Slashdot Mirror

← Back to Stories (view on slashdot.org)

Most Tor Keys May Be Vulnerable To NSA Cracking

Posted by timothy on from the aren't-you-glad-to-be-so-fully-protected? dept.

Ars Technica reports that security researcher Rob Graham of Errata Security, after analyzing nearly 23,000 Tor connections through an exit node that Graham controls, believes that the encryption used by a majority of Tor users could be vulnerable to NSA decryption: "About 76 percent of the 22,920 connections he polled used some form of 1024-bit Diffie-Hellman key," rather than stronger elliptic curve encryption. More from the article: "'Everyone seems to agree that if anything, the NSA can break 1024 RSA/DH keys,' Graham wrote in a blog post published Friday. 'Assuming no "breakthroughs," the NSA can spend $1 billion on custom chips that can break such a key in a few hours. We know the NSA builds custom chips, they've got fairly public deals with IBM foundries to build chips.' He went on to cite official Tor statistics to observe that only 10 percent of Tor servers are using version 2.4 of the software. That's the only Tor release that implements elliptical curve Diffie-Hellman crypto, which cryptographers believe is much harder to break. The remaining versions use keys that are presumed to be weaker."

52 of 236 comments (clear)

  1. Re:well by Jeremiah+Cornelius · · Score: 5, Informative

    Just use bigger DH, with better cipher. AES-256? Maybe. Twofish? OK.

    Bruce Schneier himself advises avoiding elliptic-curve, as being intellectually tainted by the spooks.

    --
    "Flyin' in just a sweet place,
    Never been known to fail..."
  2. Re:well by Black+Parrot · · Score: 5, Insightful

    I recommend a "zero time pad" : if you want it secret, don't put it on a computer.

    --
    Sheesh, evil *and* a jerk. -- Jade
  3. Getting tired here by ghost_templar · · Score: 3, Insightful

    The more I read of Slashdot (and to an extend Ars Technica), the less I want to continue reading. All it is these days is NSA, NSA, NSA. It's too damn depressing and what's worse, it's one of those situations where it's

    (a) an intangable threat (you will probably never suffer directly because of what they're doing, but it still feels wrong)
    (b) related to (a), it's something that the wider public doesn't know about and would be hard-pressed to convince is a threat without sounding like a looney
    (c) cannot be overcome (moving to Linux for example doesn't change much if the network can still be tapped, and evidently TOR is now comrpomised), short of abandoning technology and reverting to primitive technology for, again, a hypothetical threat that will probably not ever affect us DIRECTLY, but still something we know shouldn't be happening.

    I just want to read about science and technology, interesting shit. Seems impossible to do that anymore since clearly NSA stuff rates rather highly.

    TL:DR - what's the point of knowing how evil things are if tangible, WIDESPREAD changes aren't going to happen due to our lack of power? You just become miserable, while everyone else is (relatively) happy because they don't know. There's a reason ignorance is bliss is a saying.

    --
    "Holy crap! A weapon just floating in space!"
    1. Re:Getting tired here by AHuxley · · Score: 4, Insightful

      We have had 30 years of whispers, books, magazines and talks by past experts. We seem to have a generation of experts who seemed to allow their allowed hardware and software encryption to fail on a global scale.
      So every new story adds to work mentioned in the past. In 30 years this would have been amazing news.
      Getting all this crypto and telco news now is going to allow some very creative people to release some new software and hardware.

      --
      Domestic spying is now "Benign Information Gathering"
    2. Re:Getting tired here by QRDeNameland · · Score: 5, Insightful

      I just want to read about science and technology, interesting shit.

      I feel your pain, but unfortunately, if the NSA/intelligence complex truly can not be reined in (and I'm not optimistic that it can be), I think you're looking at the dark ages for any science or tech that doesn't serve their purposes.

      Someone posted the following citation at the New York Times yesterday, which really struck a nerve with me:

      "The man who is compelled to live every minute of his life among others and whose every need, thought, desire, fancy or gratification is subject to public scrutiny, has been deprived of his individuality and human dignity. Such an individual merges with the mass. His opinions, being public, tend never to be different; his aspirations, being known, tend always to be conventionally accepted ones; his feelings, being openly exhibited, tend to lose their quality of unique personal warmth and to become the feelings of every man. Such a being, although sentient, is fungible; he is not an individual." Bloustein, Privacy as an Aspect of Human Dignity: An Answer to Dean Prosser, 39 N. Y. U. L. Rev. 962, 1003 (1964).

      Don't think for one second that this is an intangible threat. The people who blissfully ignore or accept it are exactly the people who won't be doing the paradigm shifting science or creating disruptive technologies. The people who would do those things are stuck with the same choice you state: acknowledge a really sucky situation and face being miserable, or ignore it as 'intangible' and go about their day, and just focus on uncontroversial science and tech that won't get them in any trouble. Can that possibly be a good thing?

      --
      Momentarily, the need for the construction of new light will no longer exist.
    3. Re:Getting tired here by sharklasers · · Score: 5, Insightful

      I think their point is that Slashdot (and presumably most tech sites at the time) focused more on tech, developments, hard science and whatnot. Now it's basically more about the politics that goes on in tech, such as data mining, surveillance and patent wars. Sure, the stuff being talked about is serious and worth covering, but it dominates coverage these days and the balance doesn't seem to be there anymore.

      Also, if you are a fan of a site, you SHOULD piss and moan about the quality of the articles and discussion. The only reason you'd bother is if it was once great and has devolved, and you're not pleased by it. There seems to be this impression that making noise and complaints about something is a BAD thing. No wonder things are getting worse.

