Slashdot Mirror
Non-US Encryption Is 'Theoretical', Claims CIA Chief In Backdoor Debate (theregister.co.uk)
Iain Thomson, writing for The Register: CIA director John Brennan told U.S. senators they shouldn't worry about mandatory encryption backdoors hurting American businesses. And that's because, according to Brennan, there's no one else for people to turn to: if they don't want to use U.S.-based technology because it's been forced to use weakened cryptography, they'll be out of luck because non-American solutions are simply "theoretical." Thus, the choice is American-built-and-backdoored or nothing, apparently. The spymaster made the remarks at a congressional hearing on Thursday after Senator Ron Wyden (D-OR) questioned the CIA's support for weakening cryptography to allow g-men to peek at people's private communications and data. Brennan said this was needed to counter the ability of terrorists to coordinate their actions using encrypted communications. The director denied that forcing American companies to backdoor their security systems would cause any commercial problems.
LOL, how quaint. As if a company belongs to a particular nation state. Freemasons 2016, huyah!
Sir Bush, president and knighted...
Well of course he's going to say this nonsense, no surprise there. What is surprising is hearing about it from a british newspaper without a bleep in U.S. news. I imagine apple, microsoft, google and the likes will have a response soon.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
This halfwit is the best that the US can come up with to head their "intelligence" apparatus?
Glad to see that this fellow has figured out how to create new technology jobs in foreign countries. I didn't realize that was his job, but kudos nevertheless.
"No sane man will dance." -- Marcus Tullius Cicero
This guy is smoking some premium shit.
He realizes that many of the Nordic area countries in Europe have some really talented crypto people, and that it would take all of about 2-3 years for some seriously competing cryptographic solutions to hit the commercial space, right?
What will his precious 3-letter agency do when everyone stops sitting on inertia, and is compelled to create cryptography outside their control, while all the people in the US are forced to use the shitty crap he insists on-- you know, where the rest of the world can actually keep secrets secret, but his own country now cant, and foreign governments the world over just backdoor the shit out of everything, resulting in a powerful asymmetry in effective intelligence gathering?
What a fucking douche.
He's using FUD. Simple trick to get people to change up something you can't break. Trying to convince them that their stuff is being read by the US. And if they change up their techniques, maybe the US intelligence apparatus gets lucky and then *can* actually read their stuff.
I suspect professionals will understand this and roll their eyes, continuing on as before.
>> (for crypto) there's no one else for people to turn to (mofos)
Well, it's a good thing that all mathematicians have always been and will always be American then.
Under 18 U.S.C. ss. 1001, lying to Congress is offense punishable by up to five years in prison (or eight if the lie is terrorism-related). The correct "response" to John Brennon's blatant, politically motivated, criminal lie is to indict him, convict him, and send him to Federal prison where totalitarian freedom-hating enemies of the American public like him belong.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
The issue isn't whether the rest of the world would use it. The question is how long until the backdoor is hacked. Knowing its there will make it a prime target. Is the US government willing to back up its confidence with a guarantee to reimbursed all losses for everyone using this technology? Only then could the claim that it wouldn't "cause any commercial problems" be at all plausible.
Would be only a slight generalization of his view point.
A lot of people think this is how Americans think about the rest of the world.
We've heard it's out there, but it doesn't matter very much, as long as they have a McDonalds, a 7-11, and a Starbucks.
Where are we going and why are we in a handbasket?
Hold up there a minute, Mr SpyMaster. I think GnuPG (open-source implementation of PGP) is German. Or at least: " g10code GmbH, the legal entity employing some of the GnuPG hackers" is German.
My company has been using GnuPG for ten years.
See https://gnupg.org/ .
Never attribute to malice that which can be explained by mere idiocy.
I can't decide if Brennan is stupid, or if he thinks everyone else is stupid.
I readily admit this is not an uncommon reaction of mine when I read of the things presented by elected and appointed officials. The US government is a madhouse.
I've fallen off your lawn, and I can't get up.
