NSA Backdoor Key from Lotus-Notes (1997)

http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

by hosteur • 3 years ago

344 164 3 years ago

cypherspace.org

spzb2• 3 years ago

Dupe (2002!) https://news.ycombinator.com/item?id=21859581

With no context, I don't know why this is front page news today. Am I missing something?

baby• 3 years ago

Are you asking what reposts are?

ollemasle• 3 years ago

Adding the date in the HN title would be better (it is not present in the article)

spzb2• 3 years ago

No. I'm pointing out that (a) it's not marked as being from 2002 and someone would therefore assume it was some newly discovered backdoor and (b) there's no context or commentary as to why it is relevant in 2023.

Also, on closer inspection the story is from 1997 https://catless.ncl.ac.uk/Risks/19.52.html#subj1

dredmorbius2• 3 years ago

This would be a repost rather than a dupe.

HN considers dupes to be stories with significant discussion repeated within a year. (Items with little or no discussion can be resubmitted a few times.)

Stories reshared after a year are reposts, and are perfectly fine, though its appreciated to have the item's original publication year included in the title.

<https://news.ycombinator.com/item?id=37312416>

<https://news.ycombinator.com/newsfaq.html>

nonrandomstring• 3 years ago

I think a Microsoft coder recently came clean about some pretty funky stuff from the 90s and 00's. Hope I didn't hallucinate that.

ranting-moth2• 3 years ago

Link?

EvanAnderson• 3 years ago

I feel like you might be talking about Dave Plummer: https://www.youtube.com/@DavesGarage

He recently have a good talk at VCF, too: https://youtube.com/watch?v=Ig_5syuWUh0

lelandfe• 3 years ago

Good ole' "NOBUS." More fun NSA fumbles:

https://en.wikipedia.org/wiki/Clipper_chip

https://en.wikipedia.org/wiki/Dual_EC_DRBG

kmeisthax2• 3 years ago

This and the Clipper Chip aren't NOBUS. The NSA doesn't want you to know that the cryptosystem has law-enforcement access capability. The FBI doesn't care if you know as the kinds of criminals they are attacking don't do OPSEC.

sneak• 3 years ago

NOBUS isn't just intentional vulnerabilities, it's any vulnerability assumed to only be exploitable by US IC, whether engineered or otherwise.

I think these qualify.

tptacek3• 3 years ago

Dual EC is sort of the archetypical NOBUS backdoor.

gregw2• 3 years ago

It’s worth reading Ray Ozzie’s (Lotus Notes creator)’s comment on this from a HN 2013 discussion:

https://news.ycombinator.com/item?id=5846189

Before the software was released, Ray Ozzie and Kauffman openly described what they were doing at an RSA conference. This was not a secret back door. It was compliance with export controls everybody in the industry dealt with.

Also worth reading barrkel’s comment a couple comments down…

ethbr17• 3 years ago

For people younger than ~37, I'd remind them that crypto before 2000, especially in shipped commercial products, was playing under substantially different government restrictions.

https://en.m.wikipedia.org/wiki/Crypto_Wars

Effectively and in short, you were prohibited by the US government from shipping strong encryption in any internationally distributed product. Which generally meant everything commercial.

Despite open source implementations of strong encryption existing (e.g. PGP et al.).

Now, no one bats an eye if you ship the most secure crypto you want. Then, it was a coin flip as to whether you'd feel the full weight of the US government legal apparatus.

It was a crazy, schizophrenic time.

bo1024• 3 years ago

It was a crazy, schizophrenic time.

Or, we are currently experiencing a brief oasis of freedom in between extended periods of encryption lockdowns and controls.

brudgers• 3 years ago

Now, no one bats an eye if you ship the most secure crypto you want.

To me, there are only two plausible explanations for the change:

1. The three letter agencies gave up on backdooring cryptography.

2. The three letter agencies successfully subverted the entire chain of trust.

Only one of them is consistent with a workforce consisting of highly motivated codebreaking professionals available working for many decades with virtually unlimited resources and minimal oversight.

