4 ms·

Keep in mind that as a rule of thumb, its useful to assume that the NSA is about 20 years ahead of the public in crypto research. Even if systems like HTTPS and

by quux 13y ago

Keep in mind that as a rule of thumb, its useful to assume that the NSA is about 20 years ahead of the public in crypto research. Even if systems like HTTPS and Tor appear secure today, the NSA may already have knowledge of weaknesses that we don't.

gulbrandr 13y ago
Could you please provide sources to what you are mentioning?
- quux 13y ago
  see https://news.ycombinator.com/item?id=5939782 https://news.ycombinator.com/item?id=5939782
drstrangevibes 13y ago
blowfish ftw
pja 13y ago
Tor is already vulnerable to anyone that can watch a large enough portion of global network traffic. Thanks to the NSA taps on US internet use & the (recently revealed) taps that GCHQ puts on EU internet traffic travelling through the UK it seems likely that the NSA can track Tor users in the US and most of Europe in real time if they choose to. (It's fairly likely that the US has covertly tapped undersea cables elsewhere in the world as well.)
- DanBC 13y ago
  GCHQ monitors communications world wide. This is recently reported, but has been known for many many years. (Longer than the lifetimes of some HN readers.) It is the publicly stated mission of GCHQ.
- gambiting 13y ago
  Yes, but at least Tor <-> Tor(.onion sites) traffic should still be secure. It's browsing the open Internet that is unsafe.
jnbiche 13y ago
Do you have any kind of source or citation for this? Where does "20 years" come from?
- DanBC 13y ago
  20 years feels a bit strong. But, in general, NSA / GCHQ have many mathematicians working on crypto. Some of them are breaking existing products. Some of them are breaking newer algorithms. Some of them are working on creating newer algorithms. One example of an important cryptosystem that was invented independently in secret before it was invented is public is public-key crypto. (https://en.wikipedia.org/wiki/Clifford_Cocks https://en.wikipedia.org/wiki/Clifford_Cocks) Employment opportunities for mathematicians are slim, and GCHQ is known for tolerance of the sometimes odd behaviour of people with Asperger's.
- quux 13y ago
  I think I first heard this when I took a crypto course in college and read Applied Cryptography, by Bruce Schneier. There was a section in there about the development of DES. At some point the researchers at IBM showed their work in progress on DES to the NSA, and the NSA made a few suggestions on improvements, one of them was a different set of S-Boxes (basically a bunch of constants used as part of the cipher.) IBM analyzed the new S-Boxes and could find no weaknesses so they used the ones the NSA recommended. Over a decade later, differential cryptanalysis was discovered and it turned out that the tweaks the NSA had suggested made DES particularly resistant to differential cryptanalysis. After doing some googling, it seems like the gap has closed since that book was written. They are still ahead, but not as much as they were in the 80's and 90's. Or maybe that's just what they want us to think ;)

by quux 13y ago

gulbrandr 13y ago

Could you please provide sources to what you are mentioning?

quux 13y ago
see https://news.ycombinator.com/item?id=5939782 https://news.ycombinator.com/item?id=5939782

drstrangevibes 13y ago

blowfish ftw

pja 13y ago

Tor is already vulnerable to anyone that can watch a large enough portion of global network traffic. Thanks to the NSA taps on US internet use & the (recently revealed) taps that GCHQ puts on EU internet traffic travelling through the UK it seems likely that the NSA can track Tor users in the US and most of Europe in real time if they choose to. (It's fairly likely that the US has covertly tapped undersea cables elsewhere in the world as well.)

DanBC 13y ago
GCHQ monitors communications world wide. This is recently reported, but has been known for many many years. (Longer than the lifetimes of some HN readers.) It is the publicly stated mission of GCHQ.
gambiting 13y ago
Yes, but at least Tor <-> Tor(.onion sites) traffic should still be secure. It's browsing the open Internet that is unsafe.

jnbiche 13y ago

Do you have any kind of source or citation for this? Where does "20 years" come from?

DanBC 13y ago
20 years feels a bit strong. But, in general, NSA / GCHQ have many mathematicians working on crypto. Some of them are breaking existing products. Some of them are breaking newer algorithms. Some of them are working on creating newer algorithms. One example of an important cryptosystem that was invented independently in secret before it was invented is public is public-key crypto. (https://en.wikipedia.org/wiki/Clifford_Cocks https://en.wikipedia.org/wiki/Clifford_Cocks) Employment opportunities for mathematicians are slim, and GCHQ is known for tolerance of the sometimes odd behaviour of people with Asperger's.
quux 13y ago
I think I first heard this when I took a crypto course in college and read Applied Cryptography, by Bruce Schneier. There was a section in there about the development of DES. At some point the researchers at IBM showed their work in progress on DES to the NSA, and the NSA made a few suggestions on improvements, one of them was a different set of S-Boxes (basically a bunch of constants used as part of the cipher.) IBM analyzed the new S-Boxes and could find no weaknesses so they used the ones the NSA recommended. Over a decade later, differential cryptanalysis was discovered and it turned out that the tweaks the NSA had suggested made DES particularly resistant to differential cryptanalysis. After doing some googling, it seems like the gap has closed since that book was written. They are still ahead, but not as much as they were in the 80's and 90's. Or maybe that's just what they want us to think ;)