5 ms·

Meanwhile the NSA is spying on the entire world's Internet communications, including those of all US citizens, without warrant: http://en.wikipedia.org/wiki/St

by bascule 14y ago

Meanwhile the NSA is spying on the entire world's Internet communications, including those of all US citizens, without warrant: http://en.wikipedia.org/wiki/Stellar_Wind_(code_name) http://en.wikipedia.org/wiki/Stellar_Wind_(code_name)

manicbovine 14y ago
Funny enough, I was reading about this last night. There are so many extraordinary claims in the Wired article [1], that I found it all hard to believe. It'd require sci-fi technology to actively mine and decrypt every electronic transaction around the world. Imagine decrypting just all of the weakly-encrypted data --- sure, one communication stream is trivial. Billions at once? That's insane -- I'm not sure if there is enough energy on this planet. I also don't understand the cost-benefit ratio associated with actively spying on every transaction in the US. The vast majority of adversaries are outside the US, clustered in a handful of countries. I know that the US ran massive domestic anti-communism operations during the Cold War, but that would have been far cheaper than setting up a data center capable of capturing, storing, and processing every electronic transaction. (And even those Cold War operations didn't focus on every American.) It reminds me of clients who think I can predict basically anything if I have enough data and computational power. Most of them seem to think that I can automate the process, that they don't need to be involved, that it doesn't take weeks of gut feeling analysis, and that it'll basically give them God-like omniscience. I spend a lot of time educating customers about the limits of "big data". If the federal government is running such a program, they need to hire a consultant for education's sake. Edit: Also, reading the post about NSL's [2], I get the impression that the NSA is still at the same level of tech as the general public. Why wouldn't they just use Stellar Wind? [1] http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ [2] https://www.noisebridge.net/pipermail/noisebridge-discuss/2013-March/035200.html https://www.noisebridge.net/pipermail/noisebridge-discuss/20...
- gsibble 14y ago
  I've always assumed that they have backdoors into all of the publicly common crytography protocols so they are effectively violating Moore's law (by not having to brute-force). Remember, it was the NSA that designed most of them to begin with and still hires the best of the best to continue the work. It's also probably a lot easier to just tap into everything and record it for later decryption if necessary than try to target various networks or systems individually.
  - manicbovine 14y ago
    Well it depends on what you mean by backdoor. Just to pick one... let's take AES. There are a lot of open-source implementations, depending on your platform. Almost all of them are open-source [0]. Furthermore, AES is based on the Rijndael cipher [1], which is simply a mathematical process that an undergrad could understand and implement. Ignoring the fact that the major implementations have been poured over and audited by many researchers (and that you could do the same), it'd be just too risky to put a backdoor into an open implementation. It might be possible that the NSA has discovered some side-channel attack [2]. If that's what you mean by backdoor, then I suppose you could be right. (Perhaps every CPU has been manufactured so as to facilitate timing attacks.) I still think that the probabilities combine to some astronomically low number because those attacks still take time, and I don't think they have the computational ability to simultaneously run attacks against any very large subset of the US population. I don't trust secret, unaccountable organizations... but it just seems too extraordinary to imagine that any organization could actively monitor billions (millions, even) of communication streams at a time. [0] http://en.wikipedia.org/wiki/AES_implementations http://en.wikipedia.org/wiki/AES_implementations [1] http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf#page=1 http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.... [2] http://en.wikipedia.org/wiki/Side-channel_attacks http://en.wikipedia.org/wiki/Side-channel_attacks
  - danielweber 14y ago
    For DES, NSA proposed new S-box values that turned out to be better at resisting differential cryptoanalysis -- and differential cryptanalysis would not be discovered by people outside the NSA for years. Maybe this is just how masterfully deceitful they are.
- bascule 14y ago
  Their goal is to collect and archive the data, much of which is plaintext anyway. With plans to archive it for 100 years, they can just simply wait until vulnerabilities in block ciphers are discovered (possibly by the NSA) and hold on to the data until then and decrypt it. I'm sure they're decrypting everything they know how, but for everything else, it's just archival.

by bascule 14y ago

manicbovine 14y ago

Funny enough, I was reading about this last night. There are so many extraordinary claims in the Wired article [1], that I found it all hard to believe. It'd require sci-fi technology to actively mine and decrypt every electronic transaction around the world. Imagine decrypting just all of the weakly-encrypted data --- sure, one communication stream is trivial. Billions at once? That's insane -- I'm not sure if there is enough energy on this planet. I also don't understand the cost-benefit ratio associated with actively spying on every transaction in the US. The vast majority of adversaries are outside the US, clustered in a handful of countries. I know that the US ran massive domestic anti-communism operations during the Cold War, but that would have been far cheaper than setting up a data center capable of capturing, storing, and processing every electronic transaction. (And even those Cold War operations didn't focus on every American.) It reminds me of clients who think I can predict basically anything if I have enough data and computational power. Most of them seem to think that I can automate the process, that they don't need to be involved, that it doesn't take weeks of gut feeling analysis, and that it'll basically give them God-like omniscience. I spend a lot of time educating customers about the limits of "big data". If the federal government is running such a program, they need to hire a consultant for education's sake. Edit: Also, reading the post about NSL's [2], I get the impression that the NSA is still at the same level of tech as the general public. Why wouldn't they just use Stellar Wind? [1] http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ [2] https://www.noisebridge.net/pipermail/noisebridge-discuss/2013-March/035200.html https://www.noisebridge.net/pipermail/noisebridge-discuss/20...

gsibble 14y ago
I've always assumed that they have backdoors into all of the publicly common crytography protocols so they are effectively violating Moore's law (by not having to brute-force). Remember, it was the NSA that designed most of them to begin with and still hires the best of the best to continue the work. It's also probably a lot easier to just tap into everything and record it for later decryption if necessary than try to target various networks or systems individually.
- manicbovine 14y ago
  Well it depends on what you mean by backdoor. Just to pick one... let's take AES. There are a lot of open-source implementations, depending on your platform. Almost all of them are open-source [0]. Furthermore, AES is based on the Rijndael cipher [1], which is simply a mathematical process that an undergrad could understand and implement. Ignoring the fact that the major implementations have been poured over and audited by many researchers (and that you could do the same), it'd be just too risky to put a backdoor into an open implementation. It might be possible that the NSA has discovered some side-channel attack [2]. If that's what you mean by backdoor, then I suppose you could be right. (Perhaps every CPU has been manufactured so as to facilitate timing attacks.) I still think that the probabilities combine to some astronomically low number because those attacks still take time, and I don't think they have the computational ability to simultaneously run attacks against any very large subset of the US population. I don't trust secret, unaccountable organizations... but it just seems too extraordinary to imagine that any organization could actively monitor billions (millions, even) of communication streams at a time. [0] http://en.wikipedia.org/wiki/AES_implementations http://en.wikipedia.org/wiki/AES_implementations [1] http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf#page=1 http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.... [2] http://en.wikipedia.org/wiki/Side-channel_attacks http://en.wikipedia.org/wiki/Side-channel_attacks
- danielweber 14y ago
  For DES, NSA proposed new S-box values that turned out to be better at resisting differential cryptoanalysis -- and differential cryptanalysis would not be discovered by people outside the NSA for years. Maybe this is just how masterfully deceitful they are.
bascule 14y ago
Their goal is to collect and archive the data, much of which is plaintext anyway. With plans to archive it for 100 years, they can just simply wait until vulnerabilities in block ciphers are discovered (possibly by the NSA) and hold on to the data until then and decrypt it. I'm sure they're decrypting everything they know how, but for everything else, it's just archival.