4 ms·

"In the meantime, both NIST and the NSA have some explaining to do." Not happening. Hasn't yet, nor will it. NSA just keeps quite and watches for someone to us

by delinka 14y ago

"In the meantime, both NIST and the NSA have some explaining to do." Not happening. Hasn't yet, nor will it. NSA just keeps quite and watches for someone to use their particular algorithm. We should assume malicious intent and take Schneier's advice: "My recommendation, if you're in need of a random-number generator, is not to use Dual_EC_DRBG under any circumstances." And if you "don't have anything to hide," then I propose you've given up already and cryptography is useless to you.

lmm 14y ago
Not entirely. While the best cryptography is that which is secure against everyone (duh), there are a vast number of perfectly legitimate use cases for cryptography where it doesn't matter if the NSA can read your encrypted data.
- tych0 14y ago
  Are there? If I knew something had a backdoor, I'd always wonder who else has figured it out.
- delinka 14y ago
  I'd rather err on the side of keeping them in the dark all the time. Encrypting data differently based on whether I mind if NSA sees it leaks information. Specifically, that this data doesn't matter but that data does and NSA should focus their efforts on breaking that data or analyzing that social graph affiliated with the data.
- nathan_long 14y ago
  I can't imagine any legitimate use case for crappy cryptography, and any crypto with a backdoor is crappy. If the door is there, anyone with the key can open it. How can you be sure who will get the key, or what their motives will be? Good, modern cryptography offers a level of security unparalleled in the physical world, and at a processing cost which any computer can handle. Why would you intentionally choose something inferior?
  - lmm 14y ago
    >How can you be sure who will get the key, or what their motives will be? You can never be infinitely certain, but nor can you be certain your non-backdoored crypto is secure. There are cases where "the NSA leaks their top-secret backdoor to the internet" is a vanishingly small threat vector compared to other possibilities (e.g. rubber hoses). >Good, modern cryptography offers a level of security unparalleled in the physical world, and at a processing cost which any computer can handle. Why would you intentionally choose something inferior? You wouldn't. But if it later turns out the NSA has a backdoor in the algorithm you happened to pick, and for whatever reason you're unable or unwilling to change algorithms now, that still doesn't mean "you've given up already and cryptography is useless to you".
    - nathan_long 14y ago
      > You can never be infinitely certain, but nor can you be certain your non-backdoored crypto is secure. True. But "is this algorithm crackable?" is a question that can be answered with experimentation and math. "Has the NSA lost its keys or its scruples, and if not, will they ever?" cannot be answered at all until you know you've been hacked. > But if it later turns out the NSA has a backdoor in the algorithm you happened to pick, and for whatever reason you're unable or unwilling to change algorithms now, that still doesn't mean "you've given up already and cryptography is useless to you". Maybe not, but it does mean you value something else more than you value security. Yes, everyone makes cost/benefit decisions about security. But if your answer to "whoops, whoever knows this trick can see all our bank transactions" is "meh, it would take like, a week to fix that," you're placing a pretty low value on security.
  - DanBC 14y ago
    The example often given is "MILITARY GRADE ENCRYPTION" - if tank driver Bob is given commands to shell a target those commands only need to be secret for a short length of time. It doesn't matter if the enemy can decrypt them by taking a week's time, because Bob will have attacked the target and gone by then. This is, obviously, a really old example, because modern hardware makes encrypting things quick and easy, and decrypting things quick and easy. But imagine strong encryption in the 1980s - you had to balance strength with time with size and then try to cram it into low-specced hardware.
tptacek 14y ago
You don't have to take Schneier's advice in order to not end up with an elliptic curve random number generator. Nobody does that anyways.
- NegativeK 14y ago
  Can you elaborate on why?
  - _exec 14y ago
    I'm curious as well. Why not?
    - tptacek 14y ago
      'pbsd gave a much better answer than I could have.
  - pbsd 14y ago
    1 - Very slow 2 - A nightmare to implement securely 3 - Only exists for the sake of provable security 4 - The same standard defines a much better alternative pseudorandom generators based on hashes and/or block ciphers.
    - marshray 14y ago
      Which raises the question of why such a useless thing was even standardized in the first place.
      - fusiongyro 14y ago
        From that perspective, one wonders if they are instead aware of attacks on the other three and designed the fourth to withstand those attacks (but look suspicious and be unappealingly slow). Overall, the mental game is quite taxing, so I'm going to plead "bureaucracy."
        14y ago

by delinka 14y ago

lmm 14y ago

Not entirely. While the best cryptography is that which is secure against everyone (duh), there are a vast number of perfectly legitimate use cases for cryptography where it doesn't matter if the NSA can read your encrypted data.

