Slashdot Mirror
Distrustful US Allies Force Spy Agency To Back Down In Encryption Fight (reuters.com)
schwit1 shares a report from Reuters: An international group of cryptography experts has forced the U.S. National Security Agency to back down over two data encryption techniques it wanted set as global industry standards, reflecting deep mistrust among close U.S. allies. In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them. The NSA has now agreed to drop all but the most powerful versions of the techniques -- those least likely to be vulnerable to hacks -- to address the concerns.
we give you the 12 we didn't want to keep the 5 we did.
This is the same crap about the Dual EC DRBG. Really NOTHING new to see here. Everybody knows not to use this, most software has already had it removed. Yawn.
" In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them."
The NSA is widely believed to have done exactly this when it recommended particular elliptic curve constants quite a few years back.
Once you've betrayed people's trust, you're going to have a hard time convincing them you're worth trusting with anything that matters ever again.
#DeleteChrome
OK, if the NSA is pushing encryption techniques that are easy to break, or have known vulnerabilities, then they lose the "S" in their Acronym.
To make me trust you, you have to give me a good reason to do so. Unfortunately the NSA has given all sorts of reason to not thrust them with anything. Not as an American, twice not as a foreigner.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No one inside or outside of the USA trusts america anymore, you don't have any friends you have allies that are compliant out of fear and nothing else. ask anyone in Canada or the UK, your closest allies, and closest cultural parallels how they feel about the united states, and you'll find that it is almost invariably, disgust.
I'm a huge fan of properly-done one-time pads. They're the only actually unbreakable crypto out there.
But I'm curious about how you would solve the problem that limits their utility: key exchange.
The NSA trusts the NSA.
Relative to real time over years of use for any system, network. .."
Enigma, DES should have been the warning from history.
Revealed: how US and UK spy agencies defeat internet privacy and security (6 September 2013)
https://www.theguardian.com/wo...
"..to have cracked the codes used by 15 major internet companies, and 300 VPNs."
Microsoft handed the NSA access to encrypted messages (12 July 2013)
https://www.theguardian.com/wo...
".. agency already had pre-encryption stage access.."
"..helped the NSA to circumvent its encryption to address concerns
US allies should have learned from
SISMI-Telecom scandal https://en.wikipedia.org/wiki/...
https://en.wikipedia.org/wiki/...–05
Domestic spying is now "Benign Information Gathering"
Hand carried in tamper proof containers?
Expensive, but effective, high bandwidth and secure..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
One time pads are absolutely a form of encryption. They mathematically transform the cleartext. They don't just "move things around" (they don't move things around at all).
Yes. However, given that the key has to be the same length as the cleartext and can never be reused, that makes it an unworkable solution for two-way electronic communications.
It's just barely feasible for things like numbers stations.
I first ran across them in the early 80s when I needed a clearance. Back then they were "No Such Agency". Given that, why would they and their research be deemed the golden standard? They're a spy agency ffs!
How is it there wasn't a community of, I dunno, open source crypto developers, paid for by, I dunno, college research grants across the globe to figure this stuff out?
tl;dr You rely on a spy agency for 30 years for your crypto protocols, don't be surprised they cheated. One word: Sucker!
The U.S. is spearheading Five Eyes which will propose mandatory backdoors in all strong encryption. I don't think that this is a coincidence.
-- Insert witty one-liner here. --
There is a dutch phrase which is "unity sausage" which basically translated to a bad post-ww2 sausage, all the NSA crap the US has been pushing is exactly THAT...
And what does that translate to?
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
SIMON and SPECK are simple block cipher designs. You don't need an ISO for that. What's next? An ISO for HTML header tags?
>The dispute, which has played out in a series of closed-door meetings around the world over the past three years and has not been previously reported, turns on whether the International Organization of Standards should approve two NSA data encryption techniques, known as Simon and Speck.
I was in a couple of those meetings in ISO/IES SG27/WG2.
Indeed, the NSA were there and were pushing Simon and Speck.
Indeed a handful of other countries were arguing against Simon and Speck, but not on the merits of the algorithm, but on the history of the USA in crypto standards and SP800-90A in particular.
