The NSA Is Breaking Most Encryption on the Internet

http://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html

by tosh • 13 years ago

201 57 13 years ago

gadget_• 13 years ago

I would really like to know which technologies they are talking about. How about the Microsoft discovery from 2007, that's got to be public knowledge by now, right?

tptacek6• 13 years ago

Yes, but that discovery is also trivia; it was a design issue in a random number generator nobody uses.

joe_the_user• 13 years ago

"More than a century ago, A.-L. Sardou's New Dictionary of French Synonyms defined the nuances which must be grasped between fallacious, deceptive, impostrous, seductive, insidious, captious; and which taken together constitute today a kind of palette of colors with which to paint a portrait of the society of the spectacle. It was beyond the scope of his time, and his experience as a specialist, for Sardou to distinguish with equal clarity the related, but very different, perils normally expected to be faced by any group devoted to subversion, following, for example, this progression: misled, provoked, infiltrated, manipulated, usurped, inverted"

http://www.notbored.org/commentaires.html

MichaelGG4• 13 years ago

Maybe I wasn't careful in my reading, but the linked articles don't really say anything other than "yeah the NSA is probably doing something really big". Which, is like, to be expected of the NSA.

If Schneier has inside information, it'd be nice to get a simple, straightforward, article describing what exactly is known about the NSA capabilities. Various people speculating doesn't provide a clear picture of anything.

jorgeortiz852• 13 years ago

My takeaway from today's articles: they've backdoored the software, they've backdoored the hardware, they have a database of stolen private keys, they've tapped all the cables, they have zero-days for pretty much everything.

harshaw• 13 years ago

Agreed - and there isn't proof (yet) of any breakthrough in cryptanalysis.

nileshtrivedi• 13 years ago

And they have agents working at important positions at big tech companies.

MichaelGG4• 13 years ago

Yes, that's the speculation, that they've been doing this, and that's not a new speculation either. At least on the keys, cables, and 0-days (and some folks believe Windows has been backdoored for a very long time). Backdooring, as noted, is a tricky problem for all parties if found. Even with Windows, I'd expect various people inside Microsoft could verify with independent builds. (If they compile the bootloader or crypto.dll and use a disassembly tool and the output is functionally different from what's on the ISO...)

But if there's solid evidence, why don't they publish it? If they really have broken into Google, then publish the details. I'm sure Google would like to know, too. If they've backdoored Windows, Office, VLC, whatever - same thing. Or are we talking more stuff like "we knew Debian couldn't generate keys properly"?

If it's just stating that the NSA possesses heavy offensive capabilities, well, yeah, you'd expect that. Actual evidence of an NSA-backdoored common software or hardware would be a major story. (Not saying it's not possible, just speculating gets us no where.) If Schneier and Greenwald want to be taken seriously, then step up and speak out. Generic "the NSA is powerful" isn't much help.

afhof• 13 years ago

Nothing actionable in this post. If they said "OpenSSL is backdoored, don't use it!" then great. But, "Some software somewhere has a security hole in it", is pretty unhelpful.

vincie4• 13 years ago

When I looked more into the SHAs and SELinux a while ago, I had always wondered why the NSA would create/sponsor these things.

tptacek6• 13 years ago

Because NSA is chartered with assisting the USG and, as a knock-on effect, the US economy, with infosec. It's part of their job. Just like designing secure ciphers is part of their job, along with breaking them.

vincie4• 13 years ago

Why not leave it to the private sector?

lawnchair_larry• 13 years ago

Bullshit.

"Even agency programs ostensibly intended to guard American communications are sometimes used to weaken protections. The N.S.A.’s Commercial Solutions Center, for instance, invites the makers of encryption technologies to present their products and services to the agency with the goal of improving American cybersecurity. But a top-secret N.S.A. document suggests that the agency’s hacking division uses that same program to develop and “leverage sensitive, cooperative relationships with specific industry partners” to insert vulnerabilities into Internet security products. "

hobb00013• 13 years ago

The NSA is a schizophrenic organization. It is tasked with two opposing goals:

- To eavesdrop on the communications of foreign entities.

- To protect our own government from foreign entities that are doing the same.