The other is what people want to believe.

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

matheusmoreira• 3 years ago

It was a crazy, schizophrenic time.

Still is. To this day, we have to debate and justify ourselves to these people. They make us look like pedophiles for caring about this stuff. They just won't give up, they keep trying to pass these silly laws again and again. It's just a tiresome never ending struggle.

And that's in the US which is relatively good about this. Judges in my country were literally foaming at the mouth with rage when WhatsApp told them they couldn't provide decryption keys. Blocked the entire service for days out of spite, impacting hundreds of millions.

r3trohack3r• 3 years ago

IIRC this is part of what shifted hardware manufacturing out of the US.

If you wanted to build in the U.S. you had to produce two versions of your product, one with “full encryption” and one with encryption hobbled.

Or you could go build one version somewhere else and import it into the U.S.

snakeyjake• 3 years ago

Windows 2000 came on a CD... and a floppy disk.

The CD was a globally-legal image, and export-controlled strong crypto came on the floppy in countries where it was allowed.

https://winworldpc.com/product/windows-2000-high-encryption/...

hinkley• 3 years ago

Except to Iran, Syria, North Korea…

Also you couldn’t just ship products with a spot where crypto went and remove the crypto. API designs had to go through mental gymnastics to allow crypto without explicitly adding crypto. Which is why you have odd constructs that take strings as arguments and give you encryption back. Sometimes.

And since new languages copy patterns from old to remain familiar, these APIs are still frequently some of the most patience-testing.

UI_at_80x24• 3 years ago

For anybody who hasn't already read it, I highly recommend the book: "Crypto" by Steven Levy. I was 30% of my way through the book before I started recognizing real world events, news stories, whispered computer secrets; and realized that it wasn't a fictional book and was instead talking about real history.

https://www.goodreads.com/book/show/984428.Crypto?from_searc...

pkaye• 3 years ago

Not just US but other countries had their own restrictions. For example I think France didn't allow anything better than 40-bit encryption without key escrow.

http://www.cnn.com/TECH/computing/9805/19/encryption/index.h...

http://www.opengroup.org/security/meetings/apr98/french-regu...

wkat42422• 3 years ago

It's not completely gone. If you implement crypto in an iOS app you have to get an "export license" even if you're not based in the US or publish your app there.

forgetfreeman• 3 years ago

That this is no longer the case is a fairly strong indication that The Powers That Be have durably resolved the issue of decryption.

convolvatron• 3 years ago

and I believe it was a major contributor to us having poor infrastructure for PKI protocols today, since these restrictions meant that it was pointless to try to bake them into standards

rozzie• 3 years ago

"Now, no one bats an eye if you ship the most secure crypto you want."

The most surprising thing to me is that, in speaking in the past several years with younger entrepreneurs, they're not even aware of the obligation to file for an export license for any/all software containing crypto (such as that submitted to the App Store).

I've not yet seen a case in which a mass market exemption isn't quickly granted, but devs still need to file - and re-file annually.

hoc• 3 years ago

Well... some folks still do care.

https://developer.apple.com/documentation/security/complying...

Also, always makes you wonder, why the standards the OS ships with are exempt...

CTDOCodebases• 3 years ago

An ex Microsoft dev did a good breakdown video of NSAkey:

https://www.youtube.com/watch?v=vjkBAl84PJs

13of40• 3 years ago

It was an interesting time. I forget the person's name, but I talked briefly with the guy who implemented the crc32 and encryption algorithms for ZIP, and he (almost apologetically) said the encryption was designed to be exportable under those laws. It's still not trivial to break, but you can test millions of passwords on a ZIP archive entry in the time it takes to try one on a modern Office document.

fullspectrumdev2• 3 years ago

Partial known plaintext attacks are very, very useful when cracking ZIP “encryption”.

