Slashdot Mirror
UK Cryptographers Call For UK and US To Out Weakened Products
Trailrunner7 writes "A group of cryptographers in the UK has published a letter that calls on authorities in that country and the United States to conduct an investigation to determine which security products, protocols and standards have been deliberately weakened by the countries' intelligence services. The letter, signed by a number of researchers from the University of Bristol and other universities, said that the NSA and British GCHQ 'have been acting against the interests of the public that they are meant to serve.' The appeal comes a couple of weeks after leaked documents from the NSA and its UK counterpart, Government Communications Headquarters, showed that the two agencies have been collaborating on projects that give them the ability to subvert encryption protocols and also have been working with unnamed security vendors to insert backdoors into hardware and software products."
Let's start with these as they are of great importance and often fall behind with updates.
Google search:
cisco routers backdoor
cisco routers rootkit
yeah,right.... they're going to give up the gold just like that!...
Does anyone really expect these criminal organizations, headed by the kind of people who set up a Star Trek style command bridge, are going to do the right thing? The only way to deal with these scum is to shut them down and start from scratch.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I suspect the agencies will make a great show of reluctance, then reveal what they did to some protocols and algorithms -- those where the backdoors are most likely to be noticed, or have already been found, such as Dual_EC_DRBG. The crown jewels, those least likely to be noticed, will remain secret. Nothing to see here folks, move along.
NSA and GCHG couldn't care less about the public interest. They have a mandate to spy on as much as possible on the off chance that it may prevent some terrorist act. They will continue to do so in any way they can unless the legislative bodies or courts in their respective nations rein them in. This seems moderately likely in the US, quite unlikely in the UK.
I can see the marketing now. Add a sticker to your product NOW WITH NSA/MI6 approved Backdoors.
yeah man and what of firmware downloads for a bunch of the hardware like bios, game cards, cdrom drives and stuff how many times man have you seen a gpg signature how many times man have you seen checksums to go along with it tell me man how we arent fucked on a daily basis by all of this proprietary hardware and software?
the bullshit on windows systems never ceases to fascinate me:
INSTALL this bullshit program with no available source code and we promise it will work as advertised.
(goodfellas voice over) you want more options? fuck you - pay me. you want faster updates? fuck you - pay me.
I cant decide if this is for real or just a conspiracy theory! If it is real, our privacy is gone. No secrets. Everything is accesible to the agencies. SMNadim Anonymous Web Surfing
GSM standard was weakened from 128 to 64, at the time at an explicit NSA request during the standard creation.
Even the NSA themselves talk about strenghtening the security of a GSM signal:
http://www.nsa.gov/ia/_files/Mobility_Capability_Pkg_Vers_1_2.pdf
conduct an investigation to determine which security products, protocols and standards have been deliberately weakened by the countries' intelligence services
I couldn't care less which are the ones that were weakened deliberately or by honest mistake. I'd feel much better if I'd know which algos/constants are still safe and/or what can be done with the algos/constant-sets that are under doubt.
Also, a simpler alternative to an unnecessary complicated IPSEC spec would be good (on the line of "as simple as possible, but no simpler") - though I expect this would be an engineering job rather than a pure crypto one.
Questions raise, answers kill. Raise questions to stay alive.
Let me get this straight. The point of the NSA and the GCHQ is to gather intelligence. This involves collecting information. If information is encrypted then surely they would want to circumvent such encryption to access the information. The fact that they already have been doing that shows that they are fulfilling their role as intelligence gatherers.
I dislike the whole good guy bad guy theme, but if the bad guys are using encryption then wouldn't you want your intelligence gathering agencies to be able to circumvent it?
A group of cryptographers
I believe the correct term is a crib.
systemd is Roko's Basilisk.
I do miss my childhood days being shown a movie on how to survive the impending apocalypse by hiding under the desk. A certain warm and comfy feeling that i haven't felt since Regan. I keep hoping the new world with terrorism coming from every direction will bring that feeling back. I suppose it wont happen till the terrorist get nukes they can deploy.
One day i dream of the cold war again, if only putin would just hurry up already.
You left off your signature. I'll add it:
Signed - Head of NSA/Head of GCHQ
After WWII German enigma & lorenz machines were being sold to other nations as uncrackable. It was the forerunner to GCHQ, Bletchley Park which cracked them during the war and then buried all evidence of it.
ackcray isthay ouyay insensitiveway odclay!
if there is one brand of router that has been compromised, it's Cisco. why? simple, they are super popular and the NSA doesn't play nice. Cisco owns Linksys, so a huge amount of routers in people's homes have a backdoor just waiting to be used.
Anons need not reply. Questions end with a question mark.
Did you ever thought of asking a burglar what he has taken from your house? and trusting his answer?
250 mil per year buys you a lot of backdoors.