tych0 14y ago
Are there? If I knew something had a backdoor, I'd always wonder who else has figured it out.
delinka 14y ago
I'd rather err on the side of keeping them in the dark all the time. Encrypting data differently based on whether I mind if NSA sees it leaks information. Specifically, that this data doesn't matter but that data does and NSA should focus their efforts on breaking that data or analyzing that social graph affiliated with the data.
nathan_long 14y ago
I can't imagine any legitimate use case for crappy cryptography, and any crypto with a backdoor is crappy. If the door is there, anyone with the key can open it. How can you be sure who will get the key, or what their motives will be? Good, modern cryptography offers a level of security unparalleled in the physical world, and at a processing cost which any computer can handle. Why would you intentionally choose something inferior?
- lmm 14y ago
  >How can you be sure who will get the key, or what their motives will be? You can never be infinitely certain, but nor can you be certain your non-backdoored crypto is secure. There are cases where "the NSA leaks their top-secret backdoor to the internet" is a vanishingly small threat vector compared to other possibilities (e.g. rubber hoses). >Good, modern cryptography offers a level of security unparalleled in the physical world, and at a processing cost which any computer can handle. Why would you intentionally choose something inferior? You wouldn't. But if it later turns out the NSA has a backdoor in the algorithm you happened to pick, and for whatever reason you're unable or unwilling to change algorithms now, that still doesn't mean "you've given up already and cryptography is useless to you".
  - nathan_long 14y ago
    > You can never be infinitely certain, but nor can you be certain your non-backdoored crypto is secure. True. But "is this algorithm crackable?" is a question that can be answered with experimentation and math. "Has the NSA lost its keys or its scruples, and if not, will they ever?" cannot be answered at all until you know you've been hacked. > But if it later turns out the NSA has a backdoor in the algorithm you happened to pick, and for whatever reason you're unable or unwilling to change algorithms now, that still doesn't mean "you've given up already and cryptography is useless to you". Maybe not, but it does mean you value something else more than you value security. Yes, everyone makes cost/benefit decisions about security. But if your answer to "whoops, whoever knows this trick can see all our bank transactions" is "meh, it would take like, a week to fix that," you're placing a pretty low value on security.
- DanBC 14y ago
  The example often given is "MILITARY GRADE ENCRYPTION" - if tank driver Bob is given commands to shell a target those commands only need to be secret for a short length of time. It doesn't matter if the enemy can decrypt them by taking a week's time, because Bob will have attacked the target and gone by then. This is, obviously, a really old example, because modern hardware makes encrypting things quick and easy, and decrypting things quick and easy. But imagine strong encryption in the 1980s - you had to balance strength with time with size and then try to cram it into low-specced hardware.

tptacek 14y ago

You don't have to take Schneier's advice in order to not end up with an elliptic curve random number generator. Nobody does that anyways.

NegativeK 14y ago
Can you elaborate on why?
- _exec 14y ago
  I'm curious as well. Why not?
  - tptacek 14y ago
    'pbsd gave a much better answer than I could have.
- pbsd 14y ago
  1 - Very slow 2 - A nightmare to implement securely 3 - Only exists for the sake of provable security 4 - The same standard defines a much better alternative pseudorandom generators based on hashes and/or block ciphers.
  - marshray 14y ago
    Which raises the question of why such a useless thing was even standardized in the first place.
    - fusiongyro 14y ago
      From that perspective, one wonders if they are instead aware of attacks on the other three and designed the fourth to withstand those attacks (but look suspicious and be unappealingly slow). Overall, the mental game is quite taxing, so I'm going to plead "bureaucracy."
      - 14y ago