11 ms·
China issues new encryption import control
- korantu 5y agoDoes it mean that latest chrome/firefox will not be available there? ssh also would need permission?
- SAI_Peregrinus 5y agoNope, none of that uses symmetric keys >256 bits. Nothing does. The only reason to go >256 bits is if your crypto is getting attacked by an adversary with a Dyson Sphere-sized quantum computer, or an adversary that's found a way around the laws of thermodynamics. Either way, you have big problems.
- trasz 5y agoOf course not - they are free, you don't need to import them. If you meant "Cisco VPN gateway" then yes, and I wonder if China is actually going to prevent import of cryptography hardware that's known to be broken or backdoored.
- caymanjim 5y agoWhat makes you think that cost (or lack thereof) has anything to do with whether or not something is imported? The two things are completely orthogonal.
- trasz 5y agoThe law being discussed regulates import and export of commercial appliances. It doesn't apply to free software.
- dragonelite 5y agoIt's a legit concern given the Crypto AG gate that happened a while ago. Where the so called reputation of swish neutrality was destroyed, if i'm not mistaken the German and American Intelligence agency had compromised the encryption hardware.
- trasz 5y agoIt's a legit concern given that it's not just Crypto AG, IIRC backdoors were also found in Cisco and bunch of other gear.
- Rygian 5y agoThought experiment: if I use 512-bit encryption from cleartext to intermediate blob, and then encrypt that with 256-bit encryption, is there a way to determine, by looking only at the final ciphertext, that 512-bit encryption keys were used in the intermediate step?
- usrusr 5y agoThe data won't give it away, at least as long as the noise is sufficiently hidden with steganography and not just a mystery blob. But the tooling setup you use to access the cleartext with your passphrase, without starting from first principles each time, that setup might very much give it away if the system comes under serious scrutiny. Note that there's a huge difference between "until proven guilty" and "until considered suspect": suddenly obscurity cannot be shrugged off at all, quite the opposite.
- adrianN 5y agoEither you assume that the attacker can break 256 bit encryption, then probably yes. Or you assume that they can't, then, why bother?
- qwerty456127 5y agoTo avoid attracting their attention in the first place. They are not going to bother breaking every 256-bit-encrypted thing they see but as soon as they notice something obviously 512-bit-encrypted they go beat the key out of you.
- Drakim 5y agoQuick question, if encrypted data looks like noise, how can you tell apart 256-bit encrypted noise and 512-bit encrypted noise?
- raxxorrax 5y agoI don't think you can with a decent crypt. In practice most encrypted containers come with metadata and a header describing the type of encryption since the assumption is that it can only be decrypted with a key anyway. If you forget encryption parameters, this can become difficult even if you have the key. In cryptanalysis it is normally assumed that the attacker knows the algorithm and encryption parameters aside the key.
- powerapple 5y agoso US is controlling exporting encryptions, and China is controlling importing encryptions. Apparently two governments can work together /
- trezemanero 5y agoGreat CCP always saving us! They're trying to prevent our CPUs to be overwhelmed. Glory to chairman Xi
- jvik 5y agoDoes this mean that they already are able to crack 256 bit encryption?
- waynesonfire 5y agoNot nescessarily. But certainly places bounds on the budget to do so.
- daneel_w 5y agoWhat budget? At 256 bits (and even far less) it's not a question of money. It's a question of energy. We don't have enough energy production to even execute a single repeating adding instruction that bit-flips 256 bits of data registers to just count up from 0 to 2^256-1, and even if we did we don't have computer setups capable of ingesting such energy. Never mind the fact that encryption rounds and result analysis increases the energy consumption some hundred orders of magnitude.
- adrianN 5y ago256 bits is out of bounds for brute forcing for any realistic amount of hardware you throw at it. So either they have attacks on the actual algorithms that drastically cut down the complexity compared to a brute force attack, or this law doesn't do very much (other than perhaps pave the way for other laws).
- rich_sasha 5y agoI read about the NSA (I believe, or another TLA) having identified some weaknesses in encryption algorithms (RSA I think, though again, memoria fragilis est), that means they could just about break some cyphertexts. The context was that, although the agency was committed (hmm) to making cybersecurity better for US citizens, and thus helping the cryptography community to improve security, they felt OK exploiting weaknesses, so long as they thought it would be too difficult for others to do so too. Sorry it's so hand-wavy, I'd love to find the article for my own sake, but busy/hard to google.
