8 ms·
This seems like a good plan to me, but can any crypto pros poke holes in it?
by hayksaakian 13y ago
This seems like a good plan to me, but can any crypto pros poke holes in it?
- rubbingalcohol 13y agoSure. I'll get back to you in a few trillion years.
- cheald 13y agoPsh, everyone knows that it only takes the span of a commercial break to crack military-grade double-layered crypto if you use a logic bomb.
- marcamillion 13y agoSo why don't you do it then? You would be famous for sure.
- cheald 13y agoI would, but I don't know how to write a GUI interface in Visual Basic :(
- raverbashing 13y agoDecrypting [====______]
- Keyframe 13y agoI don't know VB though. On a serious note I wonder if there are guys out there that treat this tease as a challenge and try to poke holes themselves. Must be a thrill.
- SimHacker 13y agoHey guys and gals, I just found an FTP server FULL of secret NSA files! Its IP address is 127.0.0.1 -- check it out!!! http://www.cryonet.org/cgi-bin/dsp.cgi?msg=6289 http://www.cryonet.org/cgi-bin/dsp.cgi?msg=6289
- nwh 13y agoWhen you're up against the US government with all of their cracking hardware, your passphrase won't be simple.
- jlgreco 13y agoUnless the insurance files are bluffs, you may as well give the US government the keys yourself so that they know you are not bluffing. The threat that makes the insurance files work is that the public/press and/or foreign governments may get the keys.
- kaolinite 13y agoThe problem with doing that is that the US government might release the information themselves, just dampened a bit with some PR, so the insurance files aren't worth anything and so WikiLeaks don't get the credit.
- XorNot 13y agoWhich would generally imply that they're not very good insurance files. I had the last one for a bit, and deleted it just now because I'm seriously doubtful these things are anything more then /dev/urandom piped into a file.
- nwh 13y agoWhat gives you any indication of that? There's no way of telling a ciphertext from random bytes.
- gwern 13y agoWell, obviously, there's no way of telling or he'd simply crack the file and say it was random. His point is based more on softer considerations like "they never used the previous insurance file yet, have they?" and "Wikileaks pulls a lot of stunts" and "this is just the sort of thing that would appeal to a cryptogeek like Assange whose avowed purpose is to throw sand into the gears of secretive organizations" and "so how did they get 300GB+ of leaked stuff since the site has been half-inactive for years and Assange completely distracted by his legal issues? Who would trust them with it? eg. Snowden didn't go to Wikileaks".
- JoachimSchipper 13y agoClearly, just use a standard solution (PGP). Don't do this with a weak passphrase, and use key-strengthening (bcrypt etc.) just in case. Assange is pretty good at crypto, so I'd expect Wikileaks to broadly get this right. Also, they already got in trouble for reusing a password (http://boingboing.net/2011/08/31/wikileaks-guardian-journalist-negligently-published-password-to-unredacted-cables.html http://boingboing.net/2011/08/31/wikileaks-guardian-journali...), so I'm pretty sure they won't do that again...
- raverbashing 13y agoNo, the key strengthening is probably built-in. Also, most likely it doesn't use a passphrase, but a big generated gpg key (with a passphrase protecting it, of course)
- JoachimSchipper 13y agoAt least for symmetric encryption, gpg defaults (defaulted?) to SHA-1'ing the passphrase 2^16 times, which is not a very large number - http://passwords12.at.ifi.uio.no/Jeremi_Gosney_Password_Cracking_HPC_Passwords12.pdf http://passwords12.at.ifi.uio.no/Jeremi_Gosney_Password_Crac... [pdf] talks of ~2^36 operations per second. This isn't the worst thing ever, but using GPG for passphrase-protected encryption is not as strong as you might expect - just use a slightly longer/better one. (Obviously, don't switch to another tool if you can't evaluate it in depth - GPG isn't perfect, but picking a random other tool won't be an improvement.)
- stefantalpalaru 13y ago> Assange is pretty good at crypto Not really. He gave a moron the password to a publicly distributed insurance file instead of making a new encrypted file just for him.
- JoachimSchipper 13y agoAre you aware of http://en.wikipedia.org/wiki/Rubberhose_(file_system) http://en.wikipedia.org/wiki/Rubberhose_(file_system)?