    4. Re:Getting tired here by Artifakt · · Score: 4, Insightful

      I'm going to take a stab at empowering you.
      We're in a long term fight for human freedom. Long term means you may have to influence people now who can just possibly help us, or at least you, ten or twenty years down the road. Pick people who are running for minor or local offices, and need a little help, whether it's contributions or getting out the vote or going door to door. You don't have to spend a fortune or put in fifty hours a week on top of your day job to be remembered as one of those people who helped congressman X get his start in politics.
      Write letters - you'ld be surprised how many seemingly major pieces of legislation draw two or three letters as they are up for debate, and how getting letters from as few as 10 or 20 people may make a congressman suddenly vote the way he now thinks the vast majority of his constituents want him to vote. Senators and Representitives may see 10,000 e-signatures on a stock electronic petition, but don't usually see even 10 actual letters. A letter thanking them for having done the right thing after it's over is even rarer.
      Focus on the persons who seem like they have a good chance of making it to higher office eventually. Find out what a Farley file is, and make sure you end up in a few, in a positive way. Work on your spelling and grammer - An eloquent nutcase may be able to pass as a mainstream voter, but a mainstream voter who writes in all caps and spews sentence fragments, can definitely say something eminently sensible and still be labled a nutcase.

      Here's a link for Farley Files. Politicians who make it to high office just about invariably use these, so it's always helpful to know about them. Learning to watch for signs a candidate uses the system is a way of spotting the ones who will go high enough they may someday be able to address issues like the NSA programs. It's also useful to consider in judging what a politician truly considers important rather than what he says in prepared speeches - that is, if he or she is using a file, what do they focus on.

      http://en.wikipedia.org/wiki/Farley_file

      --
      Who is John Cabal?
    5. Re:Getting tired here by Natales · · Score: 2

      I understand your thinking. Yet, once your eyes have been opened, you can't go back anymore. I know it's a cliche in this audience, but it's really like swallowing the red pill. We now know we were not crazy and there really is an extremely powerful entity out there attempting to break all our most trusted systems. We can 1) ignore it, 2) accept our fate and go kosher (according to 'the system') or 3) fight it. I've chosen 3, mostly because I think this is just the beginning and things can get really dark very fast if we let this stand. I also want to point out that the NSA hires really smart folks, but they are not superhuman. We, as a collective, can outsmart them all, and then we can create open source software easy enough for the masses to use. We've done it before and we can do it again. THEY are not infallible!

    6. Re:Getting tired here by AHuxley · · Score: 2

      The http://en.wikipedia.org/wiki/Allegory_of_the_Cave moment via US crypto exports :)

      --
      Domestic spying is now "Benign Information Gathering"
    7. Re:Getting tired here by Jah-Wren+Ryel · · Score: 2

      All it is these days is NSA, NSA, NSA.

      I count 22 stories today (friday). At most 4 are NSA, and that's stretching it (epic browser isn't more about commercial trackers than government and Iran/Syria interception is only speculatively nsa). So ~15% NSA stories really isn't that overwhelming.

      --
      When information is power, privacy is freedom.
    8. Re:Getting tired here by he-sk · · Score: 3, Interesting

      Hackers can't afford to be apolitical anymore. It's what brought us to the current situation.

      --
      Free Manning, jail Obama.
  4. a few hours for one key would be good by raymorris · · Score: 4, Interesting

    If that speculation is right, that a billion dollars will buy hardware that takes a few hours to break one key, great. That would mean nobody is going to break MY key, and that al Qaeda's keys were broken soon after they started using them. Works for me.

    1. Re:a few hours for one key would be good by girlintraining · · Score: 5, Interesting

      If that speculation is right, that a billion dollars will buy hardware that takes a few hours to break one key, great. That would mean nobody is going to break MY key, and that al Qaeda's keys were broken soon after they started using them. Works for me.

      I think you're looking at this backwards; They won't spend any money to break your key because you're worth zero dollars. What could you possibly be doing that would warrant the NSA's interest? You need to understand the organization; They primarily do signals intelligence, and they operate in a support role to other agencies, principally the CIA, FBI, and DHS.

      The NSA simply logs the data and holds on to it until and unless something happens that makes analyzing that data a priority. They may record all cell phone calls, but they don't listen to them all. They may record all internet traffic, but they don't review all of it. In order for them to expend resources, there needs to be a reason. You could be using '1 bit' encryption and it would be as interesting to them as '1 million bit' encryption.

      In security, your defenses need to be harder to break than the value of the thing being protected. Although Tor's encryption may be insufficient against a government, it is plenty strong for most everyday uses -- getting around corporate proxies, location-locked services (like shows the BBC offers, Netflix, etc.), and for proxying to Facebook. Yes, I use Tor to connect to Facebook... because I don't want them knowing where I am, and my IP address provides a wealth of marketing information to them. I also don't use my real name, but really, the main reason is just to piss in their data collection cheerios, not because I'm doing it to be 'anonymous' or 'super secure'. And this is what most people use Tor for; along with browsing bittorrent sites (though downloading is still direct...), and other things that they may feel uncomfortable with having a readily-accessible record of at their ISP's office (gay porn anyone?).

      The NSA cares not for these activities. It's logged all the same, but until they say that, say, "the alias raymorris on slashdot indicated he may be in possession of classified materials" all that data just sits on a harddrive somewhere, waiting to expire. The NSA just waits for the phone call.

      That said, a few hours to break one key is pretty petty for accessing your internet traffic or mine, but if Al Quaeda has a hidden service inside Tor they're using to communicate with, a secret website if you will... now those few hours' worth of electricity seem very, very worth it.