Jonny, listen. There is a thing called "compiler". That's a program that lets anyone around the globe take source code, that is like some sort of text that anyone who knows how to program can read (trust me on that one, anyone who can program can read this stuff. Just because you can't doesn't mean nobody else can, there is intelligence outside of your agency on the planet, ya know? Some of it even in people). That source code can also be changed by people who can read it. And then they put that source code into a compiler.
What this means for your backdoor is that even if there was only 'murrican code (which there isn't, but let's play pretend as you usually do) is that your backdoor gets ripped out of that code, tossed onto the pile of junk code where it belongs and you're standing outside the door.
You AND your industry.
Because if I can easily create a non-broken version of your code, why the hell should I use yours which is inferior?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
if the Government spooks & goons can peek at your stuff then the criminals that are good at cybercrime will find a way to crack the key to the Government's backdoor
Politics is Treachery, Religion is Brainwashing
The biggest threat to US security is US security.
He shouldn't have said it was just theoretical. After all, how does he know for certain that it doesn't already exist and the US hasn't detected it?
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
The problem with Johnny is that he knows so little that it's hard to say whether he is actually trying to bullshit you or whether he really believes what he says.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Like the "theoretical" encryption Rijndael...?
If it's known there is a backdoor people WILL find it. And the arrogance that only American companies can create encryption libraries is dumbfounding. We have China's Red Flag, edition of Linux, North Korea appearently has "Red Star" and I suspect Russia has their own version of Linux as well. It may a crime to use non-use encryption, but it will be there and used if people fear for their privacy. We recently had an event in France where the CIA tried to claim encryption was used to coordinate their operation, and it turns it...it had nothing to do with coordination. The best people will use method with less technology dependencies. This will only make it easier for people (terrorists or "partner" like China) to go through their backdoors to access data. . We seem to "terrorism" as an excuse for everything the same way we used "communism" in the Mccarthy days. the end doesn't justify the means
"Imagination is more important than knowledge" - Einstein
I took a trip to Europe last week. I tried using GPG but it told me that it won't encrypt anything because I'm not in the USA. Then I tried VeraCrypt but it made my hard drive fizzle out.
I would like to apologize on behalf of the American people. Director Brennan clearly has no knowledge on the subject which he is speaking about and was advised poorly by his staff.
The name of the algorithm behind AES is Rijndael -- a combination of the names of the Belgian cryptographers who developed it.
His utterings are in the running for either biggest lie of the year, or most ignorant.
Learning HOW to think is more important than learning WHAT to think.
the various agencies of the US Government tend to lie ( even to Congress ), I'm somewhat puzzled about why they even bother to ask questions of them anymore.
Perhaps Congress should forgo asking questions of the professional liars ( any intelligence agency ) and ask the tech world instead. I'm quite sure the likes of Cisco, Juniper, Apple, Google and many others ( assuming they're not secretly on the Governments payroll ) would have a much different perspective on the issue at hand.
For example, AES is a Belgian design. The US has long since lost leadership in this. That is if they ever had it.
Incidentally, when did US TLAs catch any terrorists "coordinating via encryption" the last time? Oh, right, NEVER.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
As other posters have said, his words are those of an idiot.
Any possibly that he is actually saying that known crypto algorithms have been broken by the US? I doubt it, but it is interesting to ponder.
It sounds like they have a lot of the CENTRAL and AGENCY, but not INTELLIGENCE.
Given that nearly every major tech company has large presence in multiple foreign countries, then they move their headquarters outside the US. For instance, I know for a fact that MS has contingency plans to move headquarters 60 miles up the road to Vancouver BC for some situations and given their presence in India, that likely wouldn't be much of a challenge either. I'm sure that most other big players are similar. They simply leave to avoid the law. Yay, great for America right?
This guy should write a book on how to drive away the American tech industry and promote off-shoring of jobs.
Just because most encryption is developed by us companies, doesn't mean it'll always stay that way. Something like this just makes Offshore and Foreign vendors become more attractive. Why would anyone buy a software security package that is known to be compromised or have back doors. Even if it's meant only for the "good guys" to get through, something like that is just a ticking timebomb, eventually it'll get into the hands of someone who shouldn't have it, then at that point, you may as well have no encryption at all.
