15 ms·

Inside the NSA's War on Internet Security

595 points by FabianBeiner 12y ago

revelation 12y ago
I mostly read this thinking "good news". No, seriously, the documents suggest that the NSA hasn't made fundamentally important advances in decryption or uncovered significant weaknesses that academia doesn't know about. Now, that's not too much of a reassurance, because what academia (and the NSA) know is that HTTPS is in pretty terrible state, end-point security remains a significant problem, IPSec is a terrible protocl and so on. It does raise the question what all the mathematicians are doing at NSA, and why they don't seem to have come up with any meaningful results. Suggests they are a waste of money, but then that's all of the NSA. I suggest all of you check the original material (powerpoints w/ screenshots). A lot of people here suffer from the action movie mentality where they think the NSA is not like any other government agency, i.e. inefficient, behind the times, filled with horrible middle managers, deadweight, .. you get the idea. Things like the enterprise Java web interface, the CSV mass data export and "genericIPSec_wrapper.pl" can quickly dispel that myth.
- EthanHeilman 12y ago
  Or at the very least they have compartmentalized serious mathematical cryptanalytic capabilities. For instance: * We know that the NSA has a novel md5 collision capability since they have used it in their malware. None of the Snowden docs, that I have seen, have talked about this. * It is likely based on public research that the NSA can break 1024-bit RSA, but this has not showed up in the documents either. My personal belief is that we are missing compartments dealing with cryptanalysis because Snowden did not have access to them. His work and access were focused on Computer Network Operations and not cryptanalysis.
  - dogma1138 12y ago
    I would not see any news organizations publishing any leaked document relating to actual technical capabilities. I don't even think that Snowden shared them with the reporters, the only ones who probably seen the besides Snowden are the FSB officers who "debriefed" him once he arrived in Russia. That's actually the thing that worries me the most about this incident, Snowden him self said that he kept the truely "nasty" stuff safe to be released in case something happens to him. But while he might not shared this with the press anyone who thinks he didn't had to buy his freedom in Russia with the full uncensored documents is fooling him self. This means that if he had any operational documents Russia and it's allies (N. Korea, Iran, China) just got a free upgrade to their own computer and communication intelligence apparatus. While people might not like their privacy being violated for the most part the NSA uses it's capabilities against unquestionably bad people, while in places like Russia and Iran it will be used against anything from reporters to political activists with much more severe consequences.
    - deleted 12y ago
      [deleted]
  - yuhong 12y ago
    It is likely based on public research that the NSA can break 1024-bit RSA, but this has not showed up in the documents either. It would be expensive though. This is one reason why I consider 1024-bit end entity certificates much less of a threat than 1024-bit CA roots.
    - skuhn 12y ago
      I don't totally agree. I think that factoring in the risk of exposure leaves a CA root with a worse price / performance ratio versus an individual cert. While you could use a faux CA root to sign faux certs for any site you want (ideally ones who are customers of that CA), in practice your use is severely limited. If faux certs are spotted and no one knows where they came from, suspicions are going to be raised. Not only is your faux CA root compromised, but now you may have tipped your hand regarding your capabilities. To limit that possibility, your attacks would have to be extremely targeted. The more often a fake cert is used and the more people exposed to it, the higher the likelihood that someone will notice what is going on. It also doesn't help you decrypt the real traffic to the site, or historical traffic, which busting the site's actual SSL key can yield. This presumes that you have a way of intercepting said traffic, but I think it's pretty clear that that is not out of the question (public wifi / ISP cooperation / fiber optic taps / malware). It's more work to bust individual certs, but you're leaving a smaller trail and you aren't sending out examples of your RSA cracking capabilities to your opponents over the public Internet. Lowering the risk of exposure will let an attacker use the same methods over a much longer period of time, which I think is the goal here. As to how to combat this: there is a lot of low hanging fruit. Besides the obvious, I would love to see much shorter expiration times for certs become the norm (as in weeks, if not days). For this to realistically happen in a widespread fashion, at minimum CAs need to embrace the concept from a pricing perspective.
      - yuhong 12y ago
        Yea, if one was signed for www.google.com it would be a serious problem. If it is targeting specific obscure domain names where the customer is willing to accept the risk, that is a different matter.
    - 12y ago
  - tptacek 12y ago
    It's plausible based on public research that any well-funded adversary can break 1024-bit RSA. You should assume 1024-bit RSA is simply broken.
    - EthanHeilman 12y ago
      Yes and given that I'm kinda surprised we haven't seen any docs talking about breaking 1024-bit RSA. That should have been their bread and butter, at least as far as DNI is concerned, a few years ago.
      - tptacek 12y ago
        What 'yuhong said: it could be expensive, with NSA having the capability to break only one every couple months. They might need to carefully coordinate which keys they break, in which case it would be an important secret which CA keys were broken.
        xnull2guest 12y ago
        Do you think that the NSA would bother breaking CA keys? We know that they have shadow certificates and have much success infiltrating CAs to steal their keys and that they have been able to forge them without having to break the keys (via the previously unknown MD5 collision - as they did for Stuxnet. Seems to me like there are more valuable certs to go after (diplomats' certs, smartcard certs, OS update certs, ...).