      You've gotta understand that security is not an absolute; There is no "secure" versus "insecure". There is only no security, and then varying degrees of more security; And good security is when it costs more to break it than the value of the thing being protected. Great security is when that's true and the computer functions the way you expect.

      --
      #fuckbeta #iamslashdot #dicemustdie
    2. Re:a few hours for one key would be good by Yvanhoe · · Score: 4, Informative

      This is good only if you work under the assumption that you will not disturb any entrenched interests. As a European who works for European companies with US competitors, I can not assume that no one will ever spend a few hours to know what is inside the mails I sent to my boss.

      This is not an hypothetical case. In my last job we were in direct competition with IBM and were exchanging crucial pricing information through email. There has been precedents of ECHELON being used to gain economic intelligence (google "echelon airbus boeing" to learn about that)

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    3. Re:a few hours for one key would be good by girlintraining · · Score: 4, Interesting

      This is not an hypothetical case. In my last job we were in direct competition with IBM and were exchanging crucial pricing information through email. There has been precedents of ECHELON being used to gain economic intelligence (google "echelon airbus boeing" to learn about that)

      Oh please. Every government engages in industrial espionage. The French are so well known for it that CEOs for pharmaceuticals that check-in to local hotels are told not to use the fax machine or internet there, and to keep their laptops in their room, and to bring their own locks to secure it and not use the hotel safe or in-room safe as the cleaning crew often isn't the usual maid service. I mean, this is SOP. Not that I'm picking on the French -- they're only guilty of being particularly bad at doing it covertly, but everyone does it.

      One does not need ECHELON to spy on a company. Hell, showing up to replace a printer in slacks and an official-looking work order is usually enough to get into a building... and having a rigged printer that records all the jobs sent to it is a nice opener. Following up with a power strip with its own wifi, mini computer, and cat5 pass-thru is a good follow-on. Why do people assume you need satellites and taps on hundreds of internet routers all over the world to do this?

      And don't underestimate blackmail, human stupidity, or the CEO's penchant for keeping a post-it note with his password on his computer, trusting that his secretary and security staff would neeeeever let anyone in who wasn't supposed to be there.... and of course, nobody ever takes bathroom breaks while watching the CEO's office over lunch time.... -_-

      And as a bonus... most corporations record all e-mails to monitor their employees. Amusingly... these systems are usually less secure than the ones they're tapped into. So if you don't have the money to bring your own equipment... they're usually nice enough to provide it for you.

      --
      #fuckbeta #iamslashdot #dicemustdie
    4. Re:a few hours for one key would be good by dalias · · Score: 2

      You missed the point: the NSA likely has the capacity to break systems which SHOULD provide forward secrecy, as long as the key size is sufficiently small, for example 1024-bit Diffie-Hellman. Migration to larger keys is needed to combat this. I may be mistaken, but offhand I believe with DH each additional 2 bits will double the resources needed to break it.

    5. Re:a few hours for one key would be good by j-turkey · · Score: 5, Insightful

      I disagree with your assertion that since you're not a terrorist, the NSA has no interest in you and/or what you do. Law enforcement tools are always used to their fullest extent. I mean, it makes sense; law enforcement is a bit hamstrung by rights guaranteed under the constitution - they will use whatever tool is at their disposal to get their job done.

      Whether or not you were investigated when the system was new is irrelevant to what law enforcement has started (or will start) using these systems. Also, to obtain a FISA warrant for an investigation related to terrorism is quite trivial and open to interpretation. Any evidence discovered of other crimes in that warrant is usable in court. I have seen it first-hand while siting on a federal jury last summer. A US khat-selling ring's sending money overseas was investigated by DHS due to concerns about possibly funding terrorism. It wasn't, but the multi-million dollar investigation had to net something - so I sat on a jury for 5 weeks and sifted through mountains of wiretap transcripts so the federal government could incarcerate a bunch of taxi cab drivers who wanted to chew some khat so they could work a little later and make a little bit more money.

      I hate to be the slippery slope guy...but this is typical. It's only a matter of time until these law enforcement tools are used on a wholesale basis (if they aren't being already). After reading about the extremes that the Soviets would go to under Stalin (if you were being investigated, you must be guilty of something), I feel like I have a fair understanding for how far things can go. I'm not suggesting that America is going that way...but why give her the chance, especially when we can do something now? Why not start setting some limits on this stuff? I think that the risks of what's going on outweigh the benefits. Is it unreasonable to do an honest analysis of the real risks of terrorism against the security measures that our government is putting in place?

      --

      -Turkey

    6. Re:a few hours for one key would be good by Njovich · · Score: 2

      Ok, so I live in Netherlands. The US is wiretapping most of the worlds traffic, and the excuse is that all governments do this? No they are not. I really don't think Dutch intelligence services are spying on IBM to get better deals for companies. There are a handful of countries that do this shit at a bigger scale, and all of them should stop. This is no way to treat the citizens of other countries, especially if there is no national security issue.

      Frankly, the only thing I've heard about this that is more insulting is the 'oh, it's not a problem because we only do this to foreigners' excuse.

    7. Re:a few hours for one key would be good by nbauman · · Score: 4, Insightful

      I disagree with your assertion that since you're not a terrorist, the NSA has no interest in you and/or what you do. Law enforcement tools are always used to their fullest extent.

      National security agencies will use their tools not only against criminals, but against their political enemies who are engaging in Constitutionally-protected activities. For example, J. Edgar Hoover used to tap Martin Luther King's telephones, and then spread personal information about King's sex life to try to harm the integration movement.

