Cryptography 'Becoming Less Important,' Adi Shamir Says

Trailrunner7 writes "In the current climate of continuous attacks and intrusions by APT crews, government-sponsored groups and others organizations, cryptography is becoming less and less important, one of the fathers of public-key cryptography said Tuesday. Adi Shamir, who helped design the original RSA algorithm, said that security experts should be preparing for a 'post-cryptography' world. 'I definitely believe that cryptography is becoming less important. In effect, even the most secure computer systems in the most isolated locations have been penetrated over the last couple of years by a series of APTs and other advanced attacks,' Shamir said during the Cryptographers' Panel session at the RSA Conference today. 'We should rethink how we protect ourselves. Traditionally we have thought about two lines of defense. The first was to prevent the insertion of the APT with antivirus and other defenses. The second was to detect the activity of the APT once it's there. But recent history has shown us that the APT can survive both of these defenses and operate for several years.""

Comments

He put the S in RSA

[Anonymous Coward]

Without him, it'd just be RA, which isn't even RAD.

Re:He put the S in RSA

[a_hanso]

He put the S in Rivest-Shamir-Alderman

You mean Adleman.

Re:He put the S in RSA

[schitso]

Advanced, persistent threat.

no

[masternerdguy]

Encryption is the best anti-tampering mechanism you have in computing. Well placed encryption protects OS data from tampering, user data from theft, and sensitive communications secured. It's only getting more important.

Re:no

[masternerdguy]

Code signing to the rescue but slashdotters seem to hate that idea.

Re:no

[masternerdguy]

Before I get flamed, it is possible to do code signing without using it for evil. It's a tool like anything else.

Re:no

[jonwil]

Slashdotters (including myself) dont hate code signing, they just hate code signing where the owner of the computer does not control what gets signed and what can run.

Re:no

[happylight]

I think the point is no encryption is going to protect you from users installing malware, buggy software, or just plain hand over data unknowingly. Next to no attackers would attack the cryptography itself. The weakest link is always somewhere else.

Re:no

[masternerdguy]

Crypto is part of a full solution containing (crypto), proper segregation of permissions, proper segregation of user data / accounts, proper firewall configuration, proper software configuration, patching vulnurabilities, malware detection (lots of solutions on Windows, chkrootkit on linux), and user education. If I forgot anything add it to the list.

Re:no

[swilde23]

user education should be printed in all caps, bold, underlined, comic sans, etc...

At some point, unless we develop new algorithms that utterly break how current encryption algorithms behave (which I know I know, is a possibility... and of course the NSA has it already)... your weakest point is not going to be the computer. It's going to be the lackey at the front-desk happily letting a "tech" in (physically or electronically)

Re:no

[demonlapin]

This is true but unfortunately irrelevant. You can do all the user education in the world and it means nothing if the IT staff are idiots.

I have a handful of fairly secure passwords. They're reasonably long, are incredibly easy for me to memorize, and don't rely on any details of my life (pets, wife, kids, birthday, etc.). But I have to deal with websites that demand a series of ridiculous standards: some require (thank you, AmEx) a number in the username, some require passwords to have number, capital letter, and symbol. I spent a lot of damned time figuring out a password that people can't guess, and I can't use it because I can't remember the rules for any random website - so I have to get a password reset email sent to me in plaintext. And on top of that, I can't use a password I've used before - so every time I log into a website I rarely use, I have to reset the password to something I will forget in a few days. I'd use something like Keepass but I need to be able to log in from non-home computers.

Re:no

[grumbel]

I think the point is no encryption is going to protect you from users installing malware, buggy software, or just plain hand over data unknowingly.

That's a problem of the current day extremely fragile OS design. Stuff a user installs should simply never have the right to do any damage. Just like a HTML app is strictly sandboxed and can't access your whole HDD, so should a native executable. You don't really have to worry about malware when its locked up in a sandbox and can't even modify itself.