It is the latter directive that has provided SELinux and AES.

meepmorp• 13 years ago

There's nothing at all opposing about those goals. They're both natural by products of expertise in signals intelligence and cryptanalysis, and skill breaking security helps provide more secure systems by subjecting them to more sophisticated attacks.

atonse• 13 years ago

Just as a clarification, NSA doesn't set those standards. Agencies like NIST set AES and SHA3 through open worldwide competitions. These standards then become parts of larger compliance guidelines like FIPS (Federal Information Protection Standard I think) that govern how the USG should protect its data.

richardjordan• 13 years ago

So the NSA has basically destroyed a business sector where the US had leadership. It may not be an immediate impact but this will clearly have an impact on US sellers of security products. Why would anyone trust one of them going forward? They won't. It'll take time. But I expect this sector to crash over the next twelve months, at least internationally at first.

hobb00013• 13 years ago

Why would anyone trust one of them going forward?

The same reason people trust the Dollar as a reserve currency. Yeah, it sucks, but better than any of the alternatives.

Fortunately, there exist open-source/public-domain alternatives for security products. (Doesn't mean that contributors can't be coerced with the equivalent of a Nation Security Letter, though.)

samstave• 13 years ago

The only reason people trust the dollar is because if you refuse the dollar, the US military shows up and kills you.

How long until we find out that the "humanitarian aide" so heavily pushed WRT Syria, is an IMF debt loan requiring a central bank and fealty to the US dollar is the primary reason for the opportunity war being sought.

vincie4• 13 years ago

Somehow, I think foreign organisations have always known or at least suspected and taken appropriate measures to guard against NSA/GHCB/Echelon/ASIO whatever evesdropping. Even terrorist organisations. Its just the you and me everyday saps that have just found out. And there's not much we can do about it.

jcoder• 13 years ago

Considering what we've learned, anyone's definition of "appropriate measures" has probably changed.

bandushrew• 13 years ago

I dont think so.

I was talking to a potential client 2 days ago, they provide SaaS to a number of clients, and up until now this has always included data storage.

One of the projects we discussed involved, for a specific customer, moving data storage off the current (US based) server and onto their customer's servers in their own country.

Anecdotal, but still I am really small fish on the far edge of the world, I cannot imagine the reaction where the bigger fish are swimming.

The difference between 'suspected that our confidential data may be compromised by a third party if you believe all the conspiracy theories' and 'know absolutely that our confidential data is being compromised by a third party as we speak' turns out to be pretty big, and worth a lot to international companies who value the commercial value of their private data.

quenlinlom• 13 years ago

It's been out ten days already before the news agencies decided to report it: https://encyclopediadramatica.se/PRISM#Parabon_Leaks

Magnet link of the alleged software used to break encryption methods: magnet:?xt=urn:btih:f8a942ccff260f7b9035bbf3b8af5c3013e21097&dn=Parabon+Leaks

mindcrime• 13 years ago

Who else thinks Bruce is going die in a mysterious car accident or elevator crash sometime soon?

I love his attitude towards this, however. He's right, we need massive civil disobedience, we need whistleblowers, and we need everybody who can contribute, to help dismantle this surveillance state apparatus.

I just wish I knew more about cryptography now, so I'd be in a position to do more to help.

chernevik• 13 years ago

I've got a copy of his book. I thought I'd never get around to it, but now I wonder. And I wonder if having purchased from Amazon means I'm now on some list at Fort Meade.

Maybe there should be some canon of crypto fundamentals, and everyone ought to buy a set, as protest / funding for research / "I'm Spartacus"!

Though at this point, I also wonder if he needs to publish a list of some kind of hash of the pages' images, so readers can verify the NSA hasn't been borking it at the printer.

lhnz• 13 years ago

The sick thing about this is that they named the two programs Edgehill [0] and Bullrun [1] after early battles fought in civil wars. I can't see how they will be able to maintain that this is still about terrorism or espionage from other countries. It seems to be nothing other than state-sponsored violence against citizens of the world; the bulk infringement of our right to privacy.

And did the whole security industry really not know what was going on? That's hard to believe. In general, I feel like my trust in the ecosystem has just been nuked from orbit.

Clearly a lot needs to be done to fix this. What kind of non-violent protest works? What kind of civil disobedience works? What are the best organic ways of organising people without getting shut-down? Do we have technology that is still secure, even if CAs are broken or even if hardware is backdoored?

[0] http://en.wikipedia.org/wiki/Battle_of_Edgehill

[1] http://en.wikipedia.org/wiki/First_Battle_of_Bull_Run

drgath• 13 years ago

Violence?

tankbot• 13 years ago

Appropriate use of the word. Look here [0] as it pertains to law.

