4 ms·

Where do you get the claim that NSA can reverse cryto that is generally believed unbreakable? Maybe you meant to refer to DSA, which is deprecated, in this line

by ds9 13y ago

Where do you get the claim that NSA can reverse cryto that is generally believed unbreakable? Maybe you meant to refer to DSA, which is deprecated, in this line: "If using NSA approved crypto they'd love that such as RSA". RSA is used today for SSH keys. How about links supporting the claims about NSA? I don't doubt they're trying to break any encryption as far as possible, but the statement that they definitely can break anything needs some evidence.

drawkbox 13y ago
The algorithms may be secure, the software isn't always, much like backdoors in software so to can the libraries that do the encryption even outside the software (Windows even had an NSA backdoor in the 90's - http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-creates-security-hole-in-windows http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-crea...). They confirm nor deny this but I ask you if you were a national security cryptography agency what would you be doing? Some papers on some techniques, even modes that make weaker key generation: http://www.cryptovirology.com/cryptovfiles/newbook.html http://www.cryptovirology.com/cryptovfiles/newbook.html The last real non NSA approved system was PGP in early 1990's, look up Phil Zimmerman and understand that if you create a system that the NSA has trouble peering into if needed (sometimes with considerable processing power) you will be contacted. http://www.rsa.com/rsalabs/node.asp?id=2316 http://www.rsa.com/rsalabs/node.asp?id=2316 "As the premier cryptographic government agency, the NSA has huge financial and computer resources and employs a host of cryptographers. Developments in cryptography achieved at the NSA are not made public; this secrecy has led to many rumors about the NSA's ability to break popular cryptosystems like DES (see Section 3.2), as well as rumors that the NSA has secretly placed weaknesses, called ``trapdoors,'' in government-endorsed cryptosystems. These rumors have never been proved or disproved. Also the criteria used by the NSA in selecting cryptography standards have never been made public." There would never be definitive evidence and if so it would cause huge problems, for most communications including fast SSL/HTTPS exchanges for business or regular private communications this is not a worry. Most encryption is good enough for that level of communication, there is a reason though the military for sensitive information is using much greater levels and systems for crypto than consumer grade. Just don't be naive to think the NSA can't right now read all of your communications encrypted or not through many avenues trapdoors, backdoors in libraries, taking over computers to get private keys (all keys are stored somewhere and all passwords have to be typed in at some point) etc.
- nearengine 13y ago
  Do you have any further info on "the military for sensitive information is using much greater levels and systems for crypto than consumer grade"? From what I understand, the DoD standard is AES 128.
  - drawkbox 13y ago
    For commercial and FIPS supported that works, also for SECRET data. AES 192 and 256 are approved for TOP SECRET data. http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Security http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Se... However I am pretty sure noone is uploading target coordinates or guiding missiles using AES 256 even, it seems. I could be wrong but I would assume something greater. It is assumed the NSA, other than side channel attacks, cannot break AES as of 2006, still it is getting close. "AES has 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys. By 2006, the best known attacks were on 7 rounds for 128-bit keys, 8 rounds for 192-bit keys, and 9 rounds for 256-bit keys.[11]"
- antihero 13y ago
  What about, for instance, GnuPG, which is open-source?
cantos 13y ago
If any evidence of the kind ever came out it would be the top story for every news organization in the US. So logically, since we all know with unshakable certainty that the NSA has such capabilities, they must be suppressing and controlling the media.
- drawkbox 13y ago
  Right, this wouldn't even be news, noone cares. Is the topic of this thread in the news? AP phone logs are recently, echelon was previously, noone cares about CISPA, SOPA, AT&T diverting traffic for NSA (wired - http://www.wired.com/science/discoveries/news/2006/04/70619 http://www.wired.com/science/discoveries/news/2006/04/70619 - did you hear about this one on CNN?) etc in mainstream news. The media would quickly label this 'conspiracy' and people would turn off their minds largely like your response. Even if there were multiple whistleblowers on something like this the individuals would be attacked on their character and it would move onto the next (wikileaks). Writers would be most likely committing career suicide attacking something that big even with lots of evidence. If our security agencies aren't doing this we are going to fail, the Chinese, Russians are all doing this even as recent at the Chinese attacks on Google. It is almost always flaws in software that facilitate the communication not the algorithms themselves. You could easily test this. Modify OpenSSL (which recently had a keygen issue making weaker keys and has had holes before: http://www.gartner.com/id=676807 http://www.gartner.com/id=676807), then upload an app that allows encrypted communication and when you upload it to Apple answer the question of 'Yes' to using new cryptography. They are mainly there for export controls but you won't be able to publish that app without an FBI/NSA review if you had added new cryptography algorithms, they have to be approved. Good luck if you send any messages to geopolitical sensitive places without an approved algo or library. It doesn't mean people aren't trying to make new crypto libs: http://www.wired.com/science/discoveries/news/2006/04/70524 http://www.wired.com/science/discoveries/news/2006/04/70524 because there are lots of systems to track you now: http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ + http://www.theverge.com/2012/3/15/2876528/wired-nsa-building-massive-surveillance-codebreaking-facility http://www.theverge.com/2012/3/15/2876528/wired-nsa-building... and on and on.

