Slashdot Mirror
Silent Circle Moving Away From NIST Cipher Suites After NSA Revelations
Trailrunner7 writes "The first major domino to fall in the crypto world after the NSA leaks by Edward Snowden began was the decision by Lavabit, a secure email provider, to shut down in August rather than comply with a government order. Shortly thereafter, Silent Circle, another provider of secure email and other services, said it was discontinuing its Silent Mail offering, as well. Now, Silent Circle is going a step further, saying that it plans to replace the NIST-related cipher suites in its products with independently designed ones, not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades. Jon Callas, one of the founders of Silent Circle and a respected cryptographer, said Monday that the company has been watching all of the developments and revelations coming out of the NSA leaks and has come to the decision that it's in the best interest of the company and its customers to replace the AES cipher and the SHA-2 hash function and give customers other options. Those options, Callas said, will include non-NIST ciphers such as Twofish and Skein."
mathematics depts are interesting things...
I personally trust in s box's
regards
John Jones
Or is it the case that NIST has a branch in the Belgium?
Ezekiel 23:20
IMHO at this point we have to assume the hardware is compromised at some level. Not necessarily a backdoor but the hardware random number generator might not be that random.
Only the State obtains its revenue by coercion. - Murray Rothbard
This is actuallly good. Crypto should be flexible enough to switch to different algorithms.
AES is just an option, and I'd say it's a fine one, but it's cool to get some extra algos some breathing
room.
I trust the Chinese have already done that to every processor built for export. They'd be negligent if they haven't.
While I think that NIST related crypto algorithms are probably well compromised by the NSA I suspect that there is probably not much of anything - certainly nothing on the open market - that the NSA would not already have cracked anyway.
Same thing for 'offshore data havens'. If it's visible it gives the NSA a target of interest and the fact that it's offshore isn't even going to slow them down when they attack it. People moving to such havens might find themselves being looked at all the more closely than someone keeping their data in less interesting places.
I think the best bet of keeping your info private (from the NSA) is going to be to avoid attracting attention to start with.
blindly antisocialist = antisocial
Or stupidity. One of the two.
Why use algorithms that are standardized on by the federal government and have been looked at exhaustively by experts around the world when you can use an untested crypto system? After all I'm sure the NSA wants to ensure that bad guys have access to everything the government is encrypting by first weakening the encryption standard, then standardizing the US government on the use of them.
I highly doubt that Vincent Rijmen and Joan Daemen themselves were influenced by the NSA in any way in the design of Rijndael, unless you believe that they influenced all the AES entrants, including Ronald Rivest (RC6) and Bruce Schneier (Twofish). I think the only influence the NSA might have had was in perhaps influencing the NIST selection process that chose Rijndael as the Advanced Encryption Standard. And in the thirteen years since it was thus chosen it has been scrutinised more thoroughly than any algorithm by the best cryptographers in the world, and well, none of the open researchers anyway have found an attack on the cipher capable of breaking it significantly. The NSA might have, but then they approved the cipher for encrypting US government classified documents (a blessing that the NSA notably did not give the original Data Encryption Standard), so I'd consider it highly unlikely that they would have done that. The risk would be too great that their method of breaking the cipher have been obtained by espionage or independently discovered by some other intelligence agency's cryptanalysts. The NSA may be evil, but no one has ever accused them of stupidity.
Given that the best cryptanalysts of the world have had thirteen years to look at it and it remains solid, I'd trust it better than the other AES candidates which have had much less scrutiny, or worse yet, a newly designed cipher that no one who knows anything has bothered to even try analysing.
The other thing is that AES is incredibly efficient even on 8-bit microcontrollers. Around the time the AES contest was ongoing, I implemented Serpent, Twofish, and Rijndael on an 8051-series microcontroller, and Rijndael was consistently the best performing cipher, so I used it in the project, and wasn't surprised to learn that it eventually got selected.
Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre.
NIST has in many instances blocked independent investigations into 9/11, as well as lied about its own findings and devised unscientific explanations for the controlled demolitions of WTC 7 and the Twin Towers.
AE911truth
You know, this is probably the first time in the history of 9/11 whackjob posts on Slashdot that the reply is actually relevant to the story. Because they have nearly identical basis in reality.
...not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development...
Really? So they are worried about NSA's influence on NIST, but they still trust NIST???
The least I would have expected from the documents about the extensive spying done by NSA was a generalized weakening of cryptography.
While it is true that some algorithms might have been deliberately weakened by the NSA, I doubt this could have been systematic; especially for those which are best investigated by the cryptological community at large.
In particular, NIST mandated cipher suites while definitely amenable to some theoretical attacks in some cases, have been independently investigated and, as of today, no effective practical attack is known against AES. I would never trust a 'homemade' algorithm for anything, nor waste time to try and analyse it (cryptography is actually part of my job) unless there were some really compelling reasons for doing so (e.g. interesting mathematics, peer review requests or unusual attack models being considered).
Skein and twofish are definitely interesting algorithms, and they have also been well regarded in the competitions leading to SHA3 and AES; they are definitely not a bad choice, but to choose them because whatever has been selected by NIST is "tainted" by NSE (and not other architectural or practical considerations) resembles more a form of superstition than anything else.
Even a broken conspiracy is right twice an epoch.
