Slashdot Mirror
NSA Targeted 'The Two Leading' Encryption Chips (theintercept.com)
Advocatus Diaboli sends a report from Glenn Greenwald at The Intercept about the NSA's efforts to subvert encryption. Back in 2013, several major publications reported that the NSA was able to crack encryption surrounding commerce and banking systems. Their reports did not identify which specific technology was affected. The recent backdoor found in Juniper systems has caused the journalists involved to un-redact a particular passage from the Snowden documents indicating the NSA targeted the "two leading encryption chips" in their attempts to compromise encryption.
Quoting:
The reference to "the two leading encryption chips" provides some hints, but no definitive proof, as to which ones were successfully targeted. Matthew Green, a cryptography expert at Johns Hopkins, declined to speculate on which companies this might reference. But he said that "the damage has already been done. From what I've heard, many foreign purchasers have already begun to look at all U.S.-manufactured encryption technology with a much more skeptical eye as a result of what the NSA has done. That's too bad, because I suspect only a minority of products have been compromised this way."
When was that? I've been here since before Echelon and general consensus here when Echelon was revealed was bomb nuclear jihad assault rifle terrorism explosion poison murder kill.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Not really.
It hasn't been their job to insert backdoors into their own and existing systems worldwide, really. Not even the early codebreakers did that kind of thing.
It's their job to produce foreign signals intelligence, yes, but backdooring every piece of hardware in the country doesn't achieve that. All that achieves is compromise of people who were trusting US hardware already. For example, their allies.
All they've done is hurt their other core purpose - the national security of the US - and significantly damage their country's economy in a few specific areas.
Spying is not about having backdoors in hardware you produce in your own country. It's about getting those into foreign countries, foreign hardware, and about defeating encryptions that you're NOT already in control of.
Literally, a signed court order saying that Cisco/Juniper has to put in a backdoor for US intelligence into products X, Y, Z achieves this aim in the same way. With non-disclosure clauses, it's as secret. That's not what the NSA should be wasting their time on, if that's even what the US want to do.
Remember the big scare a while back about backdoors in Huawei network switches and routers? Looks like we weren't that far behind.
Not just encryption, but pretty much any US created technology ... cloud services or anything else.
If the US has made their technology companies part of their spy apparatus, then who the hell would trust a US technology company? You simply can't.
So don't go all boo-hoo that people are looking at your products with some skepticism they can trust you when you created the situation in which they can't trust you.
Anybody outside of the US has no choice but to look at US technologies and ask "given that it's almost certain they're under the thumb of the NSA, what are my alternatives?"
You can't have it both ways. And you don't get to whine if people stop buying your products because they can't trust you anymore.
Lost at C:>. Found at C.
This.
One of the NSA's mandates is signals intelligence. Another is information assurance, i.e. making sure our communications infrastructure is secure. Inserting backdoors in crypto hardware represents a pyrrhic victory for the first, and a complete disaster for the second.
The one thing that advocates for crypto backdoors completely fail to understand is that what you gain from the ability to monitor traffic comes at an enormous cost, which is the indroduction of a systemic flaw in our entire information infrastructure, which could potentially have catastrophic consequences. The best reason to oppose backdoors is not because "privacy" or "freedom" (although those may indeed be sufficient), but because backdoors combat a nuisance by making us vulnerable to a truly existential threat.
Obviously, nobody is "shocked" or is even claiming that someone else is stupid enought to be shocked. The emotion is anger, not shock.
Why? Because actually the NSA's job is to protect US security, whereby breaking crypto is only one possible strategy for accomplishing that goal. A rational actor running the NSA might decide that it would be directly contrary to their mission to undermine the encryption used by the US, and also contrary to their mission to undermine the sale of US products.
For whatever reason, that's not what they decided, so now we have a less secure country than if the NSA had done nothing.
Either someone made a dumb decision (d'oh!), or someone within the NSA decided to do the opposite of their job (in exchange for whatever from whomever). Either way, that's something to be legitimately angry about. We all realize that even the cleverest mathematicians can have stunning-stupid PHBs telling them to do stupid things, but we all tend to hope for better. (Nothing wrong with trying to set the bar high, is there?) And one of the neat things about America is that above the PHBs there's an elected president. And now we're seeing that even as late as 2010 the guy on top wasn't firing people left and right for incompetence and betrayal, so we have yet again, another president in a long uninterrupted series of presidents making the wrong call.
It's like we really are too stupid to elect someone to end the stupidity. Worse, at this point it looks like pretty much no matter how things go, in Jan 2017 we are going to get an even worse president than the last two. That's no matter whether you think the country is going to vote R or D. (Hillary Trump will have us longing for a return of Barrack Bush.) So that means the NSA is going to be working against the interests of America's security through at least 2020 (and We The People will be funding them, with taxes and externalities). With friends like these, we don't need enemies. Leave it to us, IIS and Al Queda: just sit back and relax.
And yes, telling people about evidence of what they had already suspected, is news. Unless you're going to tell me that when aliens are (or aren't) found, viable fusion power is (or isn't) invented, and next year's CPUs are a few percent faster, those things also won't be news. (But you're not really going to claim you're that stupid, are you?)