"The question is," said Alice, "whether you can make words mean so many different things."

"The question is," said Humpty Dumpty, "which is to be master—that's all."

[0] https://www.google.com/search?q=define%3A+violence

advice4u• 13 years ago

It may be coincidence, but both Edgehill and Bull Run are locations in Virginia, where I imagine a lot of the DoD resides. I'm not saying they weren't named after the battles, but it's not like those names are exclusively related to civil wars.

tomrod• 13 years ago

Are darknets a thing yet?

craigching• 13 years ago

In one of the articles linked from this one, the one on how to protect yourself, he says:

"Prefer symmetric cryptography over public-key cryptography."

I always thought asymmetric and public key was safer, so could someone clue me in on this?

privong2• 13 years ago

One-time pads are probably what they meant to say instead of simply symmetric crypto. One-time pads are unbreakable, but the issue is transmitting the key to the recipient. Public-key crypo is so widely used because it offers a solution to key distribution. But in terms of theoretical security, public key crypto isn't as secure as a one-time pad.

bradleyjg3• 13 years ago

No he didn't mean that. Scheiner constantly talks about how mentions of OTP are a key red flag for snake oil crypto. Yes the math is impeccable, but the implementation challenges are enormous. As this leak confirms implementation is a much bigger problem than the math.

leviself• 13 years ago

I interpreted this to mean that your private keys are probably not as safe as you think they are.

cookiecaper• 13 years ago

Unfortunately the technical details are layered underneath a bunch of fudging to make them layman-readable. Schneier doesn't even describe the attacks, just says that they're not mathematical. One would expect that this means the NSA has access to most if not all accepted SSL authorities and generates keys which they can utilize to sniff a connection at will. This is pretty much obvious, and any intelligence agency that HASN'T "compromised" SSL by gaining access to the master keys is probably very incompetent indeed.

That said, does someone have a brief rundown of the details from a technical perspective, so I don't have to read through several long news articles mostly filled with elementary explanations of basic concepts?

milesf2• 13 years ago

I owe Richard Stallman one big huge apology. I'm truly grateful for Free Software (free as in freedom. You know, that thing the USA used to stand for) because it seems to be the only alternative right now. Microsoft and Apple can never be trusted again, ever.

Sorry Richard. You were right. Thank you for your unwavering commitment to freedom.

xophe• 13 years ago

http://xkcd.com/743/

grinich• 13 years ago

You should write him directly and get involved in Free Software!

He's just rms at gnu dot org

milesf2• 13 years ago

Great idea :)

nutate• 13 years ago

That's why he only runs a machine built in the free as in freedom PRC? Not to get jingoistic, but when do you expect to see an exposé on Chinese hardware and firmware manufacturer's backdoor analysis by the Ministry of State Security (MSS) – 国家安全部 in the People's Daily. Sometime after they have freedom of press I suppose.

Or what about any of these groups?

http://en.wikipedia.org/wiki/List_of_intelligence_agencies

Which one(s) do you want to be the very best at this? Do you think the US is? And why?

ralfd• 13 years ago

Hö? What has Apple done? And why not include Google?

In the case of Microsoft there is still no proof/evidence for a NSA backdoor in Microsoft Windows (and would that not show up in the leaked Win2000 source code?) And even the Snowden documents do not allege that (please correct me if I am wrong).

What the Guardian claimed was that Microsoft helped to give access to Outlook.com. The NSA is mostly interested in online services. And this is a far bigger issue, because there is no real alternative for that. Because even if you compile your own Linux distribution you still use Google Gmail (Ha!) or visit this hacker news forum, and you have to trust a third party with your data. And even if that trust is merited the NSA can just slurp up the datastream in the Internet provider datacenters.

brymaster• 13 years ago

If you read the articles:

In one case, after the government learned that a foreign intelligence target had ordered new computer hardware, the American manufacturer agreed to insert a back door into the product before it was shipped, someone familiar with the request told The Times.
At Microsoft, as The Guardian has reported, the N.S.A. worked with company officials to get pre-encryption access to Microsoft’s most popular services, including Outlook e-mail, Skype Internet phone calls and chats, and SkyDrive, the company’s cloud storage service.

Please read.

http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet...

The NSA Is Breaking Most Encryption on the Internet

Related Stories