40 ms·

I agree crypto on personal and business communication by default would be great, but it won't do much to truly protect the data from national security. If usin

I agree crypto on personal and business communication by default would be great, but it won't do much to truly protect the data from national security. If using NSA approved crypto they'd love that such as RSA. It's newer algorithms like PGP in the 90's that actually protect (or did) or extreme military grade encryption. Trapdoors and algos that can be broken by the NSA are more preferred and don't get the Zimmerman treatment because of that. If I were the NSA I'd do the same thing, it is their job. There really is no way to fully encrypt that isn't undoable by the NSA. As long as it is only the NSA and not some other competitor spying on business ideas and private communications. Trapdoors for national security are typically in the software or a known flaw that makes it easier to decrypt and recover this information, obtain keys or enter the system to trigger and get the needed information to reverse. There are ways to trigger these modes within the software, software to be used by the NSA has to be approved by them. There is a reason you are subject to all sorts of scrutiny if you don't use approved algos/software wherever you do encryption/decryption (even when you upload a new app you are asked this and can cause problems if you aren't using the system crypto libraries). http://www.rsa.com/rsalabs/node.asp?id=2188 http://www.rsa.com/rsalabs/node.asp?id=2188 http://www.rsa.com/rsalabs/node.asp?id=2240 http://www.rsa.com/rsalabs/node.asp?id=2240 If you want to test this, simply make your own crypto lib and send some comms to a bad place in current geopolitics (I don't recommend it). Soon you will get a visit from the FBI and you may get the Phil Zimmerman treatment. Again, can't fault them, it is their job, but understand nothing is truly secure from national security. Yes it might be impossible for other businesses to read it or individuals but not the organization that employs the greatest cryptographers of all time.

ds9 13y ago
Where do you get the claim that NSA can reverse cryto that is generally believed unbreakable? Maybe you meant to refer to DSA, which is deprecated, in this line: "If using NSA approved crypto they'd love that such as RSA". RSA is used today for SSH keys. How about links supporting the claims about NSA? I don't doubt they're trying to break any encryption as far as possible, but the statement that they definitely can break anything needs some evidence.
- drawkbox 13y ago
  The algorithms may be secure, the software isn't always, much like backdoors in software so to can the libraries that do the encryption even outside the software (Windows even had an NSA backdoor in the 90's - http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-creates-security-hole-in-windows http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-crea...). They confirm nor deny this but I ask you if you were a national security cryptography agency what would you be doing? Some papers on some techniques, even modes that make weaker key generation: http://www.cryptovirology.com/cryptovfiles/newbook.html http://www.cryptovirology.com/cryptovfiles/newbook.html The last real non NSA approved system was PGP in early 1990's, look up Phil Zimmerman and understand that if you create a system that the NSA has trouble peering into if needed (sometimes with considerable processing power) you will be contacted. http://www.rsa.com/rsalabs/node.asp?id=2316 http://www.rsa.com/rsalabs/node.asp?id=2316 "As the premier cryptographic government agency, the NSA has huge financial and computer resources and employs a host of cryptographers. Developments in cryptography achieved at the NSA are not made public; this secrecy has led to many rumors about the NSA's ability to break popular cryptosystems like DES (see Section 3.2), as well as rumors that the NSA has secretly placed weaknesses, called ``trapdoors,'' in government-endorsed cryptosystems. These rumors have never been proved or disproved. Also the criteria used by the NSA in selecting cryptography standards have never been made public." There would never be definitive evidence and if so it would cause huge problems, for most communications including fast SSL/HTTPS exchanges for business or regular private communications this is not a worry. Most encryption is good enough for that level of communication, there is a reason though the military for sensitive information is using much greater levels and systems for crypto than consumer grade. Just don't be naive to think the NSA can't right now read all of your communications encrypted or not through many avenues trapdoors, backdoors in libraries, taking over computers to get private keys (all keys are stored somewhere and all passwords have to be typed in at some point) etc.
  - nearengine 13y ago
    Do you have any further info on "the military for sensitive information is using much greater levels and systems for crypto than consumer grade"? From what I understand, the DoD standard is AES 128.

ds9 13y ago

Where do you get the claim that NSA can reverse cryto that is generally believed unbreakable? Maybe you meant to refer to DSA, which is deprecated, in this line: "If using NSA approved crypto they'd love that such as RSA". RSA is used today for SSH keys. How about links supporting the claims about NSA? I don't doubt they're trying to break any encryption as far as possible, but the statement that they definitely can break anything needs some evidence.

drawkbox 13y ago
The algorithms may be secure, the software isn't always, much like backdoors in software so to can the libraries that do the encryption even outside the software (Windows even had an NSA backdoor in the 90's - http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-creates-security-hole-in-windows http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-crea...). They confirm nor deny this but I ask you if you were a national security cryptography agency what would you be doing? Some papers on some techniques, even modes that make weaker key generation: http://www.cryptovirology.com/cryptovfiles/newbook.html http://www.cryptovirology.com/cryptovfiles/newbook.html The last real non NSA approved system was PGP in early 1990's, look up Phil Zimmerman and understand that if you create a system that the NSA has trouble peering into if needed (sometimes with considerable processing power) you will be contacted. http://www.rsa.com/rsalabs/node.asp?id=2316 http://www.rsa.com/rsalabs/node.asp?id=2316 "As the premier cryptographic government agency, the NSA has huge financial and computer resources and employs a host of cryptographers. Developments in cryptography achieved at the NSA are not made public; this secrecy has led to many rumors about the NSA's ability to break popular cryptosystems like DES (see Section 3.2), as well as rumors that the NSA has secretly placed weaknesses, called ``trapdoors,'' in government-endorsed cryptosystems. These rumors have never been proved or disproved. Also the criteria used by the NSA in selecting cryptography standards have never been made public." There would never be definitive evidence and if so it would cause huge problems, for most communications including fast SSL/HTTPS exchanges for business or regular private communications this is not a worry. Most encryption is good enough for that level of communication, there is a reason though the military for sensitive information is using much greater levels and systems for crypto than consumer grade. Just don't be naive to think the NSA can't right now read all of your communications encrypted or not through many avenues trapdoors, backdoors in libraries, taking over computers to get private keys (all keys are stored somewhere and all passwords have to be typed in at some point) etc.
- nearengine 13y ago
  Do you have any further info on "the military for sensitive information is using much greater levels and systems for crypto than consumer grade"? From what I understand, the DoD standard is AES 128.