I’ve mostly used this to unpack ZyXEL firmware updates (reference below to this), but it also works on a lot of other stuff if you can get a partial plaintext. Some file formats headers might work.

https://www.fullspectrum.dev/the-hunt-for-cve-2023-28771-par...

grammers• 3 years ago

Whether secret or not, it was a backdoor that could be/was exploited. Today governments are asking for 'secret backdoors' from tech companies, not seeing the immense risks. Crazy times.

thewanderer1983• 3 years ago

This was not a secret back door. It was compliance with export controls everybody in the industry dealt with.

The author states it correctly. Here is the text from the author "The idea was that they got permission to export 64 bit crypto if 24 of those bits were encrypted for the NSA's public key. The NSA would then only have the small matter of brute-forcing the remaining 40 bits to get the plaintext"

Here is the text from the RSA conference.

Hello, 1st off please don't publish my name on your site. I'm too lazy to set up another cheezy mail acct. Today I downloaded cryptography/nsa/lotus.notes.backdoor.txt from your site. I have a close friend who is a developer for Iris (the people who make Notes for lotus.) I sent him the file I downloaded and asked him what the deal was, and here's his response:

      Here's the necessary info to truly understand the issue here; a speech by Ray
      Ozzie and Charlie Kaufman's white paper on the topic. What it comes down to is
      that notes provides superior exportable encryption technology when compared to
      other US products on the market. For anyone (but the NSA) to crack our
      international encryption keys they must crack a 64 bit key, the same as with a
      US encryption key. In the international version we take 24 of the 64 bit
      encryption key and encrypt the 24 bits with the NSA's public key and send it,
      encrypted strongly, along with the encrypted message. This means the NSA can
      decrypt with their key and have 24 of the 64 bit key. They still have to break
      the remaining 40 bits. 40 bit key encryption has been the max for exportable
      encryption and that is what all other US exportable encryption providers 
      allow.
      That limit has just been raised to 56 bits and we are incorporating that as I
      type. In the worst case: the NSA's private key is compromised, the 40 bit
      portion of the key still must be cracked. So we haven't weakened the security 
      of international encryption, but actually made it equal to the US security (to
      everyone but the NSA). We are proud of this arrangement because we have found 
      a way to make Notes as secure as the US government will allow for our
      international customers. If we hadn't used this technique all of the
      international notes encrypted data would be with only a 40 bit key. As it
      stands, the 64 bit key used in both US and international encryption is 
      extremely secure.
      
      It's too bad the author of this article choose to attack Lotus Notes without
      considering the options the US government provides. We could  have just 
      shipped 40 bit encryption like MS, Netscape, etc. and leave our international 
      customers with weak encryption but we didn't. Oh well, you can't make everyone 
      understand, this confusing and frustrating stuff. I hope this helps.

gadders• 3 years ago

None of this was secret. I worked at Lotus in the mid-90s and there were 2 versions of Lotus Notes, one for the US and the other labelled "International".

ChrisArchitect• 3 years ago

(2002)

Some previous discussions all mentioning Lotus Notes in the title:

4 years ago

https://news.ycombinator.com/item?id=21859581

8 years ago

https://news.ycombinator.com/item?id=9291404

10 years ago

https://news.ycombinator.com/item?id=5846189

dang• 3 years ago

Thanks! Macroexpanded:

NSA's Backdoor Key from Lotus Notes (2002) - https://news.ycombinator.com/item?id=21859581 - Dec 2019 (87 comments)

NSA's Backdoor Key from Lotus Notes - https://news.ycombinator.com/item?id=9291404 - March 2015 (51 comments)

NSA's Backdoor Key from Lotus Notes - https://news.ycombinator.com/item?id=5846189 - June 2013 (85 comments)

agazso• 3 years ago

I wonder how difficult would it be to brute force the private key for an RSA 760 bit public key from 1998. Does anyone know?

panki27• 3 years ago

Always depends on what resources you have (compute, time). It's possible, but not easy.

