Slashdot Mirror
John Gilmore Analyzes NSA Obstruction of Crypto In IPSEC
New submitter anwyn writes "In a recent article posted on the cryptography mailing list, long time civil libertarian and free software entrepreneur John Gilmore
has analyzed possible NSA obstruction of cryptography in IPSEC. He suggests that packet processing in the Linux kernel had been obstructed by one kernel developer. Gilmore suggests that the NSA has been plotting against strong cryptography on mobile phones."
This post needs repeating.
+=+begin paste+=+
The destruction of trust (Score:5, Insightful)
by Arrogant-Bastard (141720) on 7:08 Friday 06 September 2013 (#44773249)
The worst part of the damage done by this isn't technical. It's human.
The reporting on this latest disclosure reveals that the NSA has systematically inserted itself into the standard-crafting process, in order to deliberately weaken those standards. It also reveals that the NSA has bypassed the management of communications providers and recruited technical staff directly. In both cases it's reasonable to assume that the people involved have been through a security clearance process and are thus barred for life from disclosing what they know.
I must now ask myself how many people I've worked with weren't doing so in good faith. When they argued that such-and-such a fine point of a network protocol standard didn't need improvement or that it should be changed in a certain way, were they doing so because it was their principled engineering opinion, or because it served some other purpose? Or when they were recommending that one of the many operations I've run move its colocation point or change its router hardware, was that good customer service, or was it to facilitate easier traffic capture?
Will anyone be asking themselves the same questions about me? (They probably should.)
The Internet was built on, and runs on, trust. Every postmaster, every network engineer, every webmaster, every system admin, every hostmaster, everyone crafting standards, everyone writing code, trusts that everyone else -- no matter how vehemently they disagree on a technical point -- is acting in good faith. The NSA, in its enormous arrogance, has single-handedly destroyed much of that trust overnight.
+=+end paste+=+
--
BMO
"In all seriousness, how should the technical and geek community deal with this sort of sabotage?"
Identify who is doing the sabotaging and shun them. Professionally shun them. Expel such people from committees.
--
BMO
Read all (4 pages) of chapter 13 basically, but in this case perhaps specifically;
"Spies cannot be usefully employed without a certain intuitive sagacity. Before using spies we must assure ourselves as to their integrity of character and the extent of their experience and skill."
"Without subtle ingenuity of mind, one cannot make certain of the truth of their reports."
"Kill 'em all and let Root sort 'em out"
This! Yes! I was hoping someone would say this. Yes, this is [part of] what needs to happen.
The great thing about this is that you wind up kicking out the incompetents simultaneously.
Someone who is shit at maintaining a security module? NSA hack or incompetent, doesn't matter. Find someone else to do it.
--
BMO
From whose point of view?
First of all, this is a substantial claim that requires substantial evidence. You may think standards are "needlessly complicated", but each of those complexities had a use-case behind it and was discussed among experts who concluded it's a good idea to do it that way. I don't deny NSA can subtly influence the standardization process, but surely it can't be all a grand conspiracy to make standards useless, I much rather believe the issue they are dealing with is very complex and lacking sufficient geniuses the standardization group created a complex solution, with or without NSA's assistance.
Secondly, this sounds too much of an 80's cipherpunk wet dream, "if only everything was encrypted... but the government won't let us". Practical encryption is a very hard problem. Key distribution is hard. Interoperable, secure and non-patented implementations are hard. It's not simply about flipping a switch, changing a standard and everything is all of a sudden encrypted with 1 gazillion bit encryption; secure communication requires significant changes up and including the user's level who must change his behavior. And IPSEC with all it's complexity does very little to address those far reaching problems.
WE can cause them to completely fail. How? Make this like SETI, or the RC4 competition, in reverse!
They find needles in haystacks. Our job is MORE, BIGGER HAYSTACKS!
Create more crypto-garbage for them to sift. Expensive to crack and useless, when decrypted. Start by upgrading to Tor 2.4, and running a non-exit-node relay.
Add your own ideas. We can chaff the net with more problems than they can manage, even with their stadiums full of Xeons!
"Flyin' in just a sweet place,
Never been known to fail..."
Indeed. IPsec is a terrible, terrible mess. I always wondered how the IETF could mess up so badly when doing reasonable work otherwise. Now I know, intentional sabotage of critical infrastructure by the NSA is to blame.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Seems like another witch hunt to me. Good ol' McCarthy would have been proud.
Instead of searching for culprits, get the community to examine the compromised code and improve it.
If you think the whole community is in the hands of the NSA then we've already lost.
You/we need to do both. Fixing the compromised code without finding and removing the culprit(s) is a short term solution at best. The unknown culprit would be free to compromise other code repeatedly, unless they are outed to the community at large.
For a permanent solution, the mole MUST be found.
"City hall" in German is "Rathaus" Kinda explains a few things......
The problem is, that openVPN is also backdoored.
Please supply us with some evidence or a link to something to support your assertion.
Who wants an empire? I don't.
Who are we at war with? No one that matters as far as I know. Farm animals kill more Americans than terrorists.
Go watch more movies, jackass.
Within the context of war and empire, I'm afraid it is the right thing to do.
Then "war and empire" are the wrong things to pursue.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Sabotage and incompetence look the same.
Either should not be tolerated.
"Any advanced incompetence is indistinguishable from malice."
Me, butchering a quote from Arthur C. Clarke.
--
BMO
If NSA has a backdoor to anything, it simply allows for a backdoor to everybody. It is not like the backdoor would be wired to an NSA IP address. Ultimately it creates a disservice for the country.