- upofadown 5y ago[pointless speculation deleted] Added: A bit of searching revealed that this policy has been oversimplified to the point of nonsense in the linked article. A relevant article: * https://www.hldataprotection.com/files/2019/11/The-Grand-Finale-of-Chinas-Encryption-Law-November-2019.pdf https://www.hldataprotection.com/files/2019/11/The-Grand-Fin... This seems to be more about checking to see if imported stuff that might affect national security has any backdoors.
- NovemberWhiskey 5y agoN.B. the date on that PDF is two years ago - it is describing a completely different regulatory change which occurred some time ago.
- Proven 5y ago
- chenzhekl 5y agoThe title on HN is a bit misleading. You should use the original title of the article. According to the article, what requires an import permit is the "foreign 'data encryption technology employing a key length greater than 256 bits'". In reality, the encryption standards (SM1, SM2, SM3, SM4, etc) in China allows strong encryption. I don't see any clues stating that China forbids encryption technology with a key greater than 256 bits.
- tablespoon 5y ago> According to the article, what requires an import permit is the "foreign 'data encryption technology employing a key length greater than 256 bits'". In reality, the encryption standards (SM1, SM2, SM3, SM4, etc) in China allows strong encryption. I don't see any clues stating that China forbids encryption technology with a key greater than 256 bits. I guess that's a nit against the post title, but I don't think it really clarifies much. So they have domestic >256bit ciphers, and this restricts foreign equipment that uses >256bit ciphers. China also has an extensive domestic surveillance system, has lots of weird "national security" regulations (e.g. they use an obfuscated coordinate system for public maps, and IIRC it's illegal to use a GPS receiver for anything resembling mapping), and is also pretty protectionist. What's the purpose of these regulations? Is it... 1. To further strengthen domestic surveillance by encouraging the use of (possibly compromised) domestic encryption equipment, or... 2. protect domestic industry by making certain technology imports difficult, or encourage foreign entities to buy Chinese technology for interoperability reasons, or... 3. discourage the domestic use of foreign equipment on national security grounds (e.g. foreign backdoors), or use interoperability or market-access concerns to weaken foreign equipment, or... 4. all of the above?
- mlindner 5y ago> In reality, the encryption standards (SM1, SM2, SM3, SM4, etc) in China allows strong encryption. Those are not strong encryption standards. They have dual key escrow such that the government can backdoor the connection with their own key. Those are China made encryption standards for use primarily with government products but they are attempting to also force them on the general public. > I don't see any clues stating that China forbids encryption technology with a key greater than 256 bits. That is exactly what this results in, because your choice is either a government backdoored encryption method (which basically means it isn't encrypted at all) or a non-backdoored encryption method that is limited to a key size no greater than 256 bits. I will note, with this over reliance on dual key escrow. If a foreign government were to steal that key through espionage without China's knowledge, it would let say the US government to backdoor China's own government communications.
- 323 5y agoSome say China is recording encrypted traffic today, to decrypt it in the future when quantum computers will be a thing. https://www.bankinfosecurity.com/report-china-to-target-encrypted-data-as-quantum-tech-advances-a-17979 https://www.bankinfosecurity.com/report-china-to-target-encr...
- alfiedotwtf 5y agoFIFY: to decrypt in the future when they access the private key via other means. ... this is why forward secrecy is so important!
- upofadown 5y ago... and deleting your old messages!
- himinlomax 5y agoForward secrecy protects against obtaining keys in the future, not against breaking the encryption.
- VWWHFSfQ 5y agoNSA certainly is [0] [0] https://en.m.wikipedia.org/wiki/Utah_Data_Center https://en.m.wikipedia.org/wiki/Utah_Data_Center
- jmnicolas 5y agoIt's probably too much data to record absolutely everything, but any intelligence agency worth it's salt is certainly doing it with important traffic like embassies coms, enemy military signals etc.
- yabones 5y agoI believe it was Bruce Schneier that said "Encryption is not a lock, it's a timer."
- est 5y agoAnyone got the original link in Chinese?
- rfoo 5y agohttp://images.mofcom.gov.cn/fms/202111/20211116131222501.pdf http://images.mofcom.gov.cn/fms/202111/20211116131222501.pdf To save a click, relevant part from the PDF: 65 软件和信息技术服务业 编号：216501X 技术名称：深度伪造技术 控制要点：笔迹伪造技术、语音伪造技术、图片伪造技术、视频伪造技术、生物特征伪造技术以及其他伪造技术，伪造信息与被伪造信息相似度大于 70% 编号：216502X 技术名称：数据加密技术 控制要点：安全强度高于 256 位加密算法的加密技术 Next HN frontpage news idea: "China bans Deepfake"
- Havoc 5y agoIs there a reason not to jack up the bit count significantly just in case? Or put differently would 10x even have a noticeable performance / UI wise hit?
