3 ms·

This is a pointless article, and I'm going to be maintaining skepticism until there's some detail. For example: Do they have an actual method for breaking PGP,

This is a pointless article, and I'm going to be maintaining skepticism until there's some detail. For example: Do they have an actual method for breaking PGP, or do they have some sort of backdoor they've planted? Or some sort of access to the keys through other means? If they have an actual method to break PGP, does it work against all the algorithms, or just one or a few? Does it work against arbitrary key length, or is there a maximum they can break? If it's general-purpose enough to be just "PGP" regardless of algorithm/key length, how quickly can they decrypt? Is this real time? Is it "we can decrypt in time to find out where next week's attack will be"? Is it "we can decrypt in time to present evidence at this guy's trial next year"? Without that sort of information this reads like a scary mistranslation, and not the sort of thing a government would disclose anyway.

rubbingalcohol 13y ago
Correct. PGP mixes symmetric and public key encryption algorithms, letting you choose your favorite ciphers and key lengths. You can choose RSA, DSA, AES, CAST5, TripleDES, etc. To say you've "cracked PGP" is akin to saying you've cracked pretty much all of the widely-accepted ciphers out there. I don't buy it.
- crocowhile 13y ago
  Right. That may be what "at least partially" refers to. They may be able to crack one in some conditions...
- sounds 13y ago
  I'm looking for any algorithms among those you listed that is considered weak. http://en.wikipedia.org/wiki/Triple_DES#Security http://en.wikipedia.org/wiki/Triple_DES#Security - ok, that has chosen plaintext weaknesses. I don't see much information on CAST5 aka CAST128, can someone chime in with its current status? I suppose you could encrypt an image using ECB. Would PGP allow this kind of broken configuration? http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/ http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/
  - rubbingalcohol 13y ago
    PGP uses CFB mode. To my knowledge there is no implementation that would let you use ECB. http://tools.ietf.org/html/rfc4880 http://tools.ietf.org/html/rfc4880
glurgh 13y ago
It's not a scary mistranslation, just a lousy title in the original article. The question is posed in such a general way that it can be answered without providing any specifics or making any claims about particular crypto technologies. And that's exactly how it's answered.
sentenza 13y ago
Ok, in the fist sentence of the original, it says that they can decrypt PGP partially. The whole report is based on one sentence that a spokesperson said at some point. For some context: The news releases from German security agencies tend to be imprecise on technical details in a way that suggests that the lack of precision is not on purpose. From all that I've heard on the German media, practically all surveillance techniques they use to get at encrypted communications consist of compromising your machine and thus getting at the unencrypted data. At least that was the real story when they claimed they wanted to "wiretap" skype.
- glurgh 13y ago
  That's just the first sentence of the original, poorly titled article. Click through to the PDF and see what you make of it - in my reading, neither the question nor the answer say anything specific about PGP at all - especially the answer.

rubbingalcohol 13y ago

Correct. PGP mixes symmetric and public key encryption algorithms, letting you choose your favorite ciphers and key lengths. You can choose RSA, DSA, AES, CAST5, TripleDES, etc. To say you've "cracked PGP" is akin to saying you've cracked pretty much all of the widely-accepted ciphers out there. I don't buy it.

crocowhile 13y ago
Right. That may be what "at least partially" refers to. They may be able to crack one in some conditions...
sounds 13y ago
I'm looking for any algorithms among those you listed that is considered weak. http://en.wikipedia.org/wiki/Triple_DES#Security http://en.wikipedia.org/wiki/Triple_DES#Security - ok, that has chosen plaintext weaknesses. I don't see much information on CAST5 aka CAST128, can someone chime in with its current status? I suppose you could encrypt an image using ECB. Would PGP allow this kind of broken configuration? http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/ http://pthree.org/2012/02/17/ecb-vs-cbc-encryption/
- rubbingalcohol 13y ago
  PGP uses CFB mode. To my knowledge there is no implementation that would let you use ECB. http://tools.ietf.org/html/rfc4880 http://tools.ietf.org/html/rfc4880

glurgh 13y ago

It's not a scary mistranslation, just a lousy title in the original article. The question is posed in such a general way that it can be answered without providing any specifics or making any claims about particular crypto technologies. And that's exactly how it's answered.

sentenza 13y ago

Ok, in the fist sentence of the original, it says that they can decrypt PGP partially. The whole report is based on one sentence that a spokesperson said at some point. For some context: The news releases from German security agencies tend to be imprecise on technical details in a way that suggests that the lack of precision is not on purpose. From all that I've heard on the German media, practically all surveillance techniques they use to get at encrypted communications consist of compromising your machine and thus getting at the unencrypted data. At least that was the real story when they claimed they wanted to "wiretap" skype.

glurgh 13y ago
That's just the first sentence of the original, poorly titled article. Click through to the PDF and see what you make of it - in my reading, neither the question nor the answer say anything specific about PGP at all - especially the answer.