        spacefight 12y ago
        So many "diplomats' certs" are used in machines by Crypto AG from Switzerland. And guess what, they had one major incident years ago - and even people working there have simply no clue who owns and control the company. I'd say most of commercial crypto systems are rigged. https://pbs.twimg.com/media/B5-aW_8CEAAUzji.jpg:large https://pbs.twimg.com/media/B5-aW_8CEAAUzji.jpg:large
        12y ago
  - xnull2guest 12y ago
    Appelbaum also mentioned they have advanced crypt-analytic capabilities against AES, but the evidence right now supports that these advances are not enough to break AES in the general case.
    - MichaelMoser123 12y ago
      might be of interest in light of possible AES breakage: i have a small project that encrypts/decrypts the whole message with RSA (of course the message is also signed before encryption and result is verified on decryption); runs on as much cores as available; also for this it goes into some length to avoid multithreading locks in openssl (where possible). http://mosermichael.github.io/cstuff/all/projects/2014/02/24/openssl.html http://mosermichael.github.io/cstuff/all/projects/2014/02/24...
  - erglkjahlkh 12y ago
    It is about economics. The attacks on crypto systems have complexities, and still at the end of the day they require things like raw calculation power. Could they break even single 16384-bit RSA key pair? Probably yes, but they wouldn't be doing anything else on that year. It would be simply way too uneconomical. Presented by Spiegel are internal services that are designed on purpose to be more economical. They exploit more bad implementations. It doesn't really matter as long as the dirty tricks get the work done. Also, NSA seems to troll for targets from the vicinity of their targets of interest. It is again more economical, and can be just as revealing. The risk there is that the broken target has nothing of use. The real movie style "let's break the encryption keys" stuff is done for sure targets when they get the extremely rare high value target on platter.
    - ryan-c 12y ago
      > Could they break even single 16384-bit RSA key pair? Probably yes There is no known algorithm that can break a properly generated RSA key of that size - the work required with GNFS is equivalent to brute forcing a symmetric key of something like 280 bits. Anything that could do that should be able to break even 4096 bit RSA keys (~144 bit security) pretty much instantaneously, and their problems with PGP pretty heavily imply they cannot do that.
  - AlyssaRowan 12y ago
    That, at least, is the case. Specific operational cryptanalytic capabilities are indeed in separate compartments: PICARESQUE, PIEDMONT; focus on PAWLEYS for backdoors in, say, routers. GCHQ use STRAP3 protection measures for their CRYPTO compartments in CESG. As a sysadmin, Snowden basically had root, and probably had access to pretty much everything that wasn't thoroughly airgapped. However, very few computing resources would have been cleared for that Exceptionally Compartmented Information. The documents he gathered were focused more on activities like mass surveillance and standard undermining, that he sought to blow the whistle on, rather than their targeted cryptanalytic capabilities in general. 640-bit RSA could be broken essentially in real-time by the computing resources available to GCHQ a couple years ago. Of course, they don't actually have to work in real-time, so I suspect that 1024-bit RSA is entirely within their capabilities currently, given that. Diffie-Hellman is slightly harder, but if they're prepared to throw some in the bin or lag behind, they can probably do it, but that's just guesswork.
- onewaystreet 12y ago
  It doesn't matter how many mathematicians they have, they can't break good encryption. Unless the NSA has a super secret quantum computer that even Snowden didn't know about...
  - dogma1138 12y ago
    Well until 2 Israeli guys "rediscovered" differential cryptanalysis against DES in the late 80's no one knew about it either, no one with the exception of the NSA and the DES working group at IBM that is, even tho to them that weakness was known for almost 2 decades. Additionally something like an effective attack against AES, RSA, or any other major encryption standard will probably be so compartmentalized that it won't even have a code word. But on the other hand S31176 refers to a program which provides cryptanalysis against VPN (IPSEC, SSL and more) and it claims that they can decrypt (some of) the traffic. http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35515.pdf
- colordrops 12y ago
  Here is yet another example of an unprovoked comment pushed to the top of a forum promoting the idea that three letter agencies like the NSA are incompetent and no better than the public sector at what they do, and that we don't need to worry about them. Go back to bed America, everything is OK. Just like the rest of the government, the NSA is not a monolithic entity with no separation of concerns. There are people who clean the floor and people who are at the extreme cutting edge of research. Don't let anyone convince you otherwise.
  - revelation 12y ago
    Of course we need to worry about them? Even by what acamedia knows, it's pretty bad right now for security and encryption in practice. The belief that the NSA is at the extreme cutting edge and just so far ahead is exactly what stops us from making iterative, simple improvements on the technology we use. It's plain unhelpful, and as the data suggests, probably wrong. (The separation of concerns part is hilarious. Remember, this is the same agency where Snowden managed to wget -r their wiki and various other databases and then go on an extended vacation unnoticed.)
    - xorcist 12y ago
      The only data we have points to that the NSA is ahead of the academic community, from differential cryptanalysis onwards.
- spacefight 12y ago
  Also, most docs are from 2012. Who knows what happened since then. There is a reason, they have an army of mathematicians at hand. I look forward to the day when they walk away from their jobs.
- higherpurpose 12y ago
