Slashdot Mirror
Silent Circle Moving Away From NIST Cipher Suites After NSA Revelations
Trailrunner7 writes "The first major domino to fall in the crypto world after the NSA leaks by Edward Snowden began was the decision by Lavabit, a secure email provider, to shut down in August rather than comply with a government order. Shortly thereafter, Silent Circle, another provider of secure email and other services, said it was discontinuing its Silent Mail offering, as well. Now, Silent Circle is going a step further, saying that it plans to replace the NIST-related cipher suites in its products with independently designed ones, not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades. Jon Callas, one of the founders of Silent Circle and a respected cryptographer, said Monday that the company has been watching all of the developments and revelations coming out of the NSA leaks and has come to the decision that it's in the best interest of the company and its customers to replace the AES cipher and the SHA-2 hash function and give customers other options. Those options, Callas said, will include non-NIST ciphers such as Twofish and Skein."
mathematics depts are interesting things...
I personally trust in s box's
regards
John Jones
Or is it the case that NIST has a branch in the Belgium?
Ezekiel 23:20
IMHO at this point we have to assume the hardware is compromised at some level. Not necessarily a backdoor but the hardware random number generator might not be that random.
Only the State obtains its revenue by coercion. - Murray Rothbard
This is actuallly good. Crypto should be flexible enough to switch to different algorithms.
AES is just an option, and I'd say it's a fine one, but it's cool to get some extra algos some breathing
room.
I trust the Chinese have already done that to every processor built for export. They'd be negligent if they haven't.
While I think that NIST related crypto algorithms are probably well compromised by the NSA I suspect that there is probably not much of anything - certainly nothing on the open market - that the NSA would not already have cracked anyway.
Same thing for 'offshore data havens'. If it's visible it gives the NSA a target of interest and the fact that it's offshore isn't even going to slow them down when they attack it. People moving to such havens might find themselves being looked at all the more closely than someone keeping their data in less interesting places.
I think the best bet of keeping your info private (from the NSA) is going to be to avoid attracting attention to start with.
blindly antisocialist = antisocial
So Jon Callas, in his blog post goes about the stupidity of the meta-ramblings about DUAL_EC_DRBG which nobody except the NSA is using, the theoretical weakness of elliptic curve crypto... and therefore replace AES, which doesn't have anything to do with DUAL_EC_DRBG or elliptic curve crypto?
Oh, yeah, they are replacing the proofed AES (as Scheier would say, trust math) and SHA-2 with Skein and maybe Threefish. Thank god he wrote "Full disclosure: I’m a co-author of Skein and Threefish", because now its clear why they are doing this. Seriously, these silent circle guys now how to make PR stunts, like having ex NAVY seals possibly compressing the bits individually for you with macho muscle (facepalm).
Or stupidity. One of the two.
Why use algorithms that are standardized on by the federal government and have been looked at exhaustively by experts around the world when you can use an untested crypto system? After all I'm sure the NSA wants to ensure that bad guys have access to everything the government is encrypting by first weakening the encryption standard, then standardizing the US government on the use of them.
I highly doubt that Vincent Rijmen and Joan Daemen themselves were influenced by the NSA in any way in the design of Rijndael, unless you believe that they influenced all the AES entrants, including Ronald Rivest (RC6) and Bruce Schneier (Twofish). I think the only influence the NSA might have had was in perhaps influencing the NIST selection process that chose Rijndael as the Advanced Encryption Standard. And in the thirteen years since it was thus chosen it has been scrutinised more thoroughly than any algorithm by the best cryptographers in the world, and well, none of the open researchers anyway have found an attack on the cipher capable of breaking it significantly. The NSA might have, but then they approved the cipher for encrypting US government classified documents (a blessing that the NSA notably did not give the original Data Encryption Standard), so I'd consider it highly unlikely that they would have done that. The risk would be too great that their method of breaking the cipher have been obtained by espionage or independently discovered by some other intelligence agency's cryptanalysts. The NSA may be evil, but no one has ever accused them of stupidity.
Given that the best cryptanalysts of the world have had thirteen years to look at it and it remains solid, I'd trust it better than the other AES candidates which have had much less scrutiny, or worse yet, a newly designed cipher that no one who knows anything has bothered to even try analysing.
The other thing is that AES is incredibly efficient even on 8-bit microcontrollers. Around the time the AES contest was ongoing, I implemented Serpent, Twofish, and Rijndael on an 8051-series microcontroller, and Rijndael was consistently the best performing cipher, so I used it in the project, and wasn't surprised to learn that it eventually got selected.
Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre.
NIST has in many instances blocked independent investigations into 9/11, as well as lied about its own findings and devised unscientific explanations for the controlled demolitions of WTC 7 and the Twin Towers.
AE911truth
You know, this is probably the first time in the history of 9/11 whackjob posts on Slashdot that the reply is actually relevant to the story. Because they have nearly identical basis in reality.
...not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development...
Really? So they are worried about NSA's influence on NIST, but they still trust NIST???
What a terrible cipher, nobody uses for a reason.