"I opened my eyes, and everything went dark again"
Twofish is hardly obscure or unreviewed. It was submitted as an AES candidate along with Rijndael. It's been reviewed plenty. It didn't meet the needs of NIST as well as Rijndael, which is why it wasn't chosen to be AES. But that doesn't make it a BAD cypher. It just makes it not ideal for NIST's purposes, which may well include: being vulnerable to attack by the NSA.
For the record the US government uses the NIST cryptographic transformations as recommended by its own NSA so on a global scale of one to broken they can't be that bad. So for generalist every day encryption they should be fine, if your trying to hide something that might have some sort of national security implications then if your legitimately in possession / generating that kind of information then there will be a different set of protocols and standards to follow. People would shit their pants if the world suddenly turned to using ad-hoc unreviewed transformations because at that point all bets are off, no seriously, all bets are off. Cheers
Skein is / was a NIST candidate for SHA3 and made it through a number of rounds. It isnt a replacement for AES tho, as it does hashing, not encryption.
I guess that their intent is to surf on the NSA conspiracy bandwagon, to create the buzz and to attract more customers. Bad taste buzz, but only money is driving the business, isn't it?
The following reference is obligatory tmo:
http://xkcd.com/538/
As security experts, suggesting that using another cipher suite would protect the customers from the NSA is either ridicule or ignorant of NSA's actual powers at best. Again, I've no clue of what these powers could be, but suggesting that they could break into secure systems by brute-forcing or cryptanalysing AES / SHA-2 does not make sense. Doing so would cost an overwhelming amount of energy, even for the NSA, when actually much much cheaper and conventional methods exist, like tapping into back-end systems (often with agreement from operators themselves), installing key logger into end user devices, etc. They certainly control some botnets, and maybe even some underground websites. Knowing that most users uses the same password over several websites, it's really a child game to penetrate systems for an organisation like the NSA. The NSA do not need to guess your secrets, they simply read it over your back.
If Silent Circles feel like doing something, what about playing the card of full transparency and proving to the community that they are indeed beyond any doubts? That would at least have the merit to elevate the current level of discussions and not to throw away the work of dozens if not hundreds of people around the world trying to bring real open peer-reviewed security.
"not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades"
So in other words it distrusts NIST.
e.g. substituting a random number generator for the pseudo random output of an encryption to which they know the private key.
If I hadn't already posted in this discussion, that'd be getting a Funny mod point.
If they cascade the one the US recommends wiht the one China recommends with the one Russia recommends, it seems you're safe unless all thre of those governments are conspiring against you. And if that's the case you problably have bigger problems.
Brute-forcing or otherwise cracking the various algorithms is all well and good. However, I believe the reality is that the NSA (and others) have more success by using other means, combined with metadata. I'm am not sure what the other means are, but could include social engineering, keylogging, reading clues communicated in the clear, false certificates, MITM.
They vacuum up all data, encrypted or not, to be decrypted at leisure, when indicated by the metadata. But the underlying encryption is still (mostly) secure.
Prove anything by multiplying Huge Number times Tiny Number
IIRC, Twofish did not make the AES finalist because it used more CPU than Rijndael. This doesn't mean Twofish is less secure, it just means that crypto ASICs are cheaper to make shifting blocks around than Twofish's split key/algorithm method.
Were I to choose one of the other just for security, I'd choose Twofish over Rijndael, but NIST had other parameters in their design decision.
WIth a billion cores of custom silicon, you can speed it up even more.
You are being MICROattacked, from various angles, in a SOFT manner.
I think crypto agility is generally an awesome thing all our encryptions should have ability to swap out algorithms at a moments notice with meaningful process to mutually agree to strong acceptable algorithms.
It is also a double edged sword as practically it means if any of algorithms you trust are compromised AND both parties are still willing to use the algorithm an attacker can normally steer parties to use it.
One thing I never really understood is if your afraid of subversion why not simply chain a series of different algorithms together such that compromise of one could not result in recovery of plaintext? The only downside I can think of you might need a bigger key so jacking input bits of one algorithm does not cascade to the others or otherwise reduce effective entropy of each input.
I see Silent Circle going down the same path that Hushmail travelled. Hushmail is a very good service, but when told to either cooperate with Interpol or else, they cooperated.
With SC, they will likely be forced with the same choice. Hand over keys and put in backdoors or face shutdown/prison time.
Instead, the focus should not be on communications, but endpoint security. Maybe PGP needs a revisit?
not because the company distrusts NIST, but because its executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades.
If "executives are worried about the NSA's influence on NIST's development of ciphers in the last couple of decades" then "the company distrusts NIST".
9/11 was a low tech attack that was based on human engineering. That is what makes it so scary.
Undetectable Steganography? Yep, there's an app fo
Adding more cryptosystems doesn't automatically translate into greater security, as double DES showed.
The NSA has figured out that the crypto isn't the weak point no matter what algorythm is used. Change it all you want, it makes no difference.
Sorry to hash the joke, but that's double ROT128. Unless, of course you're using a 16-bit or 32 bit character.
I think we've pushed this "anyone can grow up to be president" thing too far.
"if they want to exchange..." Keyword: If.
You are being MICROattacked, from various angles, in a SOFT manner.