by ds9 13y ago

drawkbox 13y ago

The algorithms may be secure, the software isn't always, much like backdoors in software so to can the libraries that do the encryption even outside the software (Windows even had an NSA backdoor in the 90's - http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-creates-security-hole-in-windows http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-crea...). They confirm nor deny this but I ask you if you were a national security cryptography agency what would you be doing? Some papers on some techniques, even modes that make weaker key generation: http://www.cryptovirology.com/cryptovfiles/newbook.html http://www.cryptovirology.com/cryptovfiles/newbook.html The last real non NSA approved system was PGP in early 1990's, look up Phil Zimmerman and understand that if you create a system that the NSA has trouble peering into if needed (sometimes with considerable processing power) you will be contacted. http://www.rsa.com/rsalabs/node.asp?id=2316 http://www.rsa.com/rsalabs/node.asp?id=2316 "As the premier cryptographic government agency, the NSA has huge financial and computer resources and employs a host of cryptographers. Developments in cryptography achieved at the NSA are not made public; this secrecy has led to many rumors about the NSA's ability to break popular cryptosystems like DES (see Section 3.2), as well as rumors that the NSA has secretly placed weaknesses, called ``trapdoors,'' in government-endorsed cryptosystems. These rumors have never been proved or disproved. Also the criteria used by the NSA in selecting cryptography standards have never been made public." There would never be definitive evidence and if so it would cause huge problems, for most communications including fast SSL/HTTPS exchanges for business or regular private communications this is not a worry. Most encryption is good enough for that level of communication, there is a reason though the military for sensitive information is using much greater levels and systems for crypto than consumer grade. Just don't be naive to think the NSA can't right now read all of your communications encrypted or not through many avenues trapdoors, backdoors in libraries, taking over computers to get private keys (all keys are stored somewhere and all passwords have to be typed in at some point) etc.

nearengine 13y ago
Do you have any further info on "the military for sensitive information is using much greater levels and systems for crypto than consumer grade"? From what I understand, the DoD standard is AES 128.
- drawkbox 13y ago
  For commercial and FIPS supported that works, also for SECRET data. AES 192 and 256 are approved for TOP SECRET data. http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Security http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Se... However I am pretty sure noone is uploading target coordinates or guiding missiles using AES 256 even, it seems. I could be wrong but I would assume something greater. It is assumed the NSA, other than side channel attacks, cannot break AES as of 2006, still it is getting close. "AES has 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys. By 2006, the best known attacks were on 7 rounds for 128-bit keys, 8 rounds for 192-bit keys, and 9 rounds for 256-bit keys.[11]"
antihero 13y ago
What about, for instance, GnuPG, which is open-source?

cantos 13y ago

If any evidence of the kind ever came out it would be the top story for every news organization in the US. So logically, since we all know with unshakable certainty that the NSA has such capabilities, they must be suppressing and controlling the media.

drawkbox 13y ago
Right, this wouldn't even be news, noone cares. Is the topic of this thread in the news? AP phone logs are recently, echelon was previously, noone cares about CISPA, SOPA, AT&T diverting traffic for NSA (wired - http://www.wired.com/science/discoveries/news/2006/04/70619 http://www.wired.com/science/discoveries/news/2006/04/70619 - did you hear about this one on CNN?) etc in mainstream news. The media would quickly label this 'conspiracy' and people would turn off their minds largely like your response. Even if there were multiple whistleblowers on something like this the individuals would be attacked on their character and it would move onto the next (wikileaks). Writers would be most likely committing career suicide attacking something that big even with lots of evidence. If our security agencies aren't doing this we are going to fail, the Chinese, Russians are all doing this even as recent at the Chinese attacks on Google. It is almost always flaws in software that facilitate the communication not the algorithms themselves. You could easily test this. Modify OpenSSL (which recently had a keygen issue making weaker keys and has had holes before: http://www.gartner.com/id=676807 http://www.gartner.com/id=676807), then upload an app that allows encrypted communication and when you upload it to Apple answer the question of 'Yes' to using new cryptography. They are mainly there for export controls but you won't be able to publish that app without an FBI/NSA review if you had added new cryptography algorithms, they have to be approved. Good luck if you send any messages to geopolitical sensitive places without an approved algo or library. It doesn't mean people aren't trying to make new crypto libs: http://www.wired.com/science/discoveries/news/2006/04/70524 http://www.wired.com/science/discoveries/news/2006/04/70524 because there are lots of systems to track you now: http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ + http://www.theverge.com/2012/3/15/2876528/wired-nsa-building-massive-surveillance-codebreaking-facility http://www.theverge.com/2012/3/15/2876528/wired-nsa-building... and on and on.