG opportunties for math people at the same level as gov't?
- Y_Y 5y ago
  Finance is a good one. Academia is really hard to make any money in, if you can even get a job. Otherwise you can slide into stats or some applied field and do some consulting or something.
tsimionescu 5y ago
> In the end, I don't think nobody has good enough reason to hide stuff from the US government, at least that's my opinion, as long as the US gov is not too evil or not too corrupt. As long as other dangerous governments or criminals can't do too much cyber damage, things are fine. Such a bizarre take. The US government is one of the most belligerent and feared governments in the world, with a known track record of starting wars, toppling democratic governements that are opposed to them, ignoring international law, prioritizing US corporations over any local peoples. China and Russia aren't even half as scary to the vast majority of the planet.
- phendrenad2 5y ago
  Most people have NOT had a war started on them by the US government, so the take makes sense.

by jokoon 5y ago

marcan_42 5y ago

This has nothing to do with brain power. This was a deliberately backdoored algorithm that any cryptographer familiar with elliptic curve cryptography could've come up with. It wasn't even good or clever, seeing as people saw through it almost immediately. The only thing it had going for it is it was plausibly deniable and that allowed the US government to force people to implement it, since nobody could prove the NSA really had the secret keys. Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography. If they could, they wouldn't need to try to push through blatant backdoors like this. If you want to be safe from the NSA, use well-vetted, simple, auditable cryptography tools. The NSA doesn't break real crypto any more, they just find or make software bugs. The only "thing the NSA has probably broken" that comes to mind in the modern crypto world is when people realized that you could do a one time mass computation for fixed parameters for n-bit Diffie-Hellman and then use the result to decrypt any communications that that used them, efficiently... which was a bit of a problem when tons of software around the world was using default parameters, often 1024-bit, which is in "the NSA can almost certainly break it" range. I remember when that happened, I went through all my servers and re-generated my own dh parameters for OpenSSL, at 4096 bits. But this wasn't a particularly mind blowing idea, it was more like an "oh shit" moment since everyone knew the NSA had the storage/compute budget to actually carry out this attack. But anyone serious about crypto shouldn't have been using 1024-bit DH anyway; it was just a failure of the ecosystem that nobody had proactively deprecated such small sizes.

sjaak 5y ago
> Stuff like this is, on the contrary, evidence that the NSA can't break modern cryptography. Unless they're one step ahead here and they want us to think that which is why they add backdoors knowing that years later that knowledge will become public, giving us all a reason to think they cannot break modern crypto. <takes off his tinfoil hat>
- dylan604 5y ago
  or taking the false flag further to be able to say that all crypto is weak and has flaws, so mights as well forgoe it. sure would make everyone's job easier.
- atatatat 5y ago
  Tinfoil acts as a receiver...
sangnoir 5y ago
> The NSA doesn't break real crypto any more, they just find or make software bugs. They still can, and do break crypto. The Snowden papers (IIRC) mentioned that NSA factored a bunch of primes by throwing ridiculous amounts of compute at it: billions of dollars. With that,they could break schemes with no forward secrecy at their leisure (from all the historical internet traffic they had gathered), and they could decrypt ~30% of all "secure" internet connections in real time at the time,IIRC
- marcan_42 5y ago
  You're describing the Diffie-Hellman story I mentioned (in a somewhat confusing way; forward secrecy isn't involved here, this isn't about breaking RSA TLS keys, and in fact DH is used in connections with forward secrecy). Again, that only works for 1024 bit DH schemes. The NSA can't factor 2048 bit keys, and they definitely can't factor 4096 bit keys. These aren't unknown capabilities; it's pretty easy to get an order of magnitude estimate on how much compute power the NSA has (spoiler alert: Google has more).
- 5y ago

dylan604 5y ago

>I've heard the NSA is one of the biggest employer of math people. What are the other options for pure maths people? Academia? Does that really pay any better, plus, depending on your teaching level, there's a good chance you're just a babysitter. A cush gov't job probably sounds pretty good where you will actively be using your skills on a daily basis. Are there FAANG opportunties for math people at the same level as gov't?

Y_Y 5y ago
Finance is a good one. Academia is really hard to make any money in, if you can even get a job. Otherwise you can slide into stats or some applied field and do some consulting or something.

tsimionescu 5y ago

> In the end, I don't think nobody has good enough reason to hide stuff from the US government, at least that's my opinion, as long as the US gov is not too evil or not too corrupt. As long as other dangerous governments or criminals can't do too much cyber damage, things are fine. Such a bizarre take. The US government is one of the most belligerent and feared governments in the world, with a known track record of starting wars, toppling democratic governements that are opposed to them, ignoring international law, prioritizing US corporations over any local peoples. China and Russia aren't even half as scary to the vast majority of the planet.

phendrenad2 5y ago
Most people have NOT had a war started on them by the US government, so the take makes sense.