  SSL was sort of expected. There are tons of bad SSL implementations out there using ciphers with RC4 and SHA1, but I don't think virtually all VPNs being bypassed and decrypted is "good news".
- kchoudhu 12y ago
  Yeah -- a competent organization would have rewritten genericIPSec_wrapper.pl to genericIPsec_wrapper.rb ages ago!
deleted 12y ago
[deleted]
0x006A 12y ago
There was also just a talk about this at 31C3. Recording is still running, you have to seek back to the beginning: http://streaming.media.ccc.de/relive/6258/ http://streaming.media.ccc.de/relive/6258/
diafygi 12y ago
THESE DOCUMENTS CONTAIN EVIDENCE OF ATTACKS ON VPN, SSL, TLS, SSH, TOR. What do we do now? No seriously, what do we do? The full list of documents: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... The accompanying lecture: http://streaming.media.ccc.de/relive/6258/ http://streaming.media.ccc.de/relive/6258/ Also, obligatory: https://eff.org/donate https://eff.org/donate
- aurelius 12y ago
  Stop doing illegal things, and then be glad that NSA are working hard to catch the real bad guys?
  - akiselev 12y ago
    You mean cease all opposition to those in power, forget about the security of our information systems, and be glad that the NSA is working hard to catch the real dissidents? Silly me, should have stayed in Russia.
    - pasta_2 12y ago
      Is there any evidence that the NSA has targeted dissidents?
      - nsmartt 12y ago
        Some will say that it’s necessary to balance privacy against security, and that it’s important to find the right compromise between the two. Even if you believe that, a good negotiator doesn’t begin a conversation with someone whose position is at the exact opposite extreme by leading with concessions. And that’s exactly what we’re dealing with. Not a balance of forces which are looking for the perfect compromise between security and privacy, but an enormous steam roller built out of careers and billions in revenue from surveillance contracts and technology. To negotiate with that, we can’t lead with concessions, but rather with all the opposition we can muster. http://thoughtcrime.org/blog/we-should-all-have-something-to-hide/ http://thoughtcrime.org/blog/we-should-all-have-something-to...
pointernil 12y ago
In the age of information this is how an overpowered super power gets "nerfed": By "targeting" its information gathering capabilities by providing information about its activities. Information is power.
- pointernil 12y ago
  Anyone care to explain why the downvotes? I still think all this revelations will lead to a more balanced state of affairs.
dmix 12y ago
This would be a good time to wait and let security professionals analyze the documents and take what you read in this article lightly, as I've found a number of sensationalist examples. For example, they claim Canada is monitoring hockey sites: > Canada's Communications Security Establishment (CSEC) even monitors sites devoted to the country's national pastime: "We have noticed a large increase in chat activity on the hockeytalk sites. This is likely due to the beginning of playoff season," it says in one presentation. But if you look at the actual slide https://i.imgur.com/2GO8H6L.png https://i.imgur.com/2GO8H6L.png, it is clearly a fake sample report of what a real one might look like. It even uses the name 'Canukistan' as the country name. There are 44 slide decks, one of the biggest leaks so far. It will take time to make sense of the noise. And any misinformation from reporting by non-technical journalists doesn't help the cause.
- nsansansa 12y ago
  > reporting by non-technical journalists doesn't help the cause non-technical journalists Ever heard of a certain Jacob Appelbaum?
  - acqq 12y ago
    That guy you mention in spite of his very technical background also avoided the technical details and possibly also tried to sensationalize: I was worried as he claimed that the SSH is broken, but it seems that there is no document that states that for the passive capture of the SSH traffic (at least the documents are there and everybody can analyse them). However we already knew for a while that the active attacks are being done: http://www.theguardian.com/technology/2014/dec/07/north-korea-sony-pictures-regin-gchq-nsa-snowden-belgacom http://www.theguardian.com/technology/2014/dec/07/north-kore... The active attack can of course obtain enough information to decrypt the traffic automatically afterwards or even record it unencrypted. It appears that's the context of the SSH decryption in the documents.
    - spacefight 12y ago
      When will you guys all wake up? GCHQ does the full take on the cables, and there is no document yet, that claims NSA doesn't. So, all your sessions are hosed at some point in time. Either now or in the future. And yes, sensationalize is sometimes necessary to get more folks onboard to work with the documents.
driverdan 12y ago
Has anyone found which docs say how they attack SSH? The intro slides don't go into any detail. It could just be known SSH-1 vulnerabilities. My overall impression is that this doesn't reveal any new attacks. They are most likely using known vulnerabilities. For example, they decrypt PSK IPSec by exploiting routers and getting the keys, not breaking the encryption.
- ProfOak_ 12y ago
  In the talk they say that the papers only suggest that it can be broken into.
dicroce 12y ago
Domestic spying + Immunity from insider trading laws... It's a good time to be in the government.
- xnull2guest 12y ago
  You got downvoted. I think people have forgotten "Team Themis", HBGary and JPMorgan Chase.
- bostik 12y ago
  To give some credence to your comment about insider trading immunity, I performed a quick search. (My guess is that you got downvoted for not providing any evidence to support your, arguably acerbic and snarky, comment.) http://www.forbes.com/sites/kylesmith/2011/06/01/insider-trading-rules-that-dont-apply-to-congress/ http://www.forbes.com/sites/kylesmith/2011/06/01/insider-tra... The money quote: "There is no limit to how much money you can earn on insider trading in the House or Senate. Lawmakers and their staffers are specifically exempted." While I would consider it unlikely that NSA feeds senators with free stock market tips, the members of the oversight committee are sure to have an extensive advance view to foreign (and domestic) market-changing intelligence. There has been systematic resistance to reforms - the members probably consider making a quick and safe half-million on the stock market a necessary perk of the job.