      Or a recent example. Eliot Spitzer was the Democratic governor of New York, and he was an effective governor who was aggressive about shaking things up. Banks have to report every transaction by every customer of $10,000 or over to federal authorities, and every transaction under $10,000 that looks "suspicious." So the feds get this huge flow of reports. One of the reports was on Spitzer. They investigated and found out as the result of this fishing expedition that he had used an escort service, which was probably legal and almost never prosecuted. Nonetheless, the Republican Attorney General decided to prosecute Spitzer for this, and leaked his name to the press. The Republican AG offered Spitzer a "deal" -- if the effective Democratic governor resigned, the Republican AG wouldn't prosecute him. Spitzer resigned, and was replaced by David Patterson, who didn't want the job and nobody, including Patterson, thought was qualified.

      So there you have a partisan use of confidential information that a federal agency got through its financial monitoring process, that a Republican AG used to get rid of an effective Democratic governor.

      The more electronic monitoring we have, the more it will be used improperly by politicians to damage their enemies.

    8. Re:a few hours for one key would be good by swillden · · Score: 2

      You missed the point: the NSA likely has the capacity to break systems which SHOULD provide forward secrecy, as long as the key size is sufficiently small, for example 1024-bit Diffie-Hellman.

      No, you missed the point. It is, perhaps, a subtle point, because the meaning of "forward secrecy" isn't obvious. Let me explain.

      Having the ability (assuming they do) to crack 1024-bit keys does not give them the ability to read very much of the world's traffic because even if they can crack each key in a few hours, there are way too many keys. girlintraining said that they address this by capturing and storing all of the encrypted traffic so that at some later point in time when they realize they need to read some particular piece of it, then they can crack the relevant key (in a few hours) and decrypt it.

      But if servers use algorithms that provide forward secrecy, they can't do that. If you have recorded traffic and later crack the ECDHE private key used by the server to derive the session key with which the actual data is encrypted, you still can't derive the session key or decrypt the data. That's what forward secrecy means.

      To crack recorded data, you'd actually need to crack two 1024-bit keys... the server's key and the client's key. While the server's key is fixed (until rotation), the client generates a new random key for every session. This means that if the NSA has recovered the server's key, they still have to do that several-hours-of-computation for every single SSL session they want to read. And even that doesn't state the full difficulty of their problem, because unless they can somehow break into the server to recover its private key, the problem they're facing is cracking two 1024-bit keys at the same time from the same data stream. That problem is equivalent to cracking a 2048-bit key, which requires on the order of 10^10 more effort.

      Of course, what they actually have recorded is many sessions which all use the same server key but different client keys. There may be some way to exploit the fact that the same server key is used in all of them to optimize the process a little. If so, no one in the public cryptanalytic world has found it, and it's not obvious mathematically that it would exist. But it's vanishingly unlikely that this supposed improved method wouldn't still be orders of magnitude harder than cracking a single 1024-bit key.

      The other benefit of ECDHE over RSA is if we vary the threat model a little bit. Suppose, for example, that the NSA has bribed some employee at a big Internet site (say, Google) and obtained a copy of the server private key. If it's an RSA key, the NSA can then decrypt and read all traffic to Google which was protected with that key. If it's a DH key, they have to crack the client key for each individual SSL session before they can read that session, unless, of course, they've compromised the client thoroughly enough that it hands over each key it uses -- but if they've done that they can simply have it hand over the data, bypassing all of the crypto crud entirely.

      And if servers switch to using 2048-bit ECDHE, as Google has recently done, then the whole thing becomes completely intractable, even with the server private key, unless the NSA is mounting MITM attacks, which are fairly easy to detect.

      I may be mistaken, but offhand I believe with DH each additional 2 bits will double the resources needed to break it.

      You're mistaken. Determining key strength for asymmetric keys is not easy to do, but assumptions based on the complexity of the number field sieve (the best known algorithm for cracking DH as well as RSA) provide a decent way of estimating. From the estimates in RFC3766, I get that to add one bit of security (double the resources) of a 1024-bit key you'd need to add 25 bits to the key length. To add a bit of security to a 2048-bit key you'd need to add 36 bits to the key length. For a 4096-bit key you'd need 52 more bits.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  5. Re:Obama hates US Constitution by w1zz4 · · Score: 3

    Mmmm laws that granted NSA permissions to do this have been approved during Bush presidency. Is this meaning Republicans and Democrats are the same? Maybe it's time to wake up US citizens and stop voting for those two partys over and over... But as a Canadian, I probably should not comment on US politics. Anyway our Prime is not a reference...

  6. Re:Question: multi-layer encryption by dantotheman · · Score: 4, Informative

    Depending on the encryption method, doing it twice might make it easier to crack...

    **This message has been encrypted twice with the ROT13 method**

  7. Re:well by Jeremiah+Cornelius · · Score: 4, Informative

    Wrong Guardian Schneier link. :-)
    http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance

    From Item 5:
    "Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can."

    --
    "Flyin' in just a sweet place,
    Never been known to fail..."
  8. Guess who is funding Tor? by hypnosec · · Score: 5, Interesting

    According to consolidated financial statements and reports of the Tor Project for the year ending December 2012, US Federal agencies are responsible for nearly sixty percent of funds received by the project. Tor has taken a defensive stand against this, but who knows?

    1. Re:Guess who is funding Tor? by girlintraining · · Score: 4, Interesting

      According to consolidated financial statements and reports of the Tor Project for the year ending December 2012, US Federal agencies are responsible for nearly sixty percent of funds received by the project. Tor has taken a defensive stand against this, but who knows?

