9 ms·
Spooks break most Internet crypto, but how?
- Sonicmouse 13y ago"Unless the feds know of a flaw in the Diffie-Hellman key exchange process at the heart of this scheme..." The only flaw in the DHM algorithm is that it depends on a RNG. It goes back to the fact that if the NSA has infiltrated the RNG, then DHM key exchange is merely a slight nuisance. I wrote some software that patched out MS' CryptGenRandom() to only return 0x01's all day. I was easily able to then implement a MITM attack on Adobe RTMPE traffic all day long. I'm stupid... Imagine what an NSA engineer could accomplish.
- norswap 13y agoYou're probably less stupid than you give yourself the credit for. But yes, NSA could do this. Still, this is not practical for dragnet surveillance. I highly suspect "breaking most of the cryptography on the internet" is an over statement and that most of what they can break derive from people using weak cryptographic algorithms and/or making mistakes in the usage of cryptographic primitives.
- 0x0 13y agoWonder how well Wine implements that, actually.
- lukifer 13y agoWhat's the practical alternative, assuming a compromised RNG? random.org?
- croikle 13y agoNo. You cannot outsource your random number generation unless you have an ultimately trusted third party. The important thing is that nobody knows your random numbers. After all, random.org could be malicious or compromised, too.
- e12e 13y agoIf I were the NSA, I'd definitively try to run a service (or two) like random.org. It'll probably be cheaper than my tor exit nodes, and mixmaster remailers...
- gojomo 13y agoI suppose if you had one RNG that's 0wned by the NSA, and another that's 0wned by the Chinese MSS, and another by the Russian FSB... and you assume they never ever work together or crack each others' systems, you could XOR their results together.
- sliverstorm 13y agoSee, this is the kind of security thinking I can get behind. The kind of realist thinking that says "Ok, we should just assume we've been compromised by every major government entity. Now what."
- codelust 13y agoStrangely, that is what my thoughts on snooping at this level has been for a while. Using a combination of compromising people and infra, it is easy to break pretty much anything if, as a state, you put your mind to it. Unfortunately, the debate is mostly centered around if crypto is broken, while the question to ponder is why is the state suddenly forcing well-meaning people to start thinking like people who have something to hide.
- SilasX 13y agoNope. Random.org could be compromised. XORing it with your /dev/random, plus a locally-generated randomness source would work though.
- Aloisius 13y agoA camera and a lava lamp?
- Quequau 13y agoMy current best guess: A Hardware True Random Number Generator installed on one server combined with entropy broker to commingle all the entropy pools of the devices on my internal network into the entropy pool of that server and then serve that pool back to all devices acting as an entropy server. My intent is that if there is a deliberate weakening of certain entropy sources, that my pool is sufficiently different to at least complicate attacks which are guided by information like browser signatures. Maybe it's not a perfectly secure solution but hopefully my network isn't among the lowest hanging fruit.
- rorrr2 13y ago> It goes back to the fact that if the NSA has infiltrated the RNG NSA has NOT infiltrated the RNG. They did one particular hardware implementation of it. You don't have to use it.
- acqq 13y ago> They did one particular hardware implementation of it. Citation?
- eksith 13y agoAs in most of these technological failures, the problem may just be between the keyboard and chair. I never cease to be amazed at the seemingly insurmountable odds people defeat to ensure something breaks somewhere in the least predictable way possible. In such an atmosphere, deliberate sabotage or sci-fi caliber cracking hardware are the least of your worries.
- ordinary 13y agoAs in most of these technological failures, the problem may just be between the keyboard and chair. What slightly complicated matters is that it is not certain who's occupying said chair: a user or a developer.
- makomk 13y agoThe trouble is, well-done deliberate sabotage is very hard to distinguish from incompetence. (It appears there is definitely deliberate sabotage out there - see for instance http://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html http://www.mail-archive.com/cryptography@metzdowd.com/msg123... which sadly didn't make the front page here.)
- harrytuttle 13y agoThat should be on the front page. Thanks for linking.
- salgernon 13y agoJohn Gilmore has been involved in this space, and fighting for "us" for a long time. I'd previously submitted this, but it failed to get traction: http://www.toad.com/des-stanford-meeting.html http://www.toad.com/des-stanford-meeting.html
- MichaelGG 13y agoExcellent link, thanks. And it is very hard to distinguish. Many other IETF RFCs are incredibly complicated and add idiotic "features" and stuff just for the sake of it. Mitigating factor in this particular case is that some of the things proposed, like using the same IV for each packet, would definitely be found out by people other than the NSA. That would go against the NSA's goals.