Who's to say that some other country will do any better? I agree it is a poor move and will likely just end up being abused more against US citizens than espionage. However, it's not like the US is the only surveillance-happy country out there. The UK and China are as bad, if not worse. At least the US is being relatively transparent about their intentions. I doubt you would get much notification if China mandated that all its companies installed backdoors in their products.
It would be "aiding or giving comfort to the enemies of the United States" – by encouraging them to take over for the US companies that this type of legislation would kill.
You or I would go to Federal Prison for that.
Who actually invented public key encryption first, oh yeah a British fella working for gchq one evening in his head cos he couldnt write it down
And how long does it theoretically take for some non US entity to grab some existing OSS code out there today, fork it an package it un-crippled?
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
The director denied that forcing American companies to backdoor their security systems would cause any commercial problems.
This is lie, an outright lie, and I hope he was under oath when testifying before congress. Absolute, outright lie! Liar, liar, pants on fire. Everyone email their representative and let them know the director outright lied to their face and cite the CEO of Cisco.
This will hurt American Tech in China. To interoperate, China will steal all corporate America's IP and integrate it into their products.
Dr. Mr. Director of CIA, your reality distortion field is NOT WORKING! I am still in disbelief. This is how you kill American products in emerging markets and hurt growth. What an absolute lie!
Encryption Routines created by people who are not American
- AES (Rijndael)
- IDEA
- Serpent
Hashing Routines created by people who are not American
- SHA-3 (Keccak)
So the Current Encryption Standard and Future Hashing Standards in the US were created by non-American's, but hey, "non-American solutions are simply 'theoretical.'"
You have to be not actually dumb to get high up in government. But you do have to have a certain capacity to believe in the institutional lies, or at least repeat them as if you mean them. They still institutionally believe in a rather simplistic device to the point that gaming the thing is a criminal offence, for example.
More to the point, this here is politics in action. He is furthering an agenda in front of an audience that made this agenda-pushing their day-and-night jobs, but who do not necessarily have any clue whatsoever about what goes on under the veneer of the nice words from the very respectable chief of this here government outfit reporting to congress. So he's basically daydreaming his "truth" into existence. If he can get it enacted in law, he has won.
* Quiz: What other organisation institutionally believes in an unproven, even outright silly, bullshit device based on similar principles?
Comment removed based on user account deletion
Another article has more of the exchange:
Let's allow the assumption that American companies currently dominate the encryption field. We'll say that's true. How long would that dominance that last if foreign companies used strong encryption and American companies used hobbled encryption left vulnerable to the American government and hackers? Thank goodness for Warner and Wyden for pointing out how idiotic Brennan 's assertion was.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
The AES encryption algorithm is Rijndael, which is Belgian
The runner-up for the contest for becoming the AES standard was Serpent, which was a British/Danish/Israeli collaboration.
Third place went to the Twofish algorithm, designed by Bruce Schneier, a US citizen who happens to be a vocal opponent of backdoors.
The "main" encryption du jour happens to be from outside the USA. The best alternative is also from outside the USA. Of course, the nationality of the creators doesn't matter - the USA is able to make modified implementations that include backdoors, but the original non-backdoored versions are already out there for everyone to use instead.
Oh dear god, really? This is why we are ineffective. The men in charge are idiots, morons and buffoons.
Do not look at laser with remaining good eye.
Yeah, I had that thought as well. Except I think I'll start a bank.
I can not believe he is head of an agency with the word "Intelligence" in it.
ALL encryption is theoretical. I wonder they would want to blow that cover.
“He’s not deformed, he’s just drunk!”
the various agencies of the US Government tend to lie ( even to Congress ), I'm somewhat puzzled about why they even bother to ask questions of them anymore.
Perhaps Congress should forgo asking questions of the professional liars ( any intelligence agency ) and ask the tech world instead. I'm quite sure the likes of Cisco, Juniper, Apple, Google and many others ( assuming they're not secretly on the Governments payroll ) would have a much different perspective on the issue at hand.
Companies aren't on the payroll of the government, it's the other way around.
My beliefs do not require that you agree with them.
I'm sure Werner Koch could get a giggle out of such a statement.
