Slashdot Mirror
NSA Still Ahead In Crypto, But Not By Much
Hugh Pickens writes "Network World summarizes an RSA Conference panel discussion in which former NSA technical director Brian Snow said that cryptographers for the NSA have been losing ground to their counterparts in universities and commercial security vendors for 20 years, but still maintain the upper hand in the sophistication of their crypto schemes and in their ability to decrypt. 'I do believe NSA is still ahead, but not by much — a handful of years,' says Snow. 'I think we've got the edge still.' Snow added that that in the 1980s there was a huge gap between what the NSA could do and what commercial encryption technology was capable of. 'Now we are very close together and moving very slowly forward in a mature field.' The NSA has one key advantage (besides their deep staff of Ph.D. mathematicians and other cryptographic experts who work on securing traffic and breaking codes): 'We cheat. We get to read what [academics] publish. We do not publish what we research,' he said. Snow's claim of NSA superiority seemed to rankle some members on the panel. Adi Shamir, the "S" in the RSA encryption algorithm, said that when the titles of papers in NSA technical journals were declassified up to 1983, none of them included public key encryption; 'That demonstrates that NSA was behind,' said Shamir. Snow replied that when technologies are developed separately in parallel, the developers don't necessarily use the same terms for them."
what else would you expect from a public servant. he won't admit the private sector has them beat because it'd be the end of his job.
If you mod me down, I will become more powerful than you can imagine....
That's what they want you to think.
Be sure to drink your Ovaltine.
Everything in the world is controlled by a small, evil group to which, unfortunately, no one you know belongs.
The reality is that any private organisation will always say that their software is best or their crypto rocks the world.. There is one big difference with the NSA and that is they have very deep pockets when it comes to cracking encryption which very very few private organisations can afford. Which president would turn the NSA down if they came asking for money with a request like... 'we have managed to get xyz encrypted file that we need xyz cpu's to crack so that we can identify a leak who is selling secrets to the taliban/chinese/bob next door'.
I'm with Shamir, the only correct response here is: "Yeah, right, whatever", not "OMGOMGOMG, the NSA cAn readz my stuffz!!1".
Frankly, I don't see how any mathematician would want to waste his talent working for the NSA.
Until a working quantum computer is made.
I don't think so... public key cryptography was discovered by the GCHQ at least a decade before it was discovered in the public sphere: http://cryptome.org/ukpk-alt.htm
Crypto's not the weak link in security anymore, nor has it been for a long time. I think the real security money now is in automated (or proven) software verification and model checking. Private industry is only beginning to understand this, and as a whole, probably will not employ it for some time to come. Why bother testing for security errors when you can prove they don't exist?
"Snow replied that when technologies are developed separately in parallel, the developers don't necessarily use the same terms for them."
Sure, and I invented cars 200 years ago, but I didn't call it a car so someone else got the credit.
The NSA may have a "deep staff of Ph.D. mathematicians and other cryptographic experts who work on securing traffic and breaking codes" but let's face it, government departments are not exactly known for being the most motivated of the various sectors, and that's further exacerbated if you know you aren't going to get credit for your work as opposed to being kept secret ... I mean, in academia, one of the major motivations for leading scientists is that they get widespread recognition for their work. I suspect the funding to maintain that "deep staff" of experts probably serves more to keep those experts from being more productive 'elsewhere'. And of course they have to maintain that they are 'ahead' if they want to keep getting funded year after year, so I'd take it with a pinch of salt.
racism is not insightful
And with SELinux and NSA contributions to the Linux kernel your world domination plans aren't safe there either. They're everywhere, man.
The NSA may not have had RSA, but GCHQ did - and they developed it years before R, S and A.
> cryptographers for the NSA have been losing ground to their
> counterparts in universities and commercial security vendors for
> 20 years, but still maintain the upper hand in the sophistication
> of their crypto schemes and in their ability to decrypt.
Nevermind the intellectual "my code's better than yours" games
between arguably otherwise brilliant researchers.
Where the NSA certainly has 'maintained the upper hand' is in real
life versus ordinary people. The technology of surveillance has
gotten orders of a magnitude better and surrounding laws have been
adapted to make it fully legal to use that technology to the max
against The People (whereever they may be). Who in this discussion
encrypts their e-mails or uses 'sophisticated crypto schemes' as a
matter of course? At best it's maybe SSH here and there and the
occasional SSL site. The vast majority of traffic is plain-text, as
it's been since the days of papyrus. Hell, back in those days at
least only a few people could read it and thus had better privacy
than we mostly have today. Nevermind the ramifications of Facebook
and similar tools.