      Tor was created by the US Air Force. Surprise, surprise, they still want to fund it. Sooo, why did they create Tor? Well, as it turns out, we've got this massive high speed satellite and ground network we use for military purposes, which basically amounts to a compartmentalized version of the internet. And within that, because soldiers are away from home for months or years at a time, they decided to offer internet access to them. Often they're on board carriers, or deployed in places where a direct hookup isn't really feasible. And they want to make sure that all that traffic isn't pouring out at locations that can be easily monitored... because as much as operational security is drilled into soldiers, loose lips sink ships and all, they're still human. They can screw up.

      So they needed some way of giving them internet access without making it pathetically easy for foreign powers to simply tap a couple key routers and see everything any soldier browses (Facebook anyone?)... Enter Tor.

      Tor has over 13,000 exit nodes all over the world. And it's expensive to monitor every node. Not only that, but you have no idea where in the Tor network the traffic originated from -- is this J. Random Soldier, or Closet Gay Guy Looking At Porn? Noooobody knows. It wasn't meant to be high security. It's not meant to be totally anonymous; It's meant to make it difficult for small-time players like, say, Iran, to spy on our soldier's personal communications. Because this has happened, and it has killed people; A cell phone left on in a soldier's pocket during an operation led to the death of a half dozen marines when enemy combatants used the signal to figure out when they were leaving base... and they planned an ambush.

      So Tor will be funded by our government for the conceivable future, and they have a vested interest in maintaining the security of the network to the point that it would cost an adversary more to 'break' the network than the intelligence value of the soldiers' personal internet browsing.

      Does this worry me? Nope. Tin foil hat time? Not a chance. Don't use Tor for high value communications. But then... that goes for the public internet as well. If you want to secure high value communications, you build your own VPN, and then add code to have it transmit/receive at a constant rate to deter traffic analysis. Which, coincidentally, is what most financial institutions these days do.

      --
      #fuckbeta #iamslashdot #dicemustdie
    2. Re:Guess who is funding Tor? by ShawnA.Miller · · Score: 5, Informative

      Tor was not created by the Air Force. Initial work was funded by the Office of Naval Research via the Naval Research Laboratory. See: http://www.onion-router.net/History.html. You can also see a list of funders here: https://www.torproject.org/about/sponsors.html.en.

    3. Re:Guess who is funding Tor? by girlintraining · · Score: 2, Interesting

      "A cell phone left on in a soldier's pocket during an operation led to the death of a half dozen marines when enemy combatants used the signal to figure out when they were leaving base... and they planned an ambush."

      Citation?

      You won't find one. Another example; Stealth bombers are really great at being stealthy until they're over the target and open the bomb bay doors. Then they're as visible to radar as flying barns. Which is why usually, ahead of the actual strike, a HARM missile is deployed. It's not actually a missile though, but rather a high altitude bomb that, when released, deploys a parachute and sits over the target looking for active radar signatures. When it finds one, off goes the parachute and on comes GPS-guided death. Well, as it turns out, the frequencies used for radar are the same ones used by microwaves. A fork jammed into the security interlock, door removed, and microwave pointed upwards... looked exactly like a radar site. $10 microwave meets $50,000 bomb. And once the bomb has blown up your $10 microwave, you can flip on your actual radar sites, lock on to the stealth bombers, and shoot them down with relative ease. You won't be getting a citation for that either... partly because that er... problem... has been fixed with newer electronics, but mostly because stuff like that being on the internet really is a matter of national security.

      So no, no citation for you. But you can feel free to google for 'operational security' and 'cell phone', and note that every branch of the military has rules about this sort of thing. Those rules weren't created because of an abstract hypothetical... like most rules in the military, they were purchased with blood.

      --
      #fuckbeta #iamslashdot #dicemustdie
    4. Re:Guess who is funding Tor? by theskipper · · Score: 2

      An interesting rebuttal to the microwave oven anecdote, specifically during the Serbian war:

      http://msgboard.snopes.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=48;t=000208;p=0

  9. Re:Obama hates US Constitution by w1zz4 · · Score: 2

    A two party system with a third one being the official opposition right now... Yeah Right (Slow Clap).

  10. Re:Other than a few uber nerds by black3d · · Score: 5, Insightful

    What's this "have to hide" bullshit? What if you want to hide? A large percentage of the population are introverts, and a significant proportion of both those (among others) don't have any desire to share anything personal with anyone, at least aside from those they choose to. Some people like privacy, like anonymity, like not being seen by others. Hell - I get a serious case of anxiety if someone is merely standing behind me, no matter how innocuous my activities.

    Please, don't start with this "if you have nothing to hide, you have nothing to worry about" utter crap. The next step to that is "if you have anything to hide, you're probably a pedophile" which you're already alluding to. No, we just don't like oxygen-wasting cretins sticking their nose into our lives. Considering such a vast number of people value their privacy in exactly the same way, this behavior is *natural*.

    I make very little effort to hide my presence online. But if I did choose to, then by no means does anyone have any justification to suggest that there's something wrong with wanting to hide. It's part of the human condition - some people like being seen, being known, being pored over - some people prefer the exact opposite.

    You might suggest this is an over-reaction, that you're merely pointing out that the internet isn't for people who want to hide. But the point is, it should be. You should be directing your energies to fixing the problem - not just throwing your hands up and saying 'don't bother trying to hide even if you want to'.

    --
    "The true measure of a person is how they act when they know they won't get caught." - DSRilk
  11. duh by LodCrappo · · Score: 2

    1. Us government creates Tor.

    2. Us government can audit Tor traffic.

    Who exactly is surprised by this??

    --
    -Lod
  12. Re:well by goombah99 · · Score: 3, Interesting

    Just use bigger DH, with better cipher. AES-256? Maybe. Twofish? OK.