https://crypto.stackexchange.com/a/1982

154573452342• 3 years ago

Oddly specific question, something in particular on your mind?

cmeacham98• 3 years ago

Presumably they are referring to the 760 bit RSA key this entire post is about.

tgsovlerkhgsel2• 3 years ago

https://en.wikipedia.org/wiki/Integer_factorization_records and https://en.wikipedia.org/wiki/RSA_numbers gives some pointers. Specifically, the latter describes a 768 bit key being factored "on December 12, 2009, over the span of two years", with CPU time that "amounted approximately to the equivalent of almost 2000 years of computing on a single-core 2.2 GHz AMD Opteron-based computer".

Later, in 2019, a 795 bit key was factored with CPU time that "amounted to approximately 900 core-years on a 2.1 GHz Intel Xeon Gold 6130 CPU. Compared to the factorization of RSA-768, the authors estimate that better algorithms sped their calculations by a factor of 3–4 and faster computers sped their calculation by a factor of 1.25–1.67."

So assuming the better algorithms transfer to smaller numbers, someone who knows how to use them (factoring big numbers seems significantly harder than just running CADO-NFS and pointing it at a number and a cluster) could probably do it in a couple months on a couple dozen modern machines.

For example, using the "795-bit computations should be 2.25 times harder than 768-bit computations" from the publication accompanying the second factorization, we could assume 900/2.25 = 400 Core-years of the Xeon reference CPU (which is 6 years old by now) would be needed to break the smaller key with the modern software. Two dozen servers with 64 equivalently strong cores each would need slightly over 3 months. Not something a hobbyist would want to afford just for fun, but something that even a company with a moderate financial interest in doing could easily do, provided they had people capable of understanding and replicating this work.

rocketnasa• 3 years ago

Classic CPU hasn't held a candle compared to GPU on very repetitive math calculations. AI this year has really shown the same difference. In other words, it isn't just graphics... https://www.spiceworks.com/it-security/identity-access-manag...

btdmaster• 3 years ago

Someone has tried to factorize it before (2018) http://factordb.com/index.php?query=444376527415060195687748...

thesuitonym• 3 years ago

It's amazing to me that the folks at the NSA had enough self-reflection to see that this is Big Brother behavior, but not enough to realize why that's a bad thing.

masfuerte• 3 years ago

I'd guess that was snark from the Lotus engineer who embedded it.

w1nst0nsm1th2• 3 years ago

The Lotus engineer embedded it, but was he the guy who created the key ?

w1nst0nsm1th2• 3 years ago

The 'Big Brother' thing doesn't shock me, I know about it for some time now. At least you can still believe a modicum they maybe have good intentions... You know, protecting us from bad guys or something...

But the 'MiniTruth' thing... Wow,just wow...

Context: The Ministry Of Truth in the 1984 novel is the service dedicated to propaganda, in which the whole society is drowned. Everything about the society they live in is a lie...

It just blows away any hope of good intention from their part.

The last time I read about something so cynic, suggesting so much contempt for the people they pretend to serve, with such carelessness, is when it was revealed que FTX internal chatroom was called 'Wirefraud'.

consoomer2• 3 years ago

Wasn't the original backdoor in a code example the NSA provided to companies interested in using cryptography? They gave an example seed or whatever, and most companies copy/pasted it instead of generating their own primes, so the NSA could break it trivially.

My memory around this is fuzzy and I can't seem to find the original source.

_def• 3 years ago

This one? https://en.wikipedia.org/wiki/Dual_EC_DRBG

consoomer2• 3 years ago

Ah yeah, that rings a bell now!

leoh• 3 years ago

MaintenanceMode• 3 years ago

Now with the cloud none of this is necessary. With data at rest laws, all our email older than six months is open game.

93po• 3 years ago

i googled this and didnt see any obvious results as to what the laws are for a company like google to provide access to their data at rest to government agencies without a warrant/NSL

NSA Backdoor Key from Lotus-Notes (1997)

Related Stories