Many moons ago I used to work for Kronos. They do time tracking. The had a biometric meter that read the dimensions of the hand. It was pretty stupid in many ways. If you had a ring on during the registration you would have to wear it each time. It also required a code before you put your hand on it? How is it a hand reader if you need a code? Anyways, the workers did not want to use the device. Some people were kind enough to tell me that using your hand was the sign of the beast. Lucky for me that I am not superstitious.
I get why the don't like it. It is bad enough to direct your body every morning into a place to do repetitive tasks, but now you need to use your body to punch in. When do I get my ear tag?
Here, this is for you: try to translate it from the Dutch:
Herman van Veen - De Bom Valt Nooit (single) - 1983
warning: lyrics contain sarcasm
"A group of cryptographers in the UK has published a letter that calls on authorities in that country and the United States to conduct an investigation to determine which security products, protocols and standards have been deliberately weakened by the countries' intelligence services
You seriously think this plan will work ?
I'm afraid not.
It's as if there is still conscience left in the governments of the two countries.
If there was any conscience to start with, the government wouldn't have allowed their spooks to spy on their own people, in the first place.
It's also like asking a thief to confess to which items he has stolen.
It's like trusting the th
Muchas Gracias, Señor Edward Snowden !
The cryptographer doth protest too much.
PGP released mid 90's was pulled back and off the Internet for 6+ mo. Then re-launched with a wink and a nod for general consumption.
...when you factor in the chinese backdoor that are here too, it's starting to be a bid crowded inside.
BTW: Speaking of China, maybe that's where to start asking question -
The UK cryptographer should ask the FSB and MSS to out products which got weakened by UK and US.
Very probably the russian and the chinese have knowledge about them too (In theory FSB and MSS are also intelligence agencies, so they should have done they own investigation and perhaps uncovered a few while doing their own security assessment. In practice they probably met a few backdoors while busy trying to plant their own), and unlike the UK and US they don't need to try hiding from public disgrace by trying to keep secretly these specific weakening.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
What makes you think non-proprietary routers or routers that come with source code aren't backdoored?
To each problems it own tool.
Planting backdoors (i.e.: definitely malicious code) is easier in a definitely closed environment, were very few people can see the code, and the one which understand it can easily by hushed by orders of top management.
In opensource software, that is a little bit more complicated, because the code is open and a lot more people are reading it. Hidden malicious stuff will get discovered eventually. The only variation is the amount of time until discovery. And again all it takes is one single developper poking in the wrong corner (because he/she hit a bizarre bug - side effect from your backdoor) to discover it and very likely he'll be out of reach (geography/jurisdiction) to be prevented from speaking about it and embarrassing the NSA. So this specific way (planting backdoors) won't necessarily be optimal.
Better aim for other better suited solutions in this case:
- exploitable bugs/botched code/and erroneous implementation, leaking information. If it looks like bugs, less change for the whole operation to be blown up if discovered. (buggy key generator as an example in Debian. Could be negligence. Could be an inside job).
- bugged hardware. hardware random number generator for example. Something as simple as a counter whose output is encrypted, would look genuinely random, but for someone knowing the encryption password, is completely trivial to abuse. (And an encryption stage would make sense in a genuine RNG, as a way to erase out any non randomness in the output. So no surprise if there is a AES-like stage in the RNG of a CPU. Simply, the data fed into it isn't the electrical noise generated by heat (as designed by the engineer), but a simple counter (discretely replaced by an anonymous employee at the maker, somewhere on the line between the engineer and the fab).
- limited ressource: randomness is hard to obtain, specially in embed devices like routers. There might not be enough accumulated entropy by the time the SSH keys need to be generated during the first boot of a home router. And thus the keys to the router could be quite easily predicted.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It is naive to believe that "the authorities" would conduct any kind of real investigation and release any real information on back doors. This is the proverbial fox guarding the hen house problem.
It would be much more effective to has a "backleaks" type web site where the programmers and managers who are aware of these back doors could silently post about compromised software. Then, the accused software could be investigated (easier if open source).
There are probably many people who know about compromised software... we just need a way for them to clear their conscience.
I don't read your sig. Why are you reading mine?
The NSA has an interest in strong encryption as much as they do in subverting encryption. Take as an example the work they did with (read "for") IBM on DES.
"It took the academic community two decades to figure out that the NSA 'tweaks' actually improved the security of DES." -Bruce Schneier
http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design
Al queda, etc. aren't that tech savvy, compared to, say, the DoD. To the extent they communicate electronically, they're doing so via "off the shelf" civilian-accessible means. NSA and GCHQ aren't stupid. they haven't compromised garden variety technologies to the point they're vulnerable to garden variety criminals. No nerd with a Beowulf cluster will crack it. That said, the spooks aren't slumming with Beowulf clusters either. And they're not going to do anything to enhance the security of such civilian technologies beyond what they themselves can penetrate.