4 ms·
The fact that they broke some but not all the OTR messages in the log suggests to me that their attack is not a MITM, but instead a compromise of the 1024 bit D
by nullc 12y ago
The fact that they broke some but not all the OTR messages in the log suggests to me that their attack is not a MITM, but instead a compromise of the 1024 bit DH or CTR mode AES.
- tptacek 12y agoDo you really think NSA has compromised AES-CTR? That would have to be a pretty fundamental attack, wouldn't it?
- tedunangst 12y agoI have little doubt they have compromised some system that reuses keys or nonces (or fails to increment the counter :)). If I were making a powerpoint to brag to my bosses, I would definitely put that on a slide.
- nullc 12y agoI am not trying to draw any conclusions. Just exploring what the data seems to support. Another alternative (mentioned on otr-dev) is an implementation which uses a low quality rng feeding the ECDH might result in some messages being recoverable and others not. An attack on CTR would indeed be pretty fundamental. Though some of the other documents appeared to support some level of cryptanalysis capability against some implementations of at least some symmetric ciphers.
- tptacek 12y agoCan you think through a scenario in which CTR could be broken? CTR, in particular. What's a hypothetical here?
- nullc 12y agoSure. Improve the existing key-recovery attacks (http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf http://research.microsoft.com/en-us/projects/cryptanalysis/a...) on AES from 2^126 to 2^80 (through unknown methods, potentially exploiting the trivial relation of CTR plaintexts), which is a scale at which a state level party could perform computation, especially on specialized hardware. Observe a CTR block on known plaintext and recover the key. Practical key recovery attacks have existed against many block ciphers. AES is pedantically weaker than it should be (since an attack exists at 2^126). Do I think this is likely? I don't have enough information to answer, and in the absence of information I'd default to "probably not". It wouldn't be inconceivable, however.
- meowface 12y agoThe impression I got was that the person they were monitoring used OTR for some messages and plaintext for others.
- nullc 12y agoOne normally does not turn off OTR in the middle of a conversation.
- AlyssaRowan 12y agoI believe this is correct.