deleted 12y ago
[deleted]
- yuhong 12y ago
  Older versions of the Adobe Reader plug-in often hangs for example while the PDF is downloading.
scrapcode 12y ago
Even though we know that the NSA does collect data on Americans, let's assume that they didn't. By using a network such as a VPN or a Tor Node that is located outside of the United States, would they "legally" be able to use the data collected on you received from those networks as if you weren't an US Citizen?
- CamperBob2 12y ago
  No, but that's where the Five Eyes concept comes into play, previously known as ECHELON. The idea is that agencies such as CIA and NSA can work around the limitations imposed by their own charters by cooperating with foreign agencies who have no such prohibitions. Then, the doctrine of parallel construction takes care of any remaining legal hangups.
nsansansa 12y ago
The comments that try to reassure the reader seem to have become more frequent. Scary.
nullc 12y ago
The fact that they broke some but not all the OTR messages in the log suggests to me that their attack is not a MITM, but instead a compromise of the 1024 bit DH or CTR mode AES.
- tptacek 12y ago
  Do you really think NSA has compromised AES-CTR? That would have to be a pretty fundamental attack, wouldn't it?
  - tedunangst 12y ago
    I have little doubt they have compromised some system that reuses keys or nonces (or fails to increment the counter :)). If I were making a powerpoint to brag to my bosses, I would definitely put that on a slide.
  - nullc 12y ago
    I am not trying to draw any conclusions. Just exploring what the data seems to support. Another alternative (mentioned on otr-dev) is an implementation which uses a low quality rng feeding the ECDH might result in some messages being recoverable and others not. An attack on CTR would indeed be pretty fundamental. Though some of the other documents appeared to support some level of cryptanalysis capability against some implementations of at least some symmetric ciphers.
    - tptacek 12y ago
      Can you think through a scenario in which CTR could be broken? CTR, in particular. What's a hypothetical here?
      - nullc 12y ago
        Sure. Improve the existing key-recovery attacks (http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf http://research.microsoft.com/en-us/projects/cryptanalysis/a...) on AES from 2^126 to 2^80 (through unknown methods, potentially exploiting the trivial relation of CTR plaintexts), which is a scale at which a state level party could perform computation, especially on specialized hardware. Observe a CTR block on known plaintext and recover the key. Practical key recovery attacks have existed against many block ciphers. AES is pedantically weaker than it should be (since an attack exists at 2^126). Do I think this is likely? I don't have enough information to answer, and in the absence of information I'd default to "probably not". It wouldn't be inconceivable, however.
misiti3780 12y ago
does anyone know why spiegel leaked these docs - and not greenwald via the intercept?
- xnull2guest 12y ago
  Doesn't Der Speigel have access to different documents and a second leaker? Or are these also Snowden documents?
- noinsight 12y ago
  They were released by Jacob Appelbaum and Laura Poitras who did a 3C31 talk about this too.
ck2 12y ago
As a google security engineer once said, "f-ck these guys" According to an NSA document, the agency intended to crack 10 million intercepted https connections a day by late 2012. By the end of 2012, the system was supposed to be able to "detect the presence of at least 100 password based encryption applications" in each instance some 20,000 times a month.
acd 12y ago
Most proprietary and mainstream software and protocols are insecure. If you care about your security use open source and open standards so that security professionals can test and verify its security. Skype insecure Cloud email popular ones used by end users insecure Whatsapp insecure Facebook messenger insecure Email insecure Dropbox insecure So in conclusion they are tapping into mainstream communication channels, its their job. People have become a bit lazy with cloud solutions and proprietary software because of their fast setup and convenience. People pay with their privacy for the convenience/laziness.
- edraferi 12y ago
  WhatsApp's recent integration of TextSecure [1] makes it one of the most secure communication options available to lay users. The vast majority of people simply can't manage without hosted tools. This lack of sophistication shouldn't damn them. [1] https://whispersystems.org/blog/whatsapp/ https://whispersystems.org/blog/whatsapp/
avz 12y ago
One topic I find missing from the privacy and security debate following Snowden's revelations is an explicit consideration of the adequate threat model. If the public thinks that the most prominent attackers on their privacy, security or identify are the best founded intelligence agencies on the planet, then the likely outcome will be grumpy resignation and consequent failure to protect against more mundane (and more likely) threats. Security and encryption are considered difficult and tricky. Even for software engineers. Raising the bar by highlighting the scale of resources of the most competent attackers is counterproductive. I think a practical threat model for an average internet user should highlight cyber-criminals, accidental misconfiguration, and careless handling of private information. Not NSA or GCHQ. Edit: The discussion of mischief by NSA and GCHQ belongs to the debate on public oversight of government agencies. The article above is about using encryption on the internet.
marcosdumay 12y ago
Ok, now that I've finally read the slides. They take usernames and passwords out of SSH. People, if the private botnets didn't made you disable password authentication already, do it for the NSA.
eyeareque 12y ago
It makes you wonder if the NSA/five eyes is actively working to keep topics/threads such as this one down played in the media, or even on HN. I did my part and upvoted the story to get it more exposure here:)

