How 1990s Encryption Backdoors Put Today's Internet In Jeopardy 42
An anonymous reader writes: While debate swirls in Washington D.C. about new encryption laws, the consequences of the last crypto war is still being felt. Logjam vulnerabilities making headlines today is "a direct result of weakening cryptography legislation in the 1990s," researcher J. Alex Halderman said. "Thanks to Moore's law and improvements in cryptanalysis, the ability to break that crypto is something really anyone can do with open-source software. The backdoor might have seemed like a good idea at the time. Maybe the arguments 20 years ago convinced people this was going to be safe. History has shown otherwise. This is the second time in two months we've seen 90s era crypto blow up and put the safety of everyone on the internet in jeopardy."
Re: (Score:2, Troll)
It's not all about the gays. Your objection is noted, and filed under 'why should I care' or 'irrelevant' for the overwhelming majority of us.
More proof San Francisco is culturally irrelevant.
The SJWs had their day with systemd. Go away. Now. And stay anonymous.
Re: (Score:3)
The name "Logjam" is not a good one, especially for those of us working in Silicon Valley.
Due to our proximity to San Francisco and its demographic (read: lots of homosexual males), that term has a very different meaning here than it does in most places.
"Logjam" refers to fecal compaction: that is, when a penis thrusting into an anus repeatedly compacts the feces in a way that causes severe constipation.
All day I had to listen to the dev/QA/ops team cackling about "logjams".
It was a not a pleasant day.
As someone who lives in San Francisco and has many openly gay friends and coworkers, I can honestly say that I've never heard that definition of "logjam", and I wonder if anyone out of middle school uses the term.
Re: (Score:2)
I'm afraid "log jam" typically means getting a penis stuck during anal sex. Feces do not "compact" from anal sex: unless you've already got other problems. they're not that solid, and intestinal walls are somewhat elastic. They _squish_.
Re: (Score:2)
Backdoors for truth and justice! (Score:1)
But don't worry guys! Only the GOOD GUYS can use this backdoor...
Re:Backdoors for truth and justice! (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
So you implictly trust NSA's changes to Rijndael, to turn it into AES?
Unless you think there was a pre-submission conspiracy (e.g, a manchurian candidate), AFAIK there were only 2 changes made to Rijndael during the AES competition:
1. Restrict the officially supported block size to 128 bits (rather than support any block size a multiple of 32-bits)
2. Restrict the officially standardized key sizes to 128, 192 and 256 bits and the number rounds associated with them.
No algorithmic modification were made to Rijndael during the AES competition (unlike the DES where the NSA tweaked
Anyone?!? (Score:5, Funny)
...the ability to break that crypto is something really anyone can do with open-source software.
I asked my mom to to break crypto with open-source software...her eyes glazed over and I had to perform CPR.
Re: (Score:2)
Your Mom isn't much of a "Cyber Criminal" then. I guess she should stick with baking cookies.
Of course, the obvious solution to this is to ban open-source software.
Re: (Score:3)
Your Mom isn't much of a "Cyber Criminal" then. I guess she should stick with baking cookies.
True. I've heard her baking is criminal enough.
Re: (Score:3)
https://xkcd.com/341/
Re: (Score:1)
She'd also have to be in a position to intercept the traffic to begin with. The article's problem-description is rather silly, indeed.
I also do not see, who would still be allowing weak ciphers on their servers — after all the earlier SSL-vulnerabilities we went through in the last 6 months, that is... But the report [weakdh.org] on the matter estimates 8.4% of the top million web-sites and 3.4% of all HTTPS-using sites as still vulnerable. Shrug...
Re: (Score:2)
People just fix the things that have been reported, they don't actually look at what they mean. Because most people don't really know what all the crypto really means.
You had me at Secret Backdoor (Score:2)
What's all this then? I heard it from a different guy that all modern computer security krazy-krypto-keys are divisible by 69, so just keep it under your hat, guy
Logjam (Score:5, Interesting)
Here's the weird thing about this to me (in bullet points):
* A couple years ago, the only people who cared about vulns were people who knew how to use metasploit or ethereal or something.
* Last year, with Heartbleed, the news organization found out it could generate page views if the vulnerability had a pretty logo.
* Now with this story, the non-techy articles are so numerous it's hard to figure out what the actual exploit even is. But if you want to find an 'personal interest' story blaming Bush or Clinton (or whatever president), they're all over the place.
I wonder what will happen if the mainstream media learns to read Apple's or Microsoft's security bulletins and finds out how common security exploits actually are......
Re: (Score:1)
Adding to this is that a lot of these 'new vulnerabilites' are long known things. It's been long known you should be generating unique dhparam. It's been long known that export grade 90s ciphers were weak (that's the whole point).
Of course, on the flip side, awareness obviously wasn't that high in the general wider world, so dressing up old news as something novel and exciting has its merits.
Re: (Score:2)
Yeah, I thought "Internet in jeopardy" was over the top. It's some serious hindsight to complain that decisions made 20 years ago are screwing up software today. There are so many decisions from the early days we're stuck with now, why are these so special? Because it's security?
The PC has tons of cruft, such as the hard drive partitioning scheme, boot code, the layers and layers of hardware discovery, and memory organization. The platform has been updated repeatedly, with many hard limits raised repe
Re: (Score:3)
It'll break again in 2100, rolling over to 2000, but I very much doubt that software will still be in use then.
That's exactly how we got into the Y2K mess in the first place :p
Y2K problem resurfaces and will again (Score:4, Informative)
Such stupidity took a full two weeks to fix.
Re: (Score:2)
"There are so many decisions from the early days we're stuck with now, why are these so special?"
This one is special because some organizations (those that didn't learn those lessons in the 90's) are pushing to make the same mistakes again. Only this time the results could be different: people not buying US-made software anymore. And with open source crypto generaly available now this won't work anyway.
Meanwhile, in Australia (Score:3)
Re: (Score:1)
There has already been enough discussion about this in IT circles and more in the future. I bet that there will be a bill passed to clarify this.
Encryption/cryptography are not the sole property of the good good guys anyway. If someone builds a bigger wall, there's always someone else that can pull it down.
This illustrates the folly of giving backdoors... (Score:3)
Re: (Score:1, Insightful)
"...to three-letter agencies. If we allow them in, we also allow the 'baddies' in -- and the NSA has proven to be at least as bad as the terrorists and criminals they're ostensibly monitoring."
Can you draw me a ven diagram for three letter agencies, baddies, criminals and terrorists, I'm getting confused.
Must be be a millennium thing, I don't remember it being so difficult 15 years ago...
Flawed Comparison (Score:1)
I don't think this is a good comparison to make. As I understand it, the restrictions of the 1990s did not require a back door to be inserted; they just limited the strength of the cryptography, presumably to a level breakable by the NSA even then. The old Clipper-chip back door fiasco was not responsible for logjam et al. and the new proposals are not intending to limit key length.
N.B.: I still definitely think that the current noises about mandating back doors is very worrying. My hope is that it won't
you're telling them about our backdoors??!! (Score:1)