To make quick Unix example of how things should work:

Wrong way: sed "s/foo/bar/" file
Right way: cat file | sed "s/foo/bar/"

In the first one 'sed' has all the rights the user has and can do whatever it wants behind the users back. In the second case 'sed' needs absolutely no rights at all aside from being able to read stdin and could be completely sandboxed away. It's 'cat' that has the right to access users files and pass the data down the line to other programs. Thus instead of having dozens or hundreds of apps with file access, you have just one. Similar concepts can be adopted to the GUI easily where the file dialog (the GUIs 'cat' equivalent) becomes part of the OS instead of the application.

Re:no

[hairyfeet]

Exactly, its like how a friend of mine was nearly fired because he wouldn't let a PHB have his "files" from his "friend" Melissa, yep the moron was threatening to fire him if he didn't let a worm loose on the network. Lucky for Glenn the guy above the PHB wasn't a retard and actually kept up on current events so he just said "Is he talking about the worm that's going around?" and then gave Glenn a free steak dinner while giving the PHB the riot act for trying to compromise security for an imaginary girl.

At the end of the day you just can't protect from a case of the stupids, you just can't. I was quite proud of having an unbroken record, nothing but happy customers and well running systems,until I finally had to throw a customer out of the shop and threaten to call the cops, why? because this was right after Limewire had been shut down, I told him flat footed "The courts shut Limewire down, it doesn't exist and anything that says its limewire is either worthless or a malware laden fake" so guess what he did? promptly went home, downloaded "the new limewire" and then demanded i fix the machine for free because...shock... it was nothing but a bunch of malware with the limewire logo. When i threw him out the shop he was saying "it says its limewire now you make it work!"

Sadly there is only so much you can do without turning the system into nothing but a locked down, corporate controlled thin client and as long as the user has the right to install you are at the whims of somebody who may be a moron. I learned you do the best you can but at the end of the day stupid is as stupid does.

Re:no

[the_B0fh]

no. They finally tracked it down. They watched the guy come in and take over the box again. He got in and owned the box in 8 seconds.

The hacker found an old samba server in Australia (version 0.5 or some such), took it over. Used that to remotely mount the windows desktop used by the researchers in Japan.

Found the private cert/key on the windows box. Used that to ssh in to the linux server. Ran a zero day gnome exploit and took it over.

After taking over the server, installed 2 kernel modules that hid itself and also trapped certain calls like the ones used by tripwire and basically returned true for all the operations for tripwire and removed itself from the modules list and the process list.

damned cool hack, and that was 15 years ago!

Re:no

[crutchy]

would you remove all the locks on the doors and windows of your house merely because they couldn't stop aliens from abducting you?

also, window locks are uselss because burglers can simply smash the window

any level of personal security (even the fake security cameras, lasers, etc) is better than none at all

but on the other hand, imposing your ideas of "security" on others is not a good idea (such as the TSA)

people should be free to decide what level of security they think is appropriate for themselves, as long as it doesn't adversely affect others (don't install a nuclear reactor powered ion cannon in your back yard because your neighbors likely won't be very happy having risks from your ideas of security imposed on them)

APT

[Anonymous Coward]

Would have been nice to define APT...

Re:APT

[Dizzer]

Advanced Persistent Threat

Re:APT

[Frosty Piss]

Advanced Persistent Threat

Re:APT

[fuzzyfuzzyfungus]

It's doubly annoying because(in PR-flack ass-covering speak) an "Advanced Persistent Threat" is "Any bad guy smarter than our dumbest sysadmin's stupidest mistake".

It might have been a clear category at one point(and there still are attackers who are pretty clearly both advanced and persistent); but the constant "Well, we could say 'gosh, we fucked up, how stupid of us.' or we could say 'It was and Advanced Persistent Threat, total national security shit, probably chinamen or something!'" pressure hasn't helped...

Re:APT

[obarthelemy]

Actually, I know plenty of intelligent people who make mistakes. Almost as many as retards who take pleasure in calling others out.

Re:APT

[Score Whore]

Always Perky Titties. The thing is the nerds in IT are easily distracted by some nice sweater stretchers which enables the bad guys to have their way with the servers while the boobs are bouncing around.