595 points by FabianBeiner 12y ago

I mostly read this thinking "good news". No, seriously, the documents suggest that the NSA hasn't made fundamentally important advances in decryption or uncovered significant weaknesses that academia doesn't know about. Now, that's not too much of a reassurance, because what academia (and the NSA) know is that HTTPS is in pretty terrible state, end-point security remains a significant problem, IPSec is a terrible protocl and so on. It does raise the question what all the mathematicians are doing at NSA, and why they don't seem to have come up with any meaningful results. Suggests they are a waste of money, but then that's all of the NSA. I suggest all of you check the original material (powerpoints w/ screenshots). A lot of people here suffer from the action movie mentality where they think the NSA is not like any other government agency, i.e. inefficient, behind the times, filled with horrible middle managers, deadweight, .. you get the idea. Things like the enterprise Java web interface, the CSV mass data export and "genericIPSec_wrapper.pl" can quickly dispel that myth.

EthanHeilman 12y ago
Or at the very least they have compartmentalized serious mathematical cryptanalytic capabilities. For instance: * We know that the NSA has a novel md5 collision capability since they have used it in their malware. None of the Snowden docs, that I have seen, have talked about this. * It is likely based on public research that the NSA can break 1024-bit RSA, but this has not showed up in the documents either. My personal belief is that we are missing compartments dealing with cryptanalysis because Snowden did not have access to them. His work and access were focused on Computer Network Operations and not cryptanalysis.
- dogma1138 12y ago
  I would not see any news organizations publishing any leaked document relating to actual technical capabilities. I don't even think that Snowden shared them with the reporters, the only ones who probably seen the besides Snowden are the FSB officers who "debriefed" him once he arrived in Russia. That's actually the thing that worries me the most about this incident, Snowden him self said that he kept the truely "nasty" stuff safe to be released in case something happens to him. But while he might not shared this with the press anyone who thinks he didn't had to buy his freedom in Russia with the full uncensored documents is fooling him self. This means that if he had any operational documents Russia and it's allies (N. Korea, Iran, China) just got a free upgrade to their own computer and communication intelligence apparatus. While people might not like their privacy being violated for the most part the NSA uses it's capabilities against unquestionably bad people, while in places like Russia and Iran it will be used against anything from reporters to political activists with much more severe consequences.
  - deleted 12y ago
    [deleted]
- yuhong 12y ago
  It is likely based on public research that the NSA can break 1024-bit RSA, but this has not showed up in the documents either. It would be expensive though. This is one reason why I consider 1024-bit end entity certificates much less of a threat than 1024-bit CA roots.
  - skuhn 12y ago
    I don't totally agree. I think that factoring in the risk of exposure leaves a CA root with a worse price / performance ratio versus an individual cert. While you could use a faux CA root to sign faux certs for any site you want (ideally ones who are customers of that CA), in practice your use is severely limited. If faux certs are spotted and no one knows where they came from, suspicions are going to be raised. Not only is your faux CA root compromised, but now you may have tipped your hand regarding your capabilities. To limit that possibility, your attacks would have to be extremely targeted. The more often a fake cert is used and the more people exposed to it, the higher the likelihood that someone will notice what is going on. It also doesn't help you decrypt the real traffic to the site, or historical traffic, which busting the site's actual SSL key can yield. This presumes that you have a way of intercepting said traffic, but I think it's pretty clear that that is not out of the question (public wifi / ISP cooperation / fiber optic taps / malware). It's more work to bust individual certs, but you're leaving a smaller trail and you aren't sending out examples of your RSA cracking capabilities to your opponents over the public Internet. Lowering the risk of exposure will let an attacker use the same methods over a much longer period of time, which I think is the goal here. As to how to combat this: there is a lot of low hanging fruit. Besides the obvious, I would love to see much shorter expiration times for certs become the norm (as in weeks, if not days). For this to realistically happen in a widespread fashion, at minimum CAs need to embrace the concept from a pricing perspective.
    - yuhong 12y ago
      Yea, if one was signed for www.google.com it would be a serious problem. If it is targeting specific obscure domain names where the customer is willing to accept the risk, that is a different matter.
  - 12y ago
- tptacek 12y ago
  It's plausible based on public research that any well-funded adversary can break 1024-bit RSA. You should assume 1024-bit RSA is simply broken.
  - EthanHeilman 12y ago
    Yes and given that I'm kinda surprised we haven't seen any docs talking about breaking 1024-bit RSA. That should have been their bread and butter, at least as far as DNI is concerned, a few years ago.
    - tptacek 12y ago
      What 'yuhong said: it could be expensive, with NSA having the capability to break only one every couple months. They might need to carefully coordinate which keys they break, in which case it would be an important secret which CA keys were broken.
      - xnull2guest 12y ago
        Do you think that the NSA would bother breaking CA keys? We know that they have shadow certificates and have much success infiltrating CAs to steal their keys and that they have been able to forge them without having to break the keys (via the previously unknown MD5 collision - as they did for Stuxnet. Seems to me like there are more valuable certs to go after (diplomats' certs, smartcard certs, OS update certs, ...).
        spacefight 12y ago