    Bruce Schneier himself advises avoiding elliptic-curve, as being intellectually tainted by the spooks.

    that's what they want you to think.

    --
    Some drink at the fountain of knowledge. Others just gargle.
  13. Re:Other than a few uber nerds by djdanlib · · Score: 5, Insightful

    Exactly. Some activities need to stay hidden. For example:

    * I don't want someone's Christmas gift to be spoiled for them.

    * My neighbors don't need to know how much my electric bill was, or what tier of service I have hooked up to that wireless router.

    * I have a very dedicated stalker, whose information is limited because that person can't dig into my email or other accounts to find out what I'm up to.

    * If I post on a forum for people who own a particular product, I don't need people to be able to find my house so they can steal it.

    * A friend who's hurting after a disastrous breakup might email me something in confidence. That should stay confidential.

    * Employment and tax documents, with pay grade information and SSNs and all kinds of other PII.

    * Online banking, anyone?

    * I may compose some music that isn't ready for release yet, and that needs to stay private until it's been polished.

    * Medical records about who has what rash on their what now?

    There's just some information that doesn't need to be free. No nefarious intent, just things that shouldn't be public.

  14. See what I did here? by Okian+Warrior · · Score: 2

    Sorry guys, Tor is designed to be used in all the ways we've spent years trying to fix broken internet protocols from doing, you really need to stop drooling over it. Its not actually a good solution. It is in fact an absolutely shitty solution to the problem, as its really a way to create a bunch of new ones.

    If you have to hide, the Internet isn't for you.

    It's a really good solution! It protects privacy, it's supported/maintained by really smart people who want to protect privacy, and (when using the most current version) gives the user strong privacy.

    I just made a whole lot of unsubstantiated claims with no explanation, no supporting evidence, and with no background... just like you did. (I didn't call people names, though.)

    Sheesh, gimme some Deep Woods Off! - The number of astroturfers on Slashdot is astounding.

    Who cares who else uses Tor? Who cares whether it creates protocol problems? Who cares whether pedophiles or botnets use the system?

    The important bit, the one that has value to *me*, is that it can hide my identity. It can hide the identity of people who are afraid of oppression, it can hide the identity of whistle blowers, it can hide the identity of people asking for help.

    Stop astroturfing - you're not particularly good at it.

  15. Re:Other than a few uber nerds by bmo · · Score: 3, Insightful

    "If you have to hide, the Internet isn't for you."
    "pedophiles and botnets"

    Are you cutting yourself with that edginess?

    You know what, I've yet to see anything worth reading coming from your keyboard and this is your crowning glory - associating people who want some privacy with pedophiles.

    Your opinions are worth less than the photons they have been written with.

    Ciao. Meet your new status.

    --
    BMO

  16. Re:Question: multi-layer encryption by sjames · · Score: 2

    Not necessarily. In many cases, double encrypting it will not make it at all harder to crack, it will just effectively encrypt it with a composite key no more complex than either of the keys you used.

  17. About Tor versions by ShawnA.Miller · · Score: 5, Informative

    The original blog post by Rob Graham that Arstechnica reports on has created some confusion about Tor versions. The current recommended stable version of Tor is 0.2.3.25-12. The current alpha release is Tor 0.2.4.17-rc, and people running relays are being encouraged to use this version on the mailing lists. So the repositories, by recommending Tor 0.2.3.x, aren't out of date. However, the Tor website does advise against using the Ubuntu repositories because they aren't "reliably updated" (https://www.torproject.org/docs/debian#ubuntu), which I don't think is the fault of Tor developers. Also, the most up to date version of Tor can be found at the following repository: deb http://deb.torproject.org/torproject.org/ tor-nightly-0.2.4.x-wheezy main.

  18. Re:Other than a few uber nerds by black3d · · Score: 2

    > Your anxiety issues can be treated, the Internet is not proper treatment,
    Firstly, who said my anxiety was anything to do with the internet? I never even mentioned a computer. Stop making up shit.

    > You use the Internet as a crutch. Man up and fucking go see a damn doctor and stop being such a coward.
    I said I don't make effort to hide my online activities. I'm not talking about myself. I'm respecting those who do want to maintain their privacy.

    > You were NEVER anonymous on the Internet, you have ALWAYS been logged, you just aren't smart enough to realize it.
    Huh? Of course I realize that. I've been building networks since before the net existed. I just posted yesterday in fact about the futility of trying to hide your information on the net - http://slashdot.org/comments.pl?sid=4173525&cid=44773011

    You're completely mis-understanding me. We're probably on the same page in a lot of respects. My issue isn't that you're suggesting that the internet isn't secure. My issue is that you make no distinction between people who "have to hide" and people who "want to hide".

    > I made no mention of that retarded 'nothing to hide nothing to fear' crap, you did.
    You did - as soon as you failed to make the above distinction, you treated people who want to hide but have nothing to fear as being in the same group as people who NEED to hide. For example, you said TOR is only really used by "uber nerds, pedophiles and bot nets".. So - anyone who uses TOR because they want to hide, who isn't an uber nerd or a bot is.. a pedophile?

    I'm simply pointing out that your argument basically strips down the internet population into - precisely - those who have nothing to hide and those who need to hide. Not only are the two not mutually exclusive, but it completely ignores the category that the majority of people fall into who want to keep their privacy - those who have nothing to hide but want to hide anyway.

    Your line of thinking is very near to treating anyone who uses encryption, or encrypted channels, or any means of trying to secure the communications, pre-emptively criminal. It's a line of thinking that needs to be stamped out whenever it's seen.