They couldn't muster any real criticism of Simon and Speck, and that's because they are excellent algorithms. They are 3X more efficient that AES in whatever metric you choose (size, performance, area, power). They are easily extended to 256 bit block sizes (although NIST and the NSA have declined to do that while leaving obvious holes in the spec where the larger block sizes go. The security analysis is aided by the simplicity of the algorithms - a simple round function iterated many more times than for AES.
ISO is a political organization and the arguments are political. Don't let technical considerations muddy the waters.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Use all encryption methods from all countries on top of each other. That way no one entity can unwrap the whole thing. Only the person with all 190+ keys.
Twinstiq, game news
Like I said, hand currier is a high bandwidth (and high latency) option. It's expensive, but with some pre-planning you can have enough key material in place to send whatever messages or data you want. You can put a whole bunch of one-time pads in a brief case if you can store them securely in small enough packages. Personally, I'm envisioning a large batch of USB keys or SS Drives with pads on them. Once you transmit the message, you destroy the pad by grinding the device into dust or overwriting it enough times to be sure it's not recoverable.
I don't suppose that you'd use it for everything, due to it's cost, but that's not the point. You encrypt the less critical stuff using less secure and cheaper techniques and reserve your one-time pads for the really sensitive stuff you never want cracked. But you *could* do the one time pad for everything if you had enough key materials hand transferred to do so.
Or are you looking for a *cheap* option that's convenient? In which case the expense of key exchange is your issue, not what kind or size of keys you are exchanging and you are going to sacrifice security in some way. In the end, the issue is how much risk are you willing to take with that data? That's your call not mine.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
It's not really just splitting data. You can generate a one-time pad, distribute it to everyone you want, and then at a later point use the pad to encrypt an arbitrary message to them.
Yes. However, given that the key has to be the same length as the cleartext and can never be reused, that makes it an unworkable solution for two-way electronic communications.
It's just barely feasible for things like numbers stations.
These days you can fit 256GB on a microSD card. For point to point communication that's quite a lot. You could also smuggle two or more separate versions by different routes and XOR them together at the destination to guard against a single courier being intercepted.
The key doesn't need to be the same length as the cleartext, it can be considerably shorter. This does weaken the encoding, but not fatally. You just need to encrypt the message before you encode it with the one-time pad with a code that's difficult to recognize. The more you shorten the key, the weaker the encoding, but shortening it by 50% is still quite safe if you use a decent encryption of the cargo.
Perfection isn't impossible, but is hideously expensive.
That said, any code that depends on factoring large primes is weak when used against quantum computers. And they may not be here today, but I wouldn't make strong bets about next year in secret government offices. So if it's worth it to you, by all means use one-time pads. And most of the expense of using them is in the transmission of the info, so you might as well use the most secure version. You can get a pretty good set of random numbers by processing a web cam of a candle flame, but turning that into terabytes of good random numbers could take awhile.
I think we've pushed this "anyone can grow up to be president" thing too far.
Wouldn't that be a terrible way to distribute pads?
You'd simple need to listen to them, and then try various alignments until decrypted.
Also, 1 byte a second isn't much throughput.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
an algorithm with a novel quantum solution, or some other machine that the NSA already has functioning, would make any "version" of the techniques just as susceptible to cracking.
perhaps the quantum machine is actually made easier as the encryption becomes "more powerful".
you're all idiots.
Gotta love the guy who comes out with a load of fucking gibberish and proceeds to call everybody else idiots.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
> The key doesn't need to be the same length as the cleartext, it can be considerably shorter.
Then it's not a One-Time Pad!
> This does weaken the encoding, but not fatally.
Then it's not a One-Time Pad!
> You just need to encrypt the message before you encode it with the one-time pad with a code that's difficult to recognize.
Why would you encrypt something before, again, encrypting it with a One-Time Pad? Compression ok, but prior 'encryption' is absolutely unnecessary.
Ever heard of 'pre-encryption intercept'?
Grandma is using a Windows computer, and the pictures on her Hard Disk *are* already in the possession of the NSA.
"Trump!!", the new Godwin.