Please move to the most obscure and unreviewed encryption algorithms that you can, and do it as fast as possible. By no means should you ever use the exact same encryption standards that are approved for use for securing the big-bad-evil U.S. government's own top-secret data. Remember, the only cryptographic systems with any flaws are the ones that were developed by non-US citizens and reviewed in a public process that might have tangentially involved the NSA. Oh, and nobody, we mean nobody, else could ever weaken or backdoor a cryptographic algorithm. ... uh .. I mean "anti-government hippy commune"
-- Your friends at the NSA
AntiFA: An abbreviation for Anti First Amendment.
The least I would have expected from the documents about the extensive spying done by NSA was a generalized weakening of cryptography.
While it is true that some algorithms might have been deliberately weakened by the NSA, I doubt this could have been systematic; especially for those which are best investigated by the cryptological community at large.
In particular, NIST mandated cipher suites while definitely amenable to some theoretical attacks in some cases, have been independently investigated and, as of today, no effective practical attack is known against AES. I would never trust a 'homemade' algorithm for anything, nor waste time to try and analyse it (cryptography is actually part of my job) unless there were some really compelling reasons for doing so (e.g. interesting mathematics, peer review requests or unusual attack models being considered).
Skein and twofish are definitely interesting algorithms, and they have also been well regarded in the competitions leading to SHA3 and AES; they are definitely not a bad choice, but to choose them because whatever has been selected by NIST is "tainted" by NSE (and not other architectural or practical considerations) resembles more a form of superstition than anything else.
Even a broken conspiracy is right twice an epoch.
"I opened my eyes, and everything went dark again"
Oh look the NSA astroturf squad has arrived.
For the record the US government uses the NIST cryptographic transformations as recommended by its own NSA so on a global scale of one to broken they can't be that bad. So for generalist every day encryption they should be fine, if your trying to hide something that might have some sort of national security implications then if your legitimately in possession / generating that kind of information then there will be a different set of protocols and standards to follow. People would shit their pants if the world suddenly turned to using ad-hoc unreviewed transformations because at that point all bets are off, no seriously, all bets are off. Cheers
if provider of whatever solution you've bought has received a secret order from a secret court authorizing/demanding the installation of key-grabbbing malware or an equivalent exploit. (Which is my out-of-my-ass speculation what Ladar Levison was provided with.)
And I seriously doubt the NSA gives a damn whether the government is using an ultimately unsecure encryption *so long as* the NSA are the only ones in possession of the knowledge and/or means to execute the exploit. They *do* care about encryption the government uses being technically and practically unbreakable by others, and they would care if encryption out in the wild is technically or practically unbreakable when used by others they're interested in.
What's really silly about this story, is the Silent Circle context. No service like that, no matter how well-intentioned or what crypto algorithms they use, can ever possibly be trustworthy. If someone points a gun at their heads and tells them to further leak the passphrase that you already deliberately leak (with the hope that the leak is limited) every time you use their service, then they're going to get your key, and you aren't going to know about it.
If there's one group of people who I think we can all confidently totally ignore on the subject of AES-vs-twofish-vs-whatever, it's people who work at snake oil companies like Silent Circle, Lavabit, Hushmail, etc. I feel like a shithead for saying that, because I know some smarter-than-me people work at Silent Circle, but .. something happened to those people, for them to be offering such ridiculous services, services that these people knew couldn't ever be trusted by anyone, before they wrote the first line of code. WTF.
I guess that their intent is to surf on the NSA conspiracy bandwagon, to create the buzz and to attract more customers. Bad taste buzz, but only money is driving the business, isn't it?
The following reference is obligatory tmo:
http://xkcd.com/538/
As security experts, suggesting that using another cipher suite would protect the customers from the NSA is either ridicule or ignorant of NSA's actual powers at best. Again, I've no clue of what these powers could be, but suggesting that they could break into secure systems by brute-forcing or cryptanalysing AES / SHA-2 does not make sense. Doing so would cost an overwhelming amount of energy, even for the NSA, when actually much much cheaper and conventional methods exist, like tapping into back-end systems (often with agreement from operators themselves), installing key logger into end user devices, etc. They certainly control some botnets, and maybe even some underground websites. Knowing that most users uses the same password over several websites, it's really a child game to penetrate systems for an organisation like the NSA. The NSA do not need to guess your secrets, they simply read it over your back.
If Silent Circles feel like doing something, what about playing the card of full transparency and proving to the community that they are indeed beyond any doubts? That would at least have the merit to elevate the current level of discussions and not to throw away the work of dozens if not hundreds of people around the world trying to bring real open peer-reviewed security.
And some of those documents *shouldn't* be readable by the NSA, yet they are because the NSA messed with the cryptography.
Ignore the leaks at your peril, NIST algo's *are* compromised, we know that already. It may be that NSA thinks it is the only one that can decrypt them, e.g. substituting a random number generator for the pseudo random output of an encryption to which they know the private key. BUT, if that key is broken then everything based on it is also broken.
So they ARE apparently arrogant enough to do something stupid, (well apart from denying mass surveillance even as you're building your 5th big data center).