- tensor 13y agoHas it been verified that they can break most internet crypto? Or is it just a claim?
- harrytuttle 13y agoNo it's a claim. A claim that needs to be formally disproven based on recent events. The assumption was originally that systems were secure until disproven. Now they are insecure until proven otherwise. The latter statement in the previous sentence is possibly impossible, ergo we're fucked.
- MichaelGG 13y agoIt's a bit of hyperbole, and nothing direct from Snowden as far as I can tell. The actual releases (like XKEYSCORE) clearly show it intercepting unencrypted traffic. This could be something as simple as RSA1024 being "easily" crackable by the NSA, and hence "most encryption" would be vulnerable since so many people use RSA1024 for TLS. Taking random quotes and highlights from presentations isn't a very good way to get picture of an opponent's capabilities. Otherwise we'd think that Oracle has developed 100% secure database software that is impossible to break. I really hope Snowden releases some hard evidence or specific citations of what the NSA has broken, instead of the hand-wavy "like, everything, man" articles that have been rehashed several times in the past day. Speculation's sorta pointless.
- nly 13y ago> I really hope Snowden releases some hard evidence or specific citations of what the NSA has broken That's fairly unlikely. The Guardian articles say he never had access to such information, nor was it amongst the documents he liberated.
- CoryG89 13y agoI'm not sure it was ever the case that the original assumption was that systems are secure until disproven. The claim is more than likely alluding to a combination of techniques for breaking weak crypto (ie. sufficiently small keysize for brute force attack), or attacking the endpoints (backdoors, etc). This still doesn't seem like news to me, but hey, what do I know?
- croikle 13y agoChrome's pinning is a definite upgrade, but it's more vulnerable than some people make it seem. In practice, a pin consists of a list of CA certificates which are allowed to sign for the given domain (the list is in [1]). This list can be surprisingly long: for example, the list for twitter.com contains 22 keys from 3 different CAs. This means that, e.g., if you are "good friends" with Verisign, you can get them to issue a certificate for any Google property, and Chrome will happily accept it. [1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...
- rdl 13y agoI thought Chrome did both HSTS preload (CA pinning) and real public key pinning. I trust key pinning a lot more.
- dpifke 13y agoMy personal theory: NSA has gotten in bed with the Hardware Security Module (HSM) vendors. There's essentially only two of them: SafeNet and Thales. SafeNet has bought up all the smaller players. All of the big guys use HSMs to protect key material from intruders or malicious insiders. Key generation happens inside a sealed box from which the keys can never leave, except into another identically-configured sealed box from the same vendor. As such, there's no way to inspect the keys being generated - you have to trust the FIPS certification that it's being done correctly. If--perhaps as part of the FIPS certification process--the NSA were to compromise the key generation function of a handful of popular HSM models, in one fell swoop they would have compromised all of the CAs, DNSSEC, Google, Microsoft, Facebook, Amazon, etc. (Not to mention all of the banks, credit card companies, etc.) Further data point: in my experience talking to SafeNet at least, they employ a lot of ex-DoD folks who probably still have connections to their old bosses. This is just speculation, but seems a likely attack vector.
- ballard 13y agoMight be the tip of the iceberg. Without open source hardware and independent verification, the full supply chain of every shiny new widget is a question mark because of whichever governments/actors may happen to lean on suppliers. I think we need more decap teardowns and open source EDA functional disassembly tools. Otherwise, it's blind trust without enough tinfoil verification.
- frozenport 13y agoOpenSource is good but also false security, because there is no guarantee that the box is actually running the software, the real answer is diversification and distribution .
- samstave 13y agoPlus, when you have an NSA asset in the place of "heda of security" at facebook... why would you think he were not doing things at facebook that made FB "compliant" with the way NSA wants them to be. I.E.: adopting the "known good" security appliances/policies/companies...
- AndrewKemendo 13y agoAs usual, Randall Munroe was basically correct in identifying the best way to get into closed systems: http://xkcd.com/538/ http://xkcd.com/538/ Find the weak points in a system, which are more often than not, the pink fleshy things using them.
- BearOfNH 13y agoWhat's wrong with public-key encryption a la PGP? Assuming your keys use A LOT of bits I don't think a brute force attack will succeed in any reasonable time. You should be able to trust a public key if it has been signed by several trustworthy people. (I'm sure crypto fans could come up with a list of "trustworthy key signers".) PGP (and GPG) is open software. It's all pretty simple compared to the algorithms developed just for crypto. Isn't (open, simple, tough-to-crack) the sort of thing you want?