3 ms·

> I have no problem with the NSA being able to break encryption, that's in fact part of their job. Their "breaking" of encryption is a combination of purposefu

by jonknee 13y ago

> I have no problem with the NSA being able to break encryption, that's in fact part of their job. Their "breaking" of encryption is a combination of purposefully introducing vulnerabilities into standards, surreptitiously altering software and hardware to give the NSA a backdoor, hacking into private systems and stealing keys, etc etc. I'm cool with an NSA super computer trying to brute force my VPN traffic to YouTube, I'm not cool with the NSA planting an engineer at a chip fab and changing designs to add a backdoor (a backdoor that could also be exploited by other actors).

XorNot 13y ago
I will bet good money that the NSA has never bothered to try and plant backdoors in encryption standards. If the NSA recommends AES to the US government, but knows there's a vulnerability, then they have to assume that any adversary may be as good as whoever designed it. Which means an adversary would be perfectly capable of discovering and exploiting the weakness. Which in turn means the NSA has just made the entire US government vulnerable to foreign or non-state actors. The same applies to anything you might imagine doing to chipmakers. Not only is there the risk of being found out (how do you explain to a talented engineer spotting a flaw in a schematic, how high up do you have to go to try and stop that leaking?) but there's the more serious risk that you've just added a backdoor to hardware you yourself need to be secure. Which again, could be discovered by an adversary and used against you. This whole line of argument has always been speculative fiction on the part of the internet: it's looking for unicorns because you heard hoofs.
- gaius 13y ago
  Which in turn means the NSA has just made the entire US government vulnerable to foreign or non-state actors. Yes, and it says this in the article. And it makes perfect sense too. If you were the NSA, wouldn't you want a heads up if someone was talking about budget cuts?
- jonknee 13y ago
  > I will bet good money that the NSA has never bothered to try and plant backdoors in encryption standards. Did you read the article? > By this year, the Sigint Enabling Project had found ways inside some of the encryption chips that scramble information for businesses and governments, either by working with chipmakers to insert back doors or by surreptitiously exploiting existing security flaws, according to the documents. Seems pretty cut and dry.
- alasdair_ 13y ago
  Did you even read the article? The leaked documents confirm that this is exactly what happened.
  - XorNot 13y ago
    "The leaked documents" is as much detail as the article goes into. Given the history of reporting on this matter and the walking back done on all the original leaks, color me skeptical its as dramatic as it sounds and not what I said: the NSA engages in a bunch of spycraft since encryption is based on trust, trust is easy to compromise, but again: I'll bet AES encryption has no easily exploitable weaknesses, and SSL is completely secure provided you don't need to use the root chain of trust associations which all ultimately wind up at "the government".
- cpncrunch 13y ago
  I was wondering about AES myself. When you look at the wikipedia entry for AES it says it was "approved" by the NSA, which doesn't exactly inspire me with confidence. I don't think they would approve something that they haven't already cracked or backdoored.

by jonknee 13y ago

XorNot 13y ago

I will bet good money that the NSA has never bothered to try and plant backdoors in encryption standards. If the NSA recommends AES to the US government, but knows there's a vulnerability, then they have to assume that any adversary may be as good as whoever designed it. Which means an adversary would be perfectly capable of discovering and exploiting the weakness. Which in turn means the NSA has just made the entire US government vulnerable to foreign or non-state actors. The same applies to anything you might imagine doing to chipmakers. Not only is there the risk of being found out (how do you explain to a talented engineer spotting a flaw in a schematic, how high up do you have to go to try and stop that leaking?) but there's the more serious risk that you've just added a backdoor to hardware you yourself need to be secure. Which again, could be discovered by an adversary and used against you. This whole line of argument has always been speculative fiction on the part of the internet: it's looking for unicorns because you heard hoofs.

gaius 13y ago
Which in turn means the NSA has just made the entire US government vulnerable to foreign or non-state actors. Yes, and it says this in the article. And it makes perfect sense too. If you were the NSA, wouldn't you want a heads up if someone was talking about budget cuts?
jonknee 13y ago
> I will bet good money that the NSA has never bothered to try and plant backdoors in encryption standards. Did you read the article? > By this year, the Sigint Enabling Project had found ways inside some of the encryption chips that scramble information for businesses and governments, either by working with chipmakers to insert back doors or by surreptitiously exploiting existing security flaws, according to the documents. Seems pretty cut and dry.
alasdair_ 13y ago
Did you even read the article? The leaked documents confirm that this is exactly what happened.
- XorNot 13y ago
  "The leaked documents" is as much detail as the article goes into. Given the history of reporting on this matter and the walking back done on all the original leaks, color me skeptical its as dramatic as it sounds and not what I said: the NSA engages in a bunch of spycraft since encryption is based on trust, trust is easy to compromise, but again: I'll bet AES encryption has no easily exploitable weaknesses, and SSL is completely secure provided you don't need to use the root chain of trust associations which all ultimately wind up at "the government".
cpncrunch 13y ago
I was wondering about AES myself. When you look at the wikipedia entry for AES it says it was "approved" by the NSA, which doesn't exactly inspire me with confidence. I don't think they would approve something that they haven't already cracked or backdoored.