In other news, the US invented everything and won WW2 single-handed.
The Bank of America is a private institution. As, in fact, is the Federal Reserve. Alexander Hamilton made carefully sure that the monetary system in the US would be under (certain) private ownership.
I think we've pushed this "anyone can grow up to be president" thing too far.
... complete moron, blatant liar, or maybe both.
Does anyone in Washington remember what happened back in the 90's when the State Department declared strong cryptography a weapon and put heavy export controls on it? Hell I was a teenager and ever I remember. Tons of EU companies sprang up to fill the gap. Ireland, in particular, had quite a few software companies spring up offering software product with strong encryption. It wasn't that long ago that the government finally figured out how useless the export controls were and loosened them to where they are now. They did nothing but hurt US tech companies. How in the hell could anyone not think the same thing would happen again?
I browse on +1 so AC's need not respond, I won't see it.
It's tempting to dismiss this as him being wrong by orders of magnitude and then talking down our noses at him by assuming we need to explain what an order of magnitude is, or that he's adopting this stance for transparent political reasons, but let's assume for the moment that he's telling the truth. What would he have to know for that statement to be true?
Have you all forgotten the Snowden revelations yet? How it became known that the US grabbed cell phone encryption standards before the ink was dry on them, how they tapped the lines between Google data centres. If the operational tools for creating for encryption are compromised or at least weakened, it may well be that they have visibility into source code in a lot of industries as well as communications, which is as good *if not better*.
---- The above post was generated by the Turing Institute. Maybe.
What an idiot. Imperialism is bad, but technological imperialism is simply stupidity masked as pride.
Organization? You must be joking..
The AES NIST standard encryption competition finalists:
CAST-256--Canada
CRYPTON--South Korea
DEAL--Canada and Norway
DFC--France
E2--Japan
FROG--Costa Rica
HPC--U.S.A.
LOKI97--Australia
MAGENTA--Germany
MARS--U.S.A.
RC6--U.S.A.
Rijndael--Belgium
SAFER+--U.S.A.
SERPENT--Norway
TWOFISH--U.S.A.
http://www.eurekalert.org/pub_...
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Fire his ass. Preferably, out of a very large cannon, pointed straight at the Moon.
"One of these days, Alice, one of these days!
Bang, zoom!
To the moon, Alice, to the moon!"
https://youtu.be/98qw86DsdZ0
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
While I get what you are trying to say... that is so, so wrong that I realllllly hope you are nowhere near any crypto code, in either your professional or personal hours.
Getting the basics of a crypto function right is easy. The algorithms, complete with pseudocode or even a basic implementation in some real language, are well-published. As you say, anybody with halfway-decent skill can implement them from specifications.
Getting the details of a crypto library write is really bloody hard! There's always a risk of incorrect behavior in some edge case that completely breaks your system, for example - Heartbleed was probably the most famous and easiest-to-understand of these, but there's plenty of others across many libraries - but risks like that are not unique to crypto libs (although they are usually *worse* in a crypto lib). Side-channel attacks like timing attacks, padding oracles, CPU cache line attacks (technically a kind of timing attack, but not the sort most people think of when you say "timing attack"), and many more things than I know about bedevil implementations of such things.
Just like nobody but an expert in crypto theory should ever attempt to design their own crypto algorithm, nobody but an expert in crypto implementation should ever attempt to write a cryptosystem in live code. If you think "anyone with halfway-decent coding ability can implement them from the specs and get an encryption library with no backdoor", then there is ~0% chance that you could implement a crypto library and get one that cannot be broken, at which point who cares if it has a backdoor explicitly built in?
There's no place I could be, since I've found Serenity...
Being good at all the political games to get into a high position does not automatically mean competence with a different skillset.
Especially when there is nepotism in the mix.
Remember this?
"Brownie, you're doing a heck of a job"
Im only aware of 4 countires, America,russia, china, and terrorizerstan. Clearly we must be the only smart people.
OMG Ponies!!! with Glitter!!!! I miss Pink
We sell them weapons to fight the pinko commi bastards then we bomb them?
OMG Ponies!!! with Glitter!!!! I miss Pink