"not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades"
So in other words it distrusts NIST.
If they cascade the one the US recommends wiht the one China recommends with the one Russia recommends, it seems you're safe unless all thre of those governments are conspiring against you. And if that's the case you problably have bigger problems.
Brute-forcing or otherwise cracking the various algorithms is all well and good. However, I believe the reality is that the NSA (and others) have more success by using other means, combined with metadata. I'm am not sure what the other means are, but could include social engineering, keylogging, reading clues communicated in the clear, false certificates, MITM.
They vacuum up all data, encrypted or not, to be decrypted at leisure, when indicated by the metadata. But the underlying encryption is still (mostly) secure.
Prove anything by multiplying Huge Number times Tiny Number
It would be nice to hear from this crowd what they think of this platform: Blib: https://register.blib.us/
Seems to use https to encrypt data. Allows self-hosting. Still in pre-alpha it seems.
what about Zuckerbooger`s secret pact with the akamai founder? would they both be considered "co-conspiritors", "co-defendants", or was Zuckerbooger juST THE BOOGEYMAN STOOGE!
"gosh darn it, Marx was left behind, without the bill of lading, and without Franx Xinatra`s laundered binliner!" El-idiot Spitzer-Ness
WIth a billion cores of custom silicon, you can speed it up even more.
You are being MICROattacked, from various angles, in a SOFT manner.
I think crypto agility is generally an awesome thing all our encryptions should have ability to swap out algorithms at a moments notice with meaningful process to mutually agree to strong acceptable algorithms.
It is also a double edged sword as practically it means if any of algorithms you trust are compromised AND both parties are still willing to use the algorithm an attacker can normally steer parties to use it.
One thing I never really understood is if your afraid of subversion why not simply chain a series of different algorithms together such that compromise of one could not result in recovery of plaintext? The only downside I can think of you might need a bigger key so jacking input bits of one algorithm does not cascade to the others or otherwise reduce effective entropy of each input.
not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades.
If "executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades" then "the company distrusts NIST".
9/11 was a low tech attack that was based on human engineering. That is what makes it so scary.
Undetectable Steganography? Yep, there's an app fo
Adding more cryptosystems doesn't automatically translate into greater security, as double DES showed.
Truthers make me lol
The NSA has figured out that the crypto isn't the weak point no matter what algorythm is used. Change it all you want, it makes no difference.
What about double ROT13? So stealthy you don't even notice.
Sorry to hash the joke, but that's double ROT128. Unless, of course you're using a 16-bit or 32 bit character.
I think we've pushed this "anyone can grow up to be president" thing too far.
here we are, 12 years after the WTC demolition,
the "scientific" organisation meant to have analysed the data flip-flopped. NIST flipflopped. /.
This article has NIST in it`s title, and throughout my humble reading, I have only twice or thrice seen "NIST" in print. First time (and most impressive), was their flipflopping about the 9/11 investigation, and second time (although slightly less-than-or-equal-to the first flipflop), here on
In the 2 hours or so since i saw the "9/11 whackjob" comment, I read half of the comments about meaningless faux-encryption, spending a great deal of time trying to find other comments related to the 9/11 inside job.
NIST (and soooo many diversionary commentators/commentatrices) have lost ALL CREDIBILITY. Now go fetch my quantum keyless-entry keychain, i gotta hit the information superhighway!
But it will certainly not lead to less security. Imagine you could decipher one of those encryptions easily. You still have the other ones to protect the data. All of those transformations are reversible, and they are applied one after the other. It is also much less likely that completely independent encryption schemes (that are supposed to be secure by themselves) have the same vulnerability as 2DES. Remember that the goal of 2/3DES was to increase key size (to protect against brute force attacks), not to eliminate potential holes in the standard.
"if they want to exchange..." Keyword: If.
You are being MICROattacked, from various angles, in a SOFT manner.
What - you think that encrypting with AES and then (say) TwoFish would give you the plaintext back?
Duh. If DES has a backdoor then so does double DES. If AES has a backdoor and TwoFish doesn't then AES + TwoFish doesn't have a backdoor.
If AES has a backdoor and TwoFish doesn't then AES + TwoFish doesn't have a backdoor.
Errr... you must have meant:
If AES has a backdoor and TwoFish doesn't then AES + TwoFish does have a backdoor.
Don't worry I've had much more embarrassing does/doesn't mistakes like *Mongo does like gay sex* X(
Actually yes for some value of plaintext. The problem is you wouldn't know exactly which plaintext(s) in advance or for what level of brute force.
You would be out fishing for strawberries on a daytrip to lala-land in order to visit the licorice unicorns living in your GPU :)
You also wouldn't know how much weaker all the other soon-to-be-plaintexts are because you've created an "ATwoEFishS" pseudo-encryption with completely unknown aggregate values and traits that next to nobody has had a look at as well as including any and all weaknesses in both ciphers (including backdoors).
Obscure? Yes. Secure? No reason to think so.
Of course you could let the firewood made of jam decide...
(Apologies for any content infringing on the material of Noel Fielding).