        So many "diplomats' certs" are used in machines by Crypto AG from Switzerland. And guess what, they had one major incident years ago - and even people working there have simply no clue who owns and control the company. I'd say most of commercial crypto systems are rigged. https://pbs.twimg.com/media/B5-aW_8CEAAUzji.jpg:large https://pbs.twimg.com/media/B5-aW_8CEAAUzji.jpg:large
        12y ago
- xnull2guest 12y ago
  Appelbaum also mentioned they have advanced crypt-analytic capabilities against AES, but the evidence right now supports that these advances are not enough to break AES in the general case.
  - MichaelMoser123 12y ago
    might be of interest in light of possible AES breakage: i have a small project that encrypts/decrypts the whole message with RSA (of course the message is also signed before encryption and result is verified on decryption); runs on as much cores as available; also for this it goes into some length to avoid multithreading locks in openssl (where possible). http://mosermichael.github.io/cstuff/all/projects/2014/02/24/openssl.html http://mosermichael.github.io/cstuff/all/projects/2014/02/24...
- erglkjahlkh 12y ago
  It is about economics. The attacks on crypto systems have complexities, and still at the end of the day they require things like raw calculation power. Could they break even single 16384-bit RSA key pair? Probably yes, but they wouldn't be doing anything else on that year. It would be simply way too uneconomical. Presented by Spiegel are internal services that are designed on purpose to be more economical. They exploit more bad implementations. It doesn't really matter as long as the dirty tricks get the work done. Also, NSA seems to troll for targets from the vicinity of their targets of interest. It is again more economical, and can be just as revealing. The risk there is that the broken target has nothing of use. The real movie style "let's break the encryption keys" stuff is done for sure targets when they get the extremely rare high value target on platter.
  - ryan-c 12y ago
    > Could they break even single 16384-bit RSA key pair? Probably yes There is no known algorithm that can break a properly generated RSA key of that size - the work required with GNFS is equivalent to brute forcing a symmetric key of something like 280 bits. Anything that could do that should be able to break even 4096 bit RSA keys (~144 bit security) pretty much instantaneously, and their problems with PGP pretty heavily imply they cannot do that.
- AlyssaRowan 12y ago
  That, at least, is the case. Specific operational cryptanalytic capabilities are indeed in separate compartments: PICARESQUE, PIEDMONT; focus on PAWLEYS for backdoors in, say, routers. GCHQ use STRAP3 protection measures for their CRYPTO compartments in CESG. As a sysadmin, Snowden basically had root, and probably had access to pretty much everything that wasn't thoroughly airgapped. However, very few computing resources would have been cleared for that Exceptionally Compartmented Information. The documents he gathered were focused more on activities like mass surveillance and standard undermining, that he sought to blow the whistle on, rather than their targeted cryptanalytic capabilities in general. 640-bit RSA could be broken essentially in real-time by the computing resources available to GCHQ a couple years ago. Of course, they don't actually have to work in real-time, so I suspect that 1024-bit RSA is entirely within their capabilities currently, given that. Diffie-Hellman is slightly harder, but if they're prepared to throw some in the bin or lag behind, they can probably do it, but that's just guesswork.
onewaystreet 12y ago
It doesn't matter how many mathematicians they have, they can't break good encryption. Unless the NSA has a super secret quantum computer that even Snowden didn't know about...
- dogma1138 12y ago
  Well until 2 Israeli guys "rediscovered" differential cryptanalysis against DES in the late 80's no one knew about it either, no one with the exception of the NSA and the DES working group at IBM that is, even tho to them that weakness was known for almost 2 decades. Additionally something like an effective attack against AES, RSA, or any other major encryption standard will probably be so compartmentalized that it won't even have a code word. But on the other hand S31176 refers to a program which provides cryptanalysis against VPN (IPSEC, SSL and more) and it claims that they can decrypt (some of) the traffic. http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35515.pdf
colordrops 12y ago
Here is yet another example of an unprovoked comment pushed to the top of a forum promoting the idea that three letter agencies like the NSA are incompetent and no better than the public sector at what they do, and that we don't need to worry about them. Go back to bed America, everything is OK. Just like the rest of the government, the NSA is not a monolithic entity with no separation of concerns. There are people who clean the floor and people who are at the extreme cutting edge of research. Don't let anyone convince you otherwise.
- revelation 12y ago
  Of course we need to worry about them? Even by what acamedia knows, it's pretty bad right now for security and encryption in practice. The belief that the NSA is at the extreme cutting edge and just so far ahead is exactly what stops us from making iterative, simple improvements on the technology we use. It's plain unhelpful, and as the data suggests, probably wrong. (The separation of concerns part is hilarious. Remember, this is the same agency where Snowden managed to wget -r their wiki and various other databases and then go on an extended vacation unnoticed.)
  - xorcist 12y ago
    The only data we have points to that the NSA is ahead of the academic community, from differential cryptanalysis onwards.
spacefight 12y ago
Also, most docs are from 2012. Who knows what happened since then. There is a reason, they have an army of mathematicians at hand. I look forward to the day when they walk away from their jobs.
higherpurpose 12y ago
SSL was sort of expected. There are tons of bad SSL implementations out there using ciphers with RC4 and SHA1, but I don't think virtually all VPNs being bypassed and decrypted is "good news".
kchoudhu 12y ago
Yeah -- a competent organization would have rewritten genericIPSec_wrapper.pl to genericIPsec_wrapper.rb ages ago!