- codingdave 5y agoTo be clear, the article states that such tech is not forbidden, but that is requires an import permit. Certainly the process of getting a permit opens things up to political interference, but nothing in the article talks about anything that "forbids" the imports, so this headline is not accurate, and does not match the article.
- deleted 5y ago[deleted]
- cesarb 5y agoThere must be something I'm missing here. As far as I know, the state of the art is to use 256 bits for encryption keys, both for symmetric (AES-256, Chacha20) and asymmetric (Curve25519, the 256-bit NIST curves), and they are considered both fast and safe. Are they trying to ban some kind of post-quantum cryptography which uses larger keys?
- bretpiatt 5y agoFor TLS much larger keys are typically used, "The recommended minimum key length is 1024 bits, with 2048 bits preferred, but this is up to a thousand times more computationally intensive than symmetric keys of equivalent strength (e.g. a 2048-bit asymmetric key is approximately equivalent to a 112-bit symmetric key) and makes asymmetric encryption too slow for many purposes." Source: https://www.internetsociety.org/deploy360/tls/basics/ https://www.internetsociety.org/deploy360/tls/basics/
- resoluteteeth 5y agoThis is wrong at least as a response to the original comment, which is correct about the state of the art (TLS is also moving to elliptic curves where shorter keys are used).
- _wldu 5y agoFor signatures, I hope EdDSA wins out over ECDSA.
- monocasa 5y agoTLS isn't encrypting data with those longer keys. That's used for auth and connection bring up before switching to a symmetric encryption scheme to actually encrypt data.
- Retr0id 5y agoCurve448 also exists, which uses ~448-bit keys. Although with that, it only offers 224 bits of security (Compared to Curve25519's 128). And NIST-P521 exists, with similar properties. I wonder whether this legislation strictly applies to the bits-of-security, or bits-of-key-length. IIUC, AES-256 will be fine for the forseeable future, even with quantum computers. However, Curve25519 could fall relatively soon, depending on how rapidly quantum computing advances.
- mensetmanusman 5y agoJust encrypt every letter in a message with 256 bits, ad infinitum.
- howdydoo 5y agoThen your 256 bit encryption becomes a vigenere cipher.
- grishka 5y agoHow could this be possibly enforced with regard to software?
- pjmlp 5y agoSo basically the same old story like US with PGP in the mid-1990's.
- mrweasel 5y agoYeah, because that worked out extremely well. I don't see how they plan to actually enforce this. Sure some commercial projects may get a "China - no import restriction" version, but realistically all open source software will continue as normal, and commercial products will just get the permit. I think this is about being able to target political dissidents for using encryption.
- trasz 5y agoNo, because this is only about control over import of commercial encryption systems, not about using crypto.
- tnli 5y agoSo, send some random noise to somebody you don't like and claim that it's encrypted with some foreign algorithm?
- esjeon 5y agoThe title is misleading, but it gave me a good time. Imagine all companies are sending sensitive documents encrypted with 256-bit keys. Oh, shit, that's a true gold mine. Park near a corporate HQ, scoop up some WiFi traffic, decrypt, and profit.
- DennisP 5y agoThat'd be bad if they were using RSA but elliptic curves and symmetric algorithms are fine at 256 bits.
- esjeon 5y agoYeah, you're right. I was somehow assuming RSA. For anyone not familiar with this, 256-bit ECDSA is considered to have the same security as 3072-bit RSA. A lot of large shops use 2048-bit keys, and GPG folks think 4096 is "unnecessary"[1]. So 3072 is a more-than-decent strength by today's standards. [1]: https://gnupg.org/faq/gnupg-faq.html#not_a_bad_idea_just_unnecessary https://gnupg.org/faq/gnupg-faq.html#not_a_bad_idea_just_unn...
- marcodiego 5y agoI take this is a form of propaganda. To make opposing nations consider the possibility that they have technology to break "data encryption using a key greater than 256 bits".
- Hamuko 5y agoThey might also just be overly optimistic about when they can actually break 256-bit encryption, or they're thinking very long term.
- thesz 5y agoI think that if China has technology to break any [1] encryption with 256 bit key, they should have technology [2] to break encryption with longer keys. [1] Article does not specify encryption algorithms, so we should assume "any encryption algorithm can be broken" here. [2] Contemporary SAT (CDCL) solvers accumulate constraints derived from problem being solved and it has been shown (proven, even) to exponentially speed up search process. Resulting algorithm is still exponential (2^O(N)), but exponentially faster than brute force (different constants).