    --
    "The true measure of a person is how they act when they know they won't get caught." - DSRilk
  19. billion dollar terrorists, yeah by raymorris · · Score: 3, Insightful

    Yeah, actually if someone is bad enough to make the NSA's top 10 list, it'd probably be good for someone to be reading their email. I have a BIG problem with the fact that the NSA is tracking everyone's emails and phone calls. I've contacted my congressman about that more than once, calling them out very publicly.

    The top NSA agents know who the really bad guys are, the guys who will probably be involved in the next 9/11. Maybe they can't publicize the intelligence that proves it, maybe they are missing a few details, but we knew who bin Laden was. I'm fine with invading their privacy.

    But but but if they invade anyone's privacy, they'll invade everyone's privacy. If we let them, yes. Ideally what we want is systems, including budgets and oversight, which only allow them to spy on a few people, so they have to pick which ten people they really do need to spy on.

    1. Re:billion dollar terrorists, yeah by VortexCortex · · Score: 2

      The enemies these days are good at blending in.

      Too good if you ask me. In fact, the "enemies" now look just like passionately patriotic citizens who wish to protect their country's constitution, as they so swore.

      It makes you wonder who the real enemies are...

  20. that's my point by raymorris · · Score: 2

    That's my point. They won't spend any money tracking me. Well, not more than about $10-$50, since I'm pretty sure I'm on a list or two. They WILL spend money tracking whoever appears to be the next bin Ladin. Cool. I'd like them to be able to track bin Laden, while it's not anywhere near worth it to track me.

    If I were using "1 bit encryption" they WOULD break it. They proof of that is that they DO track people who use 0 bit (plain email, phone). That's bad. I prefer that everyone use encryption enough so NSA finds it worthwhile to track 0-100 people.

    Ps - I said I'm probably on a list. I've worked in security for many years, so my footprints can be found looking at information about exploits, etc. I run a system where we teach cybersecurity to state and local government employees, so I frequent sites that a bad guy might find interesting. On top of that, I use words like "freedom" and "Constitution" and we now know the Obama administration considers those words to be red flags.

  21. Re:well by Dahamma · · Score: 3, Informative

    He hasn't reversed himself from that link you cited - he was just pointing out an NSA recommendation, and was against it then, as well. See his comment to a poster further down:

    Bruce Schneier September 30, 2005 11:39 AM
    "'Elliptic Curve Cryptography provides greater security and more efficient performance than the first generation public key techniques'

    "But ECC was less researched than the others algorithms!"

    I agree with you, not the NSA.

  22. Translation: Don't scare me! by SmallFurryCreature · · Score: 2
    Translation of the above: Please don't tell me scary things, tell me everything is alright with lots of puppies and kittens who never ever die. Tell me a world of unicorns and rainbows so I can believe everything is alright and as it should be and I can excuse myself for not lifting a finger to improve the world.

    Allow me to rest my hand in the sand and then complain like a bitch when I am run over by a lorry. Because someone else should have been saving the world while I looked the other way.

    --

    MMO Quests are like orgasms:

    You may solo them, I prefer them in a group.

    1. Re:Translation: Don't scare me! by sharklasers · · Score: 2

      You don't need to use hyperbole. There's a lot of good in the world, but there's also a lot of bad. News sites have a predisposition to continually pump bad news, even though the NSA stuff is only one element in what's happening in the world. If people get their fix on tech news from sites such as Slashdot, and said sites fixate on all the shit that's happening, then of course people are going to become miserable. Because there's basically nothing we can do to stop it. We have no power.

      If you're arguing that it's better to know how the world works because it prevents being taken advantage of - it's good to be educated and informed. It's horrifying when you realize there's nothing you can do and it's only getting worse. Heck a single person has no real power to fight against stuff like this, and if they do, well... people like Snowden, Manning and Assange have their lives ruined for trying to do so - doesn't really motivate anyone into fighting against their respective Governments now does it.

      Snowden, Manning and Assange revealed information that shocked everyone. But those in power have all the money, weapons and blind support to ensure nothing changes.

      And that's the reason why knowing is something worse than not knowing.

  23. Re:Question: multi-layer encryption by malacandrian · · Score: 3, Informative

    Not only this, but applying different cryptography methods on top of each other may expose weaknesses in the system. IIRC Sony choosing to use "all the crypto" was one of the mistakes that allowed the PSN to be cracked,

  24. Re:Cryptography isn't the answer by BlueStrat · · Score: 2

    Stop being lazy and fix the underlying problem.

    Are you seriously suggesting we try to occupy the US and liberate it from its government?

    Just assist and support the people in the US who are trying to curtail the out-of-control US government whenever and however you can with whatever can help.

    The US government has been steadily growing and hardening itself against control by the citizenry and expanding its' scope & power beyond constitutional limits for ~100 years. It won't be overcome by a change simply between (D) & (R). The pendulum must swing back toward constitutional first-principles and a government that is small enough, and local enough, to be controllable by the citizens.

    The American people, on the whole, have a long history of being basically good, relatively peaceful, and generous people. The US government, on the other hand, has grown far too large & powerful and has long ago lost any legitimate claim to actually represent the will or the character, spirit, or beliefs of it's citizens.

    From a friendly/neutral foreign perspective, it would be far more beneficial internationally for the smaller-government crowd in the US to prevail, as a smaller, less-powerful US Federal government that is more open and accountable to its' citizens and has more effective oversight would sharply curtail the international bullying and "dirty games & tricks" the US government has been playing, and increasingly plays, against even those the US government call "allies" and their peoples & interests.

    Strat

    --
    Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
  25. Re:well by Anonymous Coward · · Score: 5, Informative

    We certainly need more research, but it looks like an RC4 complete break (that would be the big, recent breakthrough - would love to see the details, now we know about it) and 1024-bit RSA keys are the meat and potatoes of BULLRUN. And since PCI Compliance for a while advised everyone to use RC4 as a workaround to the BEAST attack... yeah. NSA. Bastards.

