4 ms·

I think there is a fundamental difference advanced Cryptanalysis (which we always assumed they had due to hiring practices and history) and being able to break

by gknoy 13y ago

I think there is a fundamental difference advanced Cryptanalysis (which we always assumed they had due to hiring practices and history) and being able to break crypto by subverting infrastructure. If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) However, this is different. Winning the cryptanalyis game because they backdoored protocols, gained access to trusted entities' private keys, etc, just means that they are really good at the SPYING game, not at the cryptanalysis game, and somehow that just feels worse.

TelmoMenezes 13y ago
I would be keeping my hat on. They would have done it with the taxpayers' money but without their consent or even knowledge. They would then be withholding a major scientific breakthrough from the public that financed it. A scientific breakthrough that might have all sorts of applications that could make our lives better. They would be exposing all the people that rely in strong cryptography to major risks. Including people that have done nothing illegal and helped fund their research. And more importantly, they shouldn't be reading our emails to being with, independently of them being encrypted or not. That was never the deal, no democratic process ever gave them the right.
- chakalakasp 13y ago
  Paying some 22 year old deskjockey a couple mil to code a backdoor into an encryption app isn't a scientific breakthrough, it's just traditional spycraft. Using the weight of the US government to force Microsoft to code a backdoor into Bitlocker isn't a scientific breakthrough, it's the sort of things governments do.
mpyne 13y ago
> If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) I disagree. Certainly they'll be doing that too, but breaking crypto is hazardous to the populace independently of how it's broken, right? Either way from NSA's perspective they are fighting a war, with terrorism, with other nation's crypto efforts, etc. In that context there are very few "unfair" ways to fight. And indeed, the U.S. has done something like this to a certain Soviet pipeline, as I recall. Besides, this at least leaves open the possibility of like-minded people to maintain countermeasures. If crypto is broken in general then we're all naked. If weak implementations are weak then we would need to be fixing those anyways. I just wish I knew which one it is we're looking at.
- nathan_long 13y ago
  >> breaking crypto is hazardous to the populace independently of how it's broken, right? Breaking crypto from the outside proves that it's breakable; if the NSA can do it, it's just a matter of time until others do. Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere. Quite different.
  - mpyne 13y ago
    > Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere Well, that does depend on how they weaken it. If it gets weakened such that it goes from "impossible" to "nation-states can crack" then there's still only 3-4 agencies in the whole world that could decrypt. But that would also tend to preclude passive wideranging cryptanalysis, which is what I'm sure NSA would prefer to be able to do.
    - nathan_long 13y ago
      > If it gets weakened such that it goes from "impossible" to "nation-states can crack" then there's still only 3-4 agencies in the whole world that could decrypt. You'd have to be talking about a gigantic change for it to benefit them. I want my crypto to take 10 billion years to crack; intelligence agencies want to crack it in a week. And what they can crack in a week today, hobbyists will be able to crack in a day a few years from now. Weakening crypto means opening it to every criminal in the world. Computers get faster and secret backdoors get leaked. If it isn't safe from everyone, in the long run, it isn't safe from anyone.
dllthomas 13y ago
A big part of the difference is that cryptanalysis weakens us against the NSA; sabotage weakens us against everyone.
deegles 13y ago
Aren't they doing both?
anigbrowl 13y ago
But speaking as a non-American here, what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies. All this hand-wringing is a bit like people expressing horror over the discovery that the CIA sometimes stoops to burglary or deception. I mean, in an ideal world the only way to compromise my password would be to for a beautiful lady spy to seduce me and trick me into revealing it in a moment of passion, but in the meantime it's a safer bet that they'll just try and fish it out of my modem/router/ISP/etc. Note to NSA: I'm actually happily married, so please don't send over any beautiful lady spies, which would be totally awkward.
- wglb 13y ago
  And I would imagine that your password is complex enough that it would be hard to recite in a moment of passion. That being a rather single-thread activity.
  - anigbrowl 13y ago
    Don't underestimate my multi-tasking ability.
- JabavuAdams 13y ago
  I think there's some cognitive dissonance at work here in the hacker community. It's easier to look up to the NSA et. al. if they're just better at math than you. It's so clean, so pure, if you ignore the black-bag jobs and kinetic side of their work.
  - XorNot 13y ago
    Obligatory xkcd: http://xkcd.com/538/ http://xkcd.com/538/
- nathan_long 13y ago
  >> what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies. The NSA, as a government agency, is in the business of serving the US citizens who pay its salaries and acting in their interests. Ultimately its performance is measured by us. My boss would fire me if I put a backdoor in his email.