Mr. Shamir can engage in discussions of who developed Public Key
Cryptography first or not. It's all nonsense, because as brilliant
as the concept is, the PUBLIC has no part in it to 99.99% and
therefore we can consider it a complete FAILURE on grounds of lack
of acceptance and widespread use. Meanwhile the NSA sits back and
laughs, as their electronic tentacles filter through PUBLIC('s)
traffic...any traffic...and mostly doesn't have to bother with
breaking anything. Cuz we 'oh-so-clever' geeks have failed
miserably. If the NSA has any problem, then it's to store and
process/search through the data they get...not the acquisition.
But not, apparently, a lot of grown up usage of the English language.
Some people like knowing things that other people don't know and having secrets. Some people like adding to the store of human knowledge, and knowing that they have left the world a slightly better informed or capable place. Personally, I know from experience which type I prefer to work with, and it's not the "I'm a member of the in crowd, you're not" type.
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
In truth, the NSA is hundreds of years ahead of the rest of the world when it comes to cryptography.
what else would you expect from a public servant. he won't admit the private sector has them beat because it'd be the end of his job.
I don't think gov't vs private sector has the same meaning here. Would anyone flat out admit that another institution of any kind has them beat, and thus lose his or her job?
This is my sig.
Go get your quantum computer - NSA will just build a 10 bazillion node cluster of them.
They will just brute force your solution into the mud if it comes to that.
I am very small, utmostly microscopic.
That's all well and good for cryptanalysis, which is more or less provable, but for new encryption algorithms the more eyes you have looking at your algorithm the more certain you can be of its strengths. Not letting people look at your encryption algorithms seems to be relying on security through obscurity.
And how has the NSA "won" exactly? You think they have secret 'backdoors' for all major encryption algorithms? And if they haven't actually "won", why hasn't there been the disaster you predict?
Original quote:
'I do believe NSA is still ahead, but not by much -- a handful of years,' says Snow. 'I think we've got the edge still.'
Slashdot headline:
NSA Still Ahead In Crypto, But Not By Much
Sorry, Snow. But someone “thinking” that something is that way, has nothing to do with what it actually is.
There are people out there who still “think” that earth is flat, the sun revolves around it, and that there is a bearded man in the sky.
Then again, if you follow the money/power, you realize quickly, why that empty and pointless quote gets thrown around the Internet... ;)
Yeees NSA... you’re still the best... mama still loves you... really! *pat-pat*
I wish that NO agency of any country is “ahead” in crypto. It’s like saying that Jack the Ripper is still ahead of the police. Not a world you want to live in.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
[D]irector Brian Snow said that cryptographers for the NSA have been losing ground to their counterparts in universities and commercial security vendors for 20 years.
Until a working quantum computer is made.
That's just what they want you to think. Secretly, they already have a quantum computer that can decrypt anything near-instantly. They call it TRANSLTR. Okay, maybe not, but it would make a great Dan Brown novel.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
According to the journalism of John Young, famously of cryptome.org, the name NSA used for what we call "public key" cryptography is thare called "non-secret cryptography" meaning that one of the keys is not secret. John Young's article can be read here: http://cryptome.org/nsa-nse/nsa-nse-01.htm
Had a chance to get to know Brian Snow many years ago. The guy is not only so smart it's scary, he's also a very kind man. He cares for those around him and shows that in how he relates to those of "lesser stature." Never talked down to any of us, always polite, and very creative with a thoughtful going away gift when I left. NSA technical director? Wow! Glad to see he rose t the heights he deserved.
READ the US Constitution, the Bill of Rights and the other amendments! http://lcweb2.loc.gov/const/const.html
No badguy encryption is safe against Abby and McGee's secret decoder groups and rings, codenamed GRRR. And even if that doesn't work, we can always get Sigourney Weaver to stare at a screenful of alien gobbledygook for a few hours.
Kidding aside, the NSA does not indulge in bragadoccio without a reason. In the present instance, the motive may simply be to panic Ted and Alice into changing not just their keys, but their algorithms, hopefully forcing them to use beta (and buggy) software before its time. The attack is against weakness (i.e., pointy-haired managers) and not against techs (must...restrain...Fist...of...Death....)
The only point of interest in this is how NSA capabilities fare versus similar shops, for example, Mossad, the Russians, the British, the French, the North Koreans, China, India, Toodai, Al Qaeda, NHK, some group you'd never dream of.
``Tension, apprehension & dissension have begun!'' - Duffy Wyg&, in Alfred Bester's _The Demolished Man_
It's not one battle. They win many, and you rarely hear of it. They lose many, and you hear of every case that doesn't get stopped elsewhere. (getting "stopped elsewhere" could be that the NSA loses but then Mr. Terrorist gets kneecapped by his local loanshark)
There are plenty of bombings that succeed, every year. We quickly forget anything less dramatic that 9/11, but it's happening. Suppose that is just 1% of the ones that were planned.
I once saw the resume of a man who went to work for NSA at age 18. The entire Work Experience part of the resume was like: "Mr. X has served in a variety of technical and management positions at the National Security Agency for N years."