    They set the constants for all of the NIST curves, however. And if they have a SHA-1 preimage (and it's their algorithm they no longer even recommend, so they might) then they could set them any way they wanted. Or just try repeated phrases until they got bit patterns they were after. prime256v1/secp256r1 and all that jazz? We can't trust them anymore. They're NSA-derived - and the way it turns out they've been behaving, we therefore assume that they ARE backdoored, even if they use them themselves.

    The curve Tor uses is curve25519. That is not NIST-derived, NSA didn't pick parameters out of a hat for that one: DJB made it independently. It's been designed, and the reasons for the choices thoroughly explained. It's extremely fast due to its structure, it's good even through the twist, the implementation is so careful that it's constant-time to avoid timing attacks, and we have a rough idea how strong it probably is (around 2^110-ish). Ed25519 is also similarly good and makes a great signature scheme (and you could do DH with it better as well), although you probably don't want to use SHA-512 with it anymore, because NSA - Skein-512-512 is probably the way to go. I don't trust NIST's choices anymore. They are ALL NSA, and thus ALL potentially-tainted.

    Unless elliptic curves in general are crackable, which would be quite a wheeze, and of course a possibility. Certicom (NSA) have been doing those for a long time: but the 25519 curves are the product entirely of civilian mathematical research, at least. For now, Schneier is spooked and notes RSA still works fine, if slowly, and maybe bigger keys... 3072-bit? 4096-bit? Against an adversary like this - and it's clear that they consider EVERYONE an adversary - we need the margin.

    I note DSA and ECDSA really need strong random numbers for every signature (see fail0verflow's Sony crack for a practical exploit), and GCM fails quicker than it should with non-random keys. Reasonable conclusion: subtle RNG backdoors. We should keep a special look-out for those. Other choices exist which aren't similarly affected (particularly, Ed25519 does not need random numbers per-signature, neither does RSA, although RSA blinding does).

    What next? AES-128-CCM use in TLS, perhaps, or OCB-AES-128? (Note I'm specifically NOT recommending AES-256/192 because of the meet-in-the-middle attack - I'd rather move to TWOFISH-256.) Ed25519 DH in TLS? All commercial CAs are toast, the model has been so thoroughly subverted that it can't possibly continue to work. What about DNSSEC? Could do the job. But we can't trust the US to manage the internet anymore. We're meeting in November to see what we have to do: maybe if we remake it used good RSA or Ed25519 keys and take the hands of the root out of ICANN, because ICANN is the US and the US has spectacularly demonstrated it cannot be trusted to manage anything, probably no country can... which means, perhaps, it's time to dig the root KSK revocation key out of mothballs: if there's no trust, there's no point. We're going to need a treaty, a .INT. This isn't a quick-fix.

  26. Schneiers most recent comment.... by ssimpson · · Score: 4, Informative

    Bruce Schneier http://www.wired.com/opinion/2013/09/black-budget-what-exactly-are-the-nsas-cryptanalytic-capabilities/ stated that "Breakthroughs in factoring have occurred regularly over the past several decades, allowing us to break ever-larger public keys. Much of the public-key cryptography we use today involves elliptic curves, something that is even more ripe for mathematical breakthroughs. It is not unreasonable to assume that the NSA has some techniques in this area that we in the academic world do not. Certainly the fact that the NSA is pushing elliptic-curve cryptography is some indication that it can break them more easily."

    I'd not rush from DH to ECC but would strongly recommend a move to 2048-bit or above keys

    And have just realised that I haven't posted to Slashdot for many years...And yet somehow my .sig is still relevant. NSA may have dropped their plans for mandatory Escrow 15 years ago after the quote was made...but they didn't change the fundamental goal: to read everything.

    --
    "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
  27. Re:well by wonkey_monkey · · Score: 2

    that's what they want you to think.

    That's what they want you to think.

    --
    systemd is Roko's Basilisk.
  28. Re:specifically, HASHING multiple times weakens it by Qzukk · · Score: 2

    I thought this meant the encryption is applied 5000 times:

    People choose crappy passwords like ABCDE so rather than using "ABCDE" as the encryption key (which wouldn't look very random at all and therefore be very bad) for encrypting the content, the password is hashed to something that hopefully looks random, then that hash is used as the key for encryption.

    The purpose of repeating that hashing process is to slow down brute force guessing against your password itself, not to protect the contents from cryptanalysis or against brute forcing all the possible hashes directly. If I want to see if your password is AAAAA, I have to repeat the algorithm 5000 times to see if the resulting hash can be used to decrypt the contents. If I don't care what your password is, I could just guess hashes starting with 0x1 to 0xFFF.... The reason attackers put up with the 5000 rounds of hashing is that even if it takes a second to calculate each password's hash, they'd still guess "ABCDE" before they guess which of the 2^x possible keys it produced.

    --
    If I have been able to see further than others, it is because I bought a pair of binoculars.
  29. Re:well by marcosdumay · · Score: 2

    He said exactly that some ECC curves have suspicious origins, and one shouldn't trust them. What he didn't say is that all of ECC is suspicious, or that he knows anything with certainty.

    Anyway, it's easier to use RSA with a larger key than to investigate each ECC curve you are thinking about using. But that's just my opinion.

    --
    Rethinking email
  30. Re:well by bluegutang · · Score: 2

    I recommend a "zero time pad" : if you want it secret, don't put it on a computer.

    That's equally vulnerable to the $5 wrench decryption method.