5 ms·

It was "masterfully terrible". Can you predict whether it was intentionally terrible or just incompetence at play? My impression is that the NSA likes their key

It was "masterfully terrible". Can you predict whether it was intentionally terrible or just incompetence at play? My impression is that the NSA likes their key leaking and similar approaches to be more subtle.

mpyne 11y ago
"The Open Smart Grid Protocol (OSGP) is a family of specifications published by the European Telecommunications Standards Institute (ETSI) used in conjunction with the ISO/IEC 14908 control networking standard for smart grid applications." Not sure who to blame if it is deliberate, but seems unlikely to be NSA, and not just because of the unsubtlety (though NSA was also behind the quickly-spotted Dual EC DRBG). Even back before the Crypto Wars the NSA usually tried to have their cake and eat it too though, trying to make their crypto breakages to types of breakage that could only be exploited by a state-level adversary like themselves. Leaving 3 different key recoveries available is 2 more than NSA would have needed, and the additional weaknesses simply make it more likely that a first-year CS student would eventually figure out the problems.
- raverbashing 11y ago
  "Published" Most likely it was created by the biggest SCADA vendors (which will remain unnamed) and know as much about computer security, best practices and modern developments as I know about 17th century Japanese history...
higherpurpose 11y ago
Doubt it's NSA in the sense that they suggested weak crypto, but I do believe NSA is to blame. They are the ones beating their chests how we need MORE CYBERSECURITY to protect our "critical infrastructure from cyberwar and cyberterrorists". And then proceed to: 1) do actually nothing to further security for critical infrastructure 2) push for more surveillance laws in disguise as "cybersecurity laws" I mean for crying out loud WhiteHouse.com didn't even use HTTPS until people on Twitter started a public shaming campaign against them. THAT'S how pathetic the real "cybersecurity" is in the US. And they have absolutely no real plan to change that right now. Who's going to come up with one anyway? This guy? http://www.govinfosecurity.com/interviews/michael-daniels-path-to-white-house-i-2422 http://www.govinfosecurity.com/interviews/michael-daniels-pa... Their current "plan" is passing stuff like CISA which will do nothing to stop a major cyberattack against critical infrastructure.
tptacek 11y ago
Nope, this is just a particularly funny example of what standards committees routinely produce.

mpyne 11y ago

"The Open Smart Grid Protocol (OSGP) is a family of specifications published by the European Telecommunications Standards Institute (ETSI) used in conjunction with the ISO/IEC 14908 control networking standard for smart grid applications." Not sure who to blame if it is deliberate, but seems unlikely to be NSA, and not just because of the unsubtlety (though NSA was also behind the quickly-spotted Dual EC DRBG). Even back before the Crypto Wars the NSA usually tried to have their cake and eat it too though, trying to make their crypto breakages to types of breakage that could only be exploited by a state-level adversary like themselves. Leaving 3 different key recoveries available is 2 more than NSA would have needed, and the additional weaknesses simply make it more likely that a first-year CS student would eventually figure out the problems.

raverbashing 11y ago
"Published" Most likely it was created by the biggest SCADA vendors (which will remain unnamed) and know as much about computer security, best practices and modern developments as I know about 17th century Japanese history...

higherpurpose 11y ago

Doubt it's NSA in the sense that they suggested weak crypto, but I do believe NSA is to blame. They are the ones beating their chests how we need MORE CYBERSECURITY to protect our "critical infrastructure from cyberwar and cyberterrorists". And then proceed to: 1) do actually nothing to further security for critical infrastructure 2) push for more surveillance laws in disguise as "cybersecurity laws" I mean for crying out loud WhiteHouse.com didn't even use HTTPS until people on Twitter started a public shaming campaign against them. THAT'S how pathetic the real "cybersecurity" is in the US. And they have absolutely no real plan to change that right now. Who's going to come up with one anyway? This guy? http://www.govinfosecurity.com/interviews/michael-daniels-path-to-white-house-i-2422 http://www.govinfosecurity.com/interviews/michael-daniels-pa... Their current "plan" is passing stuff like CISA which will do nothing to stop a major cyberattack against critical infrastructure.

tptacek 11y ago

Nope, this is just a particularly funny example of what standards committees routinely produce.