The way I do security

[Anonymous Coward]

I have a PC that I use for all of my financial stuff, record keeping, and other critical data. I don't encrypt the hard drive. I don't even password protect files.

You know how I do security for the PC that handles my most critical data?

It's not plugged into the fucking Internet. That's how.

Re:The way I do security

[masternerdguy]

Have fun when Joe the Burgler takes your computer.

Re:Dress for suck-(cess)

[vux984]

His point wasn't that cryptography wasn't useful, but simply that dealing with modern threats doesn't require "better cryptography" because modern threats aren't attacking the crypto. They are attacking the public key infrastructure (PKI), they are attacking the end points before encryption/after decryption.

Our security focus is there.
In other words, PGP doesn't protect your email, if you have a virus on your system sending everything to an attacker after its decrypted. PGP doesn't protect your email if the PKI is hacked, and you are signing mail with public keys generated by people impersonating the intended recipients.

Etc. Etc.

A better PGP crypto algorithm isn't going to help you here.

Security was never about encryption

[qbitslayer]

The use of encryption is only intended to provide a way for legitimate remote users to gain supervised access to the system without having to hack into it. The real culprit behind bad security is software reliability. Attackers look for and try to exploit the defects in the software. Why is software defective? Because (it's the bugs, stupid!) the Turing/Von Neumann model of computing is inherently insecure and unreliable. Why? Because timing is not an essential part of the model. I predict that this decade will see the end of the Turing madness and that the future of computing is non-algorithmic. There is no alternative and the sooner, the better.

He's probably just fed up.

[Animats]

I suspect he's just fed up with the state of software security, which is appallingly bad. We now have patch-and-release on everything. This turns out to be a failed strategy against competent attackers.

I used to work on secure microkernels in the 1980s. I thought that by now we'd have provably secure microkernels in ROM with a mandatory security model enforced. Systems like that have been built a few times for the three-letter agencies, but never went mainstream. Instead, we have bloated operating systems with a high churn rate, and far too much trusted software per system.

Ballmer used to call this "strategic complexity". As Ballmer once put it, when asked why Microsoft kept adding functions to Windows, "If we stopped adding functions to Windows, it would become a commodity, like a BIOS. And Microsoft is not in the BIOS business".

Most applications should be running with far less privileges than they have. But if they are locked down properly, their ad tracking, update checking, and self-modification won't work. The user would actually be in charge.

Cryptography only provides a secure way to communicate between secure regions. If there are few or no secure regions, it doesn't help much.

I do not agree!

[endus]

I was just having a discussion about this at work today. Encryption should be ubiquitous now. There is no excuse. It's not "free" in terms of the resources it takes up, but it's pretty close. Everything should be encrypted in transit. Everything should be encrypted at rest. "Well you mean the table with the PII and not...." NO! I mean EVERYTHING. The servers drive should be encrypted. The entire database should be encrypted. Every network connection should be encrypted.

This doesn't mean encryption is a panacea solution to APTs or to any other security threat, but its an absolutely critical layer which is still not widely implemented enough. To prevent tampering, to prevent certain types of attacks, to prevent breaches through physical theft, etc. Saying encryption isn't as important anymore is like saying that keyboards aren't that important anymore. Sure, management shouldn't spend a lot of time worrying about them, and should be focusing on other problems instead....but that doesn't mean everything will be cool if everyone's keyboard is stolen overnight.

It needs to be there, and by there I mean everywhere. And its not. Every day developers are looking at security guys like, "huh??" because they are looking for encryption to be incorporated into the product. Or, they want to "just get the system built out" without encryption, but they'll totally enable it once everything is working perfectly and all the testing is done (FYI developers, security guys aren't falling for that, we realize that you really mean, 'we'll think about enabling it until we realize how many things it will break, and then we'll ship the product without it, ignoring the enormous liability it creates'). You would think things would be different now that its 2013...they are different, but not that much different. Security still isn't regarded as a core piece, or even an important feature, of most products.