deleted 12y ago

[deleted]

0x006A 12y ago

There was also just a talk about this at 31C3. Recording is still running, you have to seek back to the beginning: http://streaming.media.ccc.de/relive/6258/ http://streaming.media.ccc.de/relive/6258/

diafygi 12y ago

THESE DOCUMENTS CONTAIN EVIDENCE OF ATTACKS ON VPN, SSL, TLS, SSH, TOR. What do we do now? No seriously, what do we do? The full list of documents: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... The accompanying lecture: http://streaming.media.ccc.de/relive/6258/ http://streaming.media.ccc.de/relive/6258/ Also, obligatory: https://eff.org/donate https://eff.org/donate

aurelius 12y ago
Stop doing illegal things, and then be glad that NSA are working hard to catch the real bad guys?
- akiselev 12y ago
  You mean cease all opposition to those in power, forget about the security of our information systems, and be glad that the NSA is working hard to catch the real dissidents? Silly me, should have stayed in Russia.
  - pasta_2 12y ago
    Is there any evidence that the NSA has targeted dissidents?
    - nsmartt 12y ago
      Some will say that it’s necessary to balance privacy against security, and that it’s important to find the right compromise between the two. Even if you believe that, a good negotiator doesn’t begin a conversation with someone whose position is at the exact opposite extreme by leading with concessions. And that’s exactly what we’re dealing with. Not a balance of forces which are looking for the perfect compromise between security and privacy, but an enormous steam roller built out of careers and billions in revenue from surveillance contracts and technology. To negotiate with that, we can’t lead with concessions, but rather with all the opposition we can muster. http://thoughtcrime.org/blog/we-should-all-have-something-to-hide/ http://thoughtcrime.org/blog/we-should-all-have-something-to...

pointernil 12y ago

In the age of information this is how an overpowered super power gets "nerfed": By "targeting" its information gathering capabilities by providing information about its activities. Information is power.

pointernil 12y ago
Anyone care to explain why the downvotes? I still think all this revelations will lead to a more balanced state of affairs.

dmix 12y ago

This would be a good time to wait and let security professionals analyze the documents and take what you read in this article lightly, as I've found a number of sensationalist examples. For example, they claim Canada is monitoring hockey sites: > Canada's Communications Security Establishment (CSEC) even monitors sites devoted to the country's national pastime: "We have noticed a large increase in chat activity on the hockeytalk sites. This is likely due to the beginning of playoff season," it says in one presentation. But if you look at the actual slide https://i.imgur.com/2GO8H6L.png https://i.imgur.com/2GO8H6L.png, it is clearly a fake sample report of what a real one might look like. It even uses the name 'Canukistan' as the country name. There are 44 slide decks, one of the biggest leaks so far. It will take time to make sense of the noise. And any misinformation from reporting by non-technical journalists doesn't help the cause.

nsansansa 12y ago
> reporting by non-technical journalists doesn't help the cause non-technical journalists Ever heard of a certain Jacob Appelbaum?
- acqq 12y ago
  That guy you mention in spite of his very technical background also avoided the technical details and possibly also tried to sensationalize: I was worried as he claimed that the SSH is broken, but it seems that there is no document that states that for the passive capture of the SSH traffic (at least the documents are there and everybody can analyse them). However we already knew for a while that the active attacks are being done: http://www.theguardian.com/technology/2014/dec/07/north-korea-sony-pictures-regin-gchq-nsa-snowden-belgacom http://www.theguardian.com/technology/2014/dec/07/north-kore... The active attack can of course obtain enough information to decrypt the traffic automatically afterwards or even record it unencrypted. It appears that's the context of the SSH decryption in the documents.
  - spacefight 12y ago
    When will you guys all wake up? GCHQ does the full take on the cables, and there is no document yet, that claims NSA doesn't. So, all your sessions are hosed at some point in time. Either now or in the future. And yes, sensationalize is sometimes necessary to get more folks onboard to work with the documents.

driverdan 12y ago

Has anyone found which docs say how they attack SSH? The intro slides don't go into any detail. It could just be known SSH-1 vulnerabilities. My overall impression is that this doesn't reveal any new attacks. They are most likely using known vulnerabilities. For example, they decrypt PSK IPSec by exploiting routers and getting the keys, not breaking the encryption.

ProfOak_ 12y ago
In the talk they say that the papers only suggest that it can be broken into.

dicroce 12y ago

Domestic spying + Immunity from insider trading laws... It's a good time to be in the government.

xnull2guest 12y ago
You got downvoted. I think people have forgotten "Team Themis", HBGary and JPMorgan Chase.
bostik 12y ago
To give some credence to your comment about insider trading immunity, I performed a quick search. (My guess is that you got downvoted for not providing any evidence to support your, arguably acerbic and snarky, comment.) http://www.forbes.com/sites/kylesmith/2011/06/01/insider-trading-rules-that-dont-apply-to-congress/ http://www.forbes.com/sites/kylesmith/2011/06/01/insider-tra... The money quote: "There is no limit to how much money you can earn on insider trading in the House or Senate. Lawmakers and their staffers are specifically exempted." While I would consider it unlikely that NSA feeds senators with free stock market tips, the members of the oversight committee are sure to have an extensive advance view to foreign (and domestic) market-changing intelligence. There has been systematic resistance to reforms - the members probably consider making a quick and safe half-million on the stock market a necessary perk of the job.

deleted 12y ago

[deleted]

yuhong 12y ago
Older versions of the Adobe Reader plug-in often hangs for example while the PDF is downloading.

scrapcode 12y ago

Even though we know that the NSA does collect data on Americans, let's assume that they didn't. By using a network such as a VPN or a Tor Node that is located outside of the United States, would they "legally" be able to use the data collected on you received from those networks as if you weren't an US Citizen?