Yes. However, given that the key has to be the same length as the cleartext and can never be reused, that makes it an unworkable solution for two-way electronic communications.
It's just barely feasible for things like numbers stations.
These days you can fit 256GB on a microSD card. For point to point communication that's quite a lot. You could also smuggle two or more separate versions by different routes and XOR them together at the destination to guard against a single courier being intercepted.
It would be less secure, but easier to do say among a team that gets together every week or once a day in the morning (for a bit of coffee, a status update and a pad exchange) ... if you periodically see people, then just have an app running in the background that does a one time pad swap in the background while you are in direct wireless communications range. Say transfer 300 Mb per person... ten people that is 3 Gb... which is doable.
Sure, people can be listening in on the pad exchange (or have a network of monitors in place to hoover all the wireless data up around a city or populated area) but if you are under that kind of intense surveillance already then there are already twenty different ways your communications are going to be intercepted almost regardless of what you do.
But yes, exchange of one time pads via a physical connection through removable media is very practical for gigabytes or even multiple terabytes of high value data as long as you can predict about how much data you will need in a given period of time before the next pad exchange.
It wasn't so long ago that gigabytes of data were best transferred on physical media anyway just due to physical limitations of network bandwidth and cost constraints.
Shipping data via delivery truck or hand delivery is still very much a current best practice for one time transfers of very large amounts of data. It probably should be considered best practice for high value one time exchanges of data too.
One time pads aren't unbreakable from a practical standpoint though, just theoretically unbreakable if you have perfectly random pad generation and perfect pad exchange. Would be good to see one time pad based encryption used more and then we can properly flesh out all those practical implementation issues.
Not so. Their name is the "National Security Agency". Their purpose is "National Security", not "Pushing crypto they can break".
Not so, at least not according to the NSA. Yes, their purpose is to be a part of the national security framework. Their role in that is informational security: mostly, subverting the informational security of other nations. Also, protecting domestic informational security. However, they don't consider being vulnerable to the NSA as counting as "vulnerable" in terms of domestic security.
The latter is a policy that the NSA has adopted, an interpretation of their purpose.
No, it is part of their mandate.
Unbreakable crypto is, in fact, becoming the norm.
It is? Where is all this unbreakable crypto? I'm only aware of one (one-time pads), but it's not in common use outside of spy agencies.
The key doesn't need to be the same length as the cleartext, it can be considerably shorter. This does weaken the encoding, but not fatally.
I suppose that we may differ on the definition of "fatally", but by my thinking, it weakens it fatally. (I count something as "fatally" weakened if it can be broken in a reasonable amount of time using readily available resources).
Even using a source of random numbers that isn't close to being complete random fatally weakens it, as several entities discovered during WWII.
Yes, everything you've said here is correct!
But perhaps we should reset. The comment I was replying to was asserting that algorithmic encryption shouldn't be used, and OTPs should be used instead. My assertion is that's not right, because OTPs cannot be used for most of the things we use algorithmic encryption for without eliminating the good part of OTPs -- that they're unbreakable.
True.. Using bruit force crackable cyphers is common for one reason, it's cheap and easy to set up. If you use large keys and change them often, you will deny the adversary access to your communications for enough time to make it safe.
If it's going to take 80 years on average to find your key by bruit force attacks, and there are no back doors in your encryption algorithm, then you can be pretty sure that your adversary won't be able to read it for a couple of years. If you rotate your keys regularly, even if they do crack one key, they will only be able to read your communications for a short time, years after the fact.
In the end, it's all about risk management. How much risk are you willing to take with that message? What kind of damage would it do if somebody could read it in 5 years, 10, 20, 50. Encrypt with long enough keys and rotate them often enough to keep that information safe for enough time to make it useless and you've done your job.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
...at least, according to DJB.
I do understand, however, that it is difficult to produce an implementation of any of the NIST curves that are invulnerable to side-channel exploits.
I am betting that NTRU Prime will likely be the post-quantum asymmetric winner of the NIST competition.
And then there are the home PCs running Windows, to add to your list of security risks of increasing concern.
And *that* is why it has no use for Grandma to use encryption.
"Trump!!", the new Godwin.