5 ms·
This is a procedural, not technical problem. It almost seems like the standardisation process open to everyone just enables everyone to insert their own backdoo
by rumcajz 13y ago
This is a procedural, not technical problem. It almost seems like the standardisation process open to everyone just enables everyone to insert their own backdoors into the standard.
One interesting way to solve the problem would be to allow differenct mutually hostile entities to define their own standards (US, Russia, China, FSF, Pirate Bay, whoever) and then encrypt using all of them.
That way, even if there is backdoor in each protocol, the only way to decrypt would be all those disparate players to cooperate. It would be like a vault with multiple keys possesed by different people.
- antocv 13y agoThats an interesting concept, I wonder if Russia and China have their own standards/protocols to use? I guess we could get the same effect by encrypting using 3DES, then AES, then blowfish, twofish and then RC4.
- conductor 13y agoOpenSSL supports these Russian GOST standards: * md_gost94 message digest algorithm * gost89 symmetric encryption algorithm with 256 bit key * gost94 public key algorithm with 1024 bit public key * gost94cp public key algorithm with 1024 bit public key (CP mode1) * gost2001 public key algorithm based on elliptic curves with 512 bit public key * gost2001cp public key algorithm based on elliptic curves with 512 bit public key (CP mode1)
- conductor 13y ago> I guess we could get the same effect by encrypting using 3DES, then AES, then blowfish, twofish and then RC4. TrueCrypt supports cascaded encryption in XTS mode, see [0]. AES-Twofish-Serpent, combined with a decent password and Whirlpool hash algorithm (it is used for HMAC and for mixing the RNG) should be pretty secure, IMO. Anyhow, we don't have plenty of really good and checked publicly available alternatives for symmetric encryption. [0] http://www.truecrypt.org/docs/cascades http://www.truecrypt.org/docs/cascades
- CWuestefeld 13y agoCounterintuitively, sequentially applying additional crypto doesn't necessarily improve security; in theory, it may actually damage it.
- bdamm 13y agoNone of this helps you if the random number generated that created your key is compromised.
- wahsd 13y agoEven if you use different random number generators?
- bdamm 13y agoI suppose you could, yes. If you wanted to make all this happen algorithmically you'd end up with a super-sized key that was a concatenation of all the keys you generated for each of the sub-algorithms, where the sub-algorithms would each consume their respective key chunks.
- gizmo686 13y agoYou don't have to concatenate your keys, simply XORing the random bitstreams together works fine (my intuition says that XORing them would provide a stronger result).
- deleted 13y ago[deleted]
- vincie 13y agoSounds ideal, until you realize that building and operating proper encryption is too hard for some of these organizations (PirateBay, FSF). For the rest, they are only mutually hostile on the surface. I am sure when it suits them they will get together and sell all our asses to each other.
- rumcajz 13y agoYou mean like Obama giving a tool to read his email to Putin? Unlikely IMO.
- vincie 13y agoMore generally, something along the lines of: "You give us Snowden/limit his asylum claims/etc etc, and we give you favourable trade terms".
- officemonkey 13y agoOr maybe we work out a deal over Syria. Seriously.
- devx 13y agoI think something like W3C would be better.
- rumcajz 13y agoW3C or IETF are open by their nature. Thus, there can be multiple backdoors inserted by multiple parties. So if you use multiple such standards to encrypr, it may happen that there's an entity that has backdoor in all of them. A standard from NSA, on the other hand, is guaranteed to have exactly one backdoor. Same goes for KGB etc.
- ape4 13y agoecho hello | crypt -usa | crypt -russia | crypt -china
- w_t_payne 13y agoTrue, but Russia, China and the US all have a shared interest in working (together?) against Islamic rebels/separatists/militants/terrorists, so they may well cooperate more than you might at first suspect. If you could get some Islamic militants to (develop?) contribute a cryptosystem, then you would be more convincing.
- annnnd 13y agoOne could argue that at least mass-surveilance would be much more difficult to pull off... But I am afraid that the governments would start cooperating (in 1984 style).
- rumcajz 13y agoIran should be able to do that.
- jafaku 13y agoOh god, not again with the "war on terror".
- pizza234 13y agoIt's arguable that their interest is to fight against "Islamic rebels/separatists/militants/terrorists". One might say that they instead have a political and economical agenda disguised as war against terror. If so, they would certainly have conflicts of interest, at least at some point.