CamperBob2 12y ago
No, but that's where the Five Eyes concept comes into play, previously known as ECHELON. The idea is that agencies such as CIA and NSA can work around the limitations imposed by their own charters by cooperating with foreign agencies who have no such prohibitions. Then, the doctrine of parallel construction takes care of any remaining legal hangups.

nsansansa 12y ago

The comments that try to reassure the reader seem to have become more frequent. Scary.

nullc 12y ago

The fact that they broke some but not all the OTR messages in the log suggests to me that their attack is not a MITM, but instead a compromise of the 1024 bit DH or CTR mode AES.

tptacek 12y ago
Do you really think NSA has compromised AES-CTR? That would have to be a pretty fundamental attack, wouldn't it?
- tedunangst 12y ago
  I have little doubt they have compromised some system that reuses keys or nonces (or fails to increment the counter :)). If I were making a powerpoint to brag to my bosses, I would definitely put that on a slide.
- nullc 12y ago
  I am not trying to draw any conclusions. Just exploring what the data seems to support. Another alternative (mentioned on otr-dev) is an implementation which uses a low quality rng feeding the ECDH might result in some messages being recoverable and others not. An attack on CTR would indeed be pretty fundamental. Though some of the other documents appeared to support some level of cryptanalysis capability against some implementations of at least some symmetric ciphers.
  - tptacek 12y ago
    Can you think through a scenario in which CTR could be broken? CTR, in particular. What's a hypothetical here?
    - nullc 12y ago
      Sure. Improve the existing key-recovery attacks (http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf http://research.microsoft.com/en-us/projects/cryptanalysis/a...) on AES from 2^126 to 2^80 (through unknown methods, potentially exploiting the trivial relation of CTR plaintexts), which is a scale at which a state level party could perform computation, especially on specialized hardware. Observe a CTR block on known plaintext and recover the key. Practical key recovery attacks have existed against many block ciphers. AES is pedantically weaker than it should be (since an attack exists at 2^126). Do I think this is likely? I don't have enough information to answer, and in the absence of information I'd default to "probably not". It wouldn't be inconceivable, however.

misiti3780 12y ago

does anyone know why spiegel leaked these docs - and not greenwald via the intercept?

xnull2guest 12y ago
Doesn't Der Speigel have access to different documents and a second leaker? Or are these also Snowden documents?
noinsight 12y ago
They were released by Jacob Appelbaum and Laura Poitras who did a 3C31 talk about this too.

ck2 12y ago

As a google security engineer once said, "f-ck these guys" According to an NSA document, the agency intended to crack 10 million intercepted https connections a day by late 2012. By the end of 2012, the system was supposed to be able to "detect the presence of at least 100 password based encryption applications" in each instance some 20,000 times a month.

acd 12y ago

Most proprietary and mainstream software and protocols are insecure. If you care about your security use open source and open standards so that security professionals can test and verify its security. Skype insecure Cloud email popular ones used by end users insecure Whatsapp insecure Facebook messenger insecure Email insecure Dropbox insecure So in conclusion they are tapping into mainstream communication channels, its their job. People have become a bit lazy with cloud solutions and proprietary software because of their fast setup and convenience. People pay with their privacy for the convenience/laziness.

edraferi 12y ago
WhatsApp's recent integration of TextSecure [1] makes it one of the most secure communication options available to lay users. The vast majority of people simply can't manage without hosted tools. This lack of sophistication shouldn't damn them. [1] https://whispersystems.org/blog/whatsapp/ https://whispersystems.org/blog/whatsapp/

avz 12y ago

One topic I find missing from the privacy and security debate following Snowden's revelations is an explicit consideration of the adequate threat model. If the public thinks that the most prominent attackers on their privacy, security or identify are the best founded intelligence agencies on the planet, then the likely outcome will be grumpy resignation and consequent failure to protect against more mundane (and more likely) threats. Security and encryption are considered difficult and tricky. Even for software engineers. Raising the bar by highlighting the scale of resources of the most competent attackers is counterproductive. I think a practical threat model for an average internet user should highlight cyber-criminals, accidental misconfiguration, and careless handling of private information. Not NSA or GCHQ. Edit: The discussion of mischief by NSA and GCHQ belongs to the debate on public oversight of government agencies. The article above is about using encryption on the internet.

marcosdumay 12y ago

Ok, now that I've finally read the slides. They take usernames and passwords out of SSH. People, if the private botnets didn't made you disable password authentication already, do it for the NSA.

eyeareque 12y ago

It makes you wonder if the NSA/five eyes is actively working to keep topics/threads such as this one down played in the media, or even on HN. I did my part and upvoted the story to get it more exposure here:)