by gknoy 13y ago

TelmoMenezes 13y ago

I would be keeping my hat on. They would have done it with the taxpayers' money but without their consent or even knowledge. They would then be withholding a major scientific breakthrough from the public that financed it. A scientific breakthrough that might have all sorts of applications that could make our lives better. They would be exposing all the people that rely in strong cryptography to major risks. Including people that have done nothing illegal and helped fund their research. And more importantly, they shouldn't be reading our emails to being with, independently of them being encrypted or not. That was never the deal, no democratic process ever gave them the right.

chakalakasp 13y ago
Paying some 22 year old deskjockey a couple mil to code a backdoor into an encryption app isn't a scientific breakthrough, it's just traditional spycraft. Using the weight of the US government to force Microsoft to code a backdoor into Bitlocker isn't a scientific breakthrough, it's the sort of things governments do.

mpyne 13y ago

> If the NSA said, "Our super smart brain trust figured out how to own your stuff with math five years ago ... ha ha!", I think we would be Totally Fine with that. Hats off to them for winning that game, but at least they played mostly fairly. (In theory.) I disagree. Certainly they'll be doing that too, but breaking crypto is hazardous to the populace independently of how it's broken, right? Either way from NSA's perspective they are fighting a war, with terrorism, with other nation's crypto efforts, etc. In that context there are very few "unfair" ways to fight. And indeed, the U.S. has done something like this to a certain Soviet pipeline, as I recall. Besides, this at least leaves open the possibility of like-minded people to maintain countermeasures. If crypto is broken in general then we're all naked. If weak implementations are weak then we would need to be fixing those anyways. I just wish I knew which one it is we're looking at.

nathan_long 13y ago
>> breaking crypto is hazardous to the populace independently of how it's broken, right? Breaking crypto from the outside proves that it's breakable; if the NSA can do it, it's just a matter of time until others do. Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere. Quite different.
- mpyne 13y ago
  > Undermining cryto from the inside means deliberately exposing all communicates to increased risk of hacking by anyone, anywhere Well, that does depend on how they weaken it. If it gets weakened such that it goes from "impossible" to "nation-states can crack" then there's still only 3-4 agencies in the whole world that could decrypt. But that would also tend to preclude passive wideranging cryptanalysis, which is what I'm sure NSA would prefer to be able to do.
  - nathan_long 13y ago
    > If it gets weakened such that it goes from "impossible" to "nation-states can crack" then there's still only 3-4 agencies in the whole world that could decrypt. You'd have to be talking about a gigantic change for it to benefit them. I want my crypto to take 10 billion years to crack; intelligence agencies want to crack it in a week. And what they can crack in a week today, hobbyists will be able to crack in a day a few years from now. Weakening crypto means opening it to every criminal in the world. Computers get faster and secret backdoors get leaked. If it isn't safe from everyone, in the long run, it isn't safe from anyone.

dllthomas 13y ago

A big part of the difference is that cryptanalysis weakens us against the NSA; sabotage weakens us against everyone.

deegles 13y ago

Aren't they doing both?

anigbrowl 13y ago

But speaking as a non-American here, what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies. All this hand-wringing is a bit like people expressing horror over the discovery that the CIA sometimes stoops to burglary or deception. I mean, in an ideal world the only way to compromise my password would be to for a beautiful lady spy to seduce me and trick me into revealing it in a moment of passion, but in the meantime it's a safer bet that they'll just try and fish it out of my modem/router/ISP/etc. Note to NSA: I'm actually happily married, so please don't send over any beautiful lady spies, which would be totally awkward.

wglb 13y ago
And I would imagine that your password is complex enough that it would be hard to recite in a moment of passion. That being a rather single-thread activity.
- anigbrowl 13y ago
  Don't underestimate my multi-tasking ability.
JabavuAdams 13y ago
I think there's some cognitive dissonance at work here in the hacker community. It's easier to look up to the NSA et. al. if they're just better at math than you. It's so clean, so pure, if you ignore the black-bag jobs and kinetic side of their work.
- XorNot 13y ago
  Obligatory xkcd: http://xkcd.com/538/ http://xkcd.com/538/
nathan_long 13y ago
>> what do you expect? The NSA is in the spying business, and ultimately its performance is measured by results, not methodologies. The NSA, as a government agency, is in the business of serving the US citizens who pay its salaries and acting in their interests. Ultimately its performance is measured by us. My boss would fire me if I put a backdoor in his email.