5 ms·

The article offers no explanation about how adversaries are able to get the encrypted data in the first place. I'm not saying it's unlikely or that they shouldn

The article offers no explanation about how adversaries are able to get the encrypted data in the first place. I'm not saying it's unlikely or that they shouldn't invest in quantum-proof cryptography for the future, but it would be nice to hear about some plausible ways that data is being "harvested now". I assume that nuclear weapon design secrets aren't floating around as encrypted files on the web. One possible idea I had is that adversaries are intercepting and saving HTTPS traffic between "interesting" targets.

shapefrog 5y ago
-----BEGIN PGP MESSAGE----- isnt exactly hard to find. That said it is slightly harder now most email isnt flying around in clear text just waiting to be scopped up.
kodah 5y ago
API exfiltration is a common technique. One of the downsides of public APIs is that they're usually very enumerable on purpose. This leaks into how we design private APIs as well. Others could be more traditional, like a dragnet that infiltrates common applications or exploits, then hunts for IAM credentials or a DB server. Users checking tokens with public endpoints into repositories is also very common. Also, the term is post-quantum cryptography. I don't think it can be declared quantum-safe or quantum-proof just yet.
tablespoon 5y ago
> I assume that nuclear weapon design secrets aren't floating around as encrypted files on the web. One possible idea I had is that adversaries are intercepting and saving HTTPS traffic between "interesting" targets. They're probably targeting communications, like those diplomatic cables Manning leaked. I'd assume top secret "design secrets" aren't transmitted. My understanding of spying is it's typically focused on gleaning information from sources a laymen would consider boring and/or useless. For instance, the NSA worked until 1980 to decrypt certain Soviet messages sent between 1942 and 1945 that re-used one-time pad pages: https://en.wikipedia.org/wiki/Venona_project https://en.wikipedia.org/wiki/Venona_project
- zinekeller 5y ago
  Ironically, the most uncrackable communications today is probably diplomatic cables to enemies (like the "red phone" which is a misnomer), which uses one-time pad (technically hard drives now) encryption, mainly because they don't trust each others' encryption (or even sharing their encryption to their sworn enemy!) and cryptologists on both sides say that OT pads are perfectly uncrackable (which is true, assuming that no-one tampered the diplomatic box between i.e. the Pentagon and the Kremlin, for example).
  - tablespoon 5y ago
    > diplomatic cables to enemies (like the "red phone" which is a misnomer), which uses one-time pad (technically hard drives now) encryption, mainly because they don't trust each others' encryption I don't think that's quite accurate. The Wikipedia article makes it sounds like the issue was more that they didn't want to give their adversary access to their encryption technology. In this context, OTP has the advantage of being both secure and not secret. https://en.wikipedia.org/wiki/One-time_pad#Historical_uses https://en.wikipedia.org/wiki/One-time_pad#Historical_uses > The hotline between Moscow and Washington D.C., established in 1963 after the 1962 Cuban Missile Crisis, used teleprinters protected by a commercial one-time tape system. Each country prepared the keying tapes used to encode its messages and delivered them via their embassy in the other country. A unique advantage of the OTP in this case was that neither country had to reveal more sensitive encryption methods to the other.

shapefrog 5y ago

-----BEGIN PGP MESSAGE----- isnt exactly hard to find. That said it is slightly harder now most email isnt flying around in clear text just waiting to be scopped up.

kodah 5y ago

API exfiltration is a common technique. One of the downsides of public APIs is that they're usually very enumerable on purpose. This leaks into how we design private APIs as well. Others could be more traditional, like a dragnet that infiltrates common applications or exploits, then hunts for IAM credentials or a DB server. Users checking tokens with public endpoints into repositories is also very common. Also, the term is post-quantum cryptography. I don't think it can be declared quantum-safe or quantum-proof just yet.

tablespoon 5y ago

> I assume that nuclear weapon design secrets aren't floating around as encrypted files on the web. One possible idea I had is that adversaries are intercepting and saving HTTPS traffic between "interesting" targets. They're probably targeting communications, like those diplomatic cables Manning leaked. I'd assume top secret "design secrets" aren't transmitted. My understanding of spying is it's typically focused on gleaning information from sources a laymen would consider boring and/or useless. For instance, the NSA worked until 1980 to decrypt certain Soviet messages sent between 1942 and 1945 that re-used one-time pad pages: https://en.wikipedia.org/wiki/Venona_project https://en.wikipedia.org/wiki/Venona_project

zinekeller 5y ago
Ironically, the most uncrackable communications today is probably diplomatic cables to enemies (like the "red phone" which is a misnomer), which uses one-time pad (technically hard drives now) encryption, mainly because they don't trust each others' encryption (or even sharing their encryption to their sworn enemy!) and cryptologists on both sides say that OT pads are perfectly uncrackable (which is true, assuming that no-one tampered the diplomatic box between i.e. the Pentagon and the Kremlin, for example).
- tablespoon 5y ago
  > diplomatic cables to enemies (like the "red phone" which is a misnomer), which uses one-time pad (technically hard drives now) encryption, mainly because they don't trust each others' encryption I don't think that's quite accurate. The Wikipedia article makes it sounds like the issue was more that they didn't want to give their adversary access to their encryption technology. In this context, OTP has the advantage of being both secure and not secret. https://en.wikipedia.org/wiki/One-time_pad#Historical_uses https://en.wikipedia.org/wiki/One-time_pad#Historical_uses > The hotline between Moscow and Washington D.C., established in 1963 after the 1962 Cuban Missile Crisis, used teleprinters protected by a commercial one-time tape system. Each country prepared the keying tapes used to encode its messages and delivered them via their embassy in the other country. A unique advantage of the OTP in this case was that neither country had to reveal more sensitive encryption methods to the other.