5 ms·

A lot of recent stories in various papers have made reference to the NSA not knowing exactly what was taken. I don't necessarily read that as lack of audit - mo

A lot of recent stories in various papers have made reference to the NSA not knowing exactly what was taken. I don't necessarily read that as lack of audit - more that Snowden was touching so much stuff that they have not yet managed to figure out the 1% or whatever of his accesses that resulted in the data set he shouldn't have. Or it may be that their audit system is no good (I've seen that claim), or that they actually do know what is taken. I imagine it's a combination: they know for sure some of the things that were taken, they don't know for sure what other stuff was taken, and the audit system is showing them some proportion of the take. I agree about the data+keys point, that seems a dim move. Arguable legality perhaps - here in the UK, if you can't decrypt something then you can still go to jail, but I guess at least you don't disclose. Is there straightforward software to use with one-time pads that ensures you use them correctly, though?

jacquesm 13y ago
> Is there straightforward software to use with one-time pads that ensures you use them correctly, though? XOR. The biggest problem with one time pads is that people don't use them just one time...
- ealexhudson 13y ago
  Sure, but that was my point. Is there some nice piece of software that will a. create and export a pad for you, b. import someone else's pad, c. allow you to [xor] encrypt/decrypt files in a standard format that someone else with the same software can encrypt/decrypt? I don't even know if the infrastructure exists. You'd need a file format to identify the pad (md5sum or similar) and offset to wrap the encrypted data, and then some useful mechanisms of annexing off the burned parts of the pad. If you have a network of people, you're going to need more pads, and if the pad is big enough so you don't run into "no more pad left" then that's potentially a lot of storage. TLDR: if a journo can't make easy use of gnupg, a OTP system is going to be well beyond their means.
- rst 13y ago
  The biggest problem with one time pads is that their distribution and management is a huge logistical hassle. Reuse is a consequence of that.

jacquesm 13y ago

> Is there straightforward software to use with one-time pads that ensures you use them correctly, though? XOR. The biggest problem with one time pads is that people don't use them just one time...

ealexhudson 13y ago
Sure, but that was my point. Is there some nice piece of software that will a. create and export a pad for you, b. import someone else's pad, c. allow you to [xor] encrypt/decrypt files in a standard format that someone else with the same software can encrypt/decrypt? I don't even know if the infrastructure exists. You'd need a file format to identify the pad (md5sum or similar) and offset to wrap the encrypted data, and then some useful mechanisms of annexing off the burned parts of the pad. If you have a network of people, you're going to need more pads, and if the pad is big enough so you don't run into "no more pad left" then that's potentially a lot of storage. TLDR: if a journo can't make easy use of gnupg, a OTP system is going to be well beyond their means.
rst 13y ago
The biggest problem with one time pads is that their distribution and management is a huge logistical hassle. Reuse is a consequence of that.