Distrustful US Allies Force Spy Agency To Back Down In Encryption Fight (reuters.com) 104
schwit1 shares a report from Reuters: An international group of cryptography experts has forced the U.S. National Security Agency to back down over two data encryption techniques it wanted set as global industry standards, reflecting deep mistrust among close U.S. allies. In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them. The NSA has now agreed to drop all but the most powerful versions of the techniques -- those least likely to be vulnerable to hacks -- to address the concerns.
classic plea bargain (Score:3)
Dual EC DRBG stuff...old news (Score:1)
This is the same crap about the Dual EC DRBG. Really NOTHING new to see here. Everybody knows not to use this, most software has already had it removed. Yawn.
Re: (Score:3)
Re:Dual EC DRBG stuff...old news (Score:5, Informative)
New "ciphers".
Specifically, two new families of block ciphers called SIMON [wikipedia.org] and SPECK [wikipedia.org]. These ciphers are designed to be extremely fast, which is good because although AES is fairly fast on "big" hardware" or on large quantities of data, it can be a bit sluggish when used in extremely constrained environments on small amounts of data. In particular, its key schedule its heavy, so changing keys is slow. SIMON has been designed to make it particularly cheap in purpose-built hardware while SPECK is designed for very fast software implementations. Both are very, very fast on both hardware and software, though. The 128-bit version (block size and key size) of SPECK, for example, encrypts at about 1.25 cycles per byte on an i5 on long messages, and is almost as good on short messages. That's crazy fast.
Academic cryptanalysis of the ciphers has so far shown them to be quite solid, with a very good margin of security (meaning that cryptanalysts have only been able to break significantly cut-down versions of the ciphers, quite far from full versions).
Same trick.
Possible, but doubtful. In fact, the experience with Dual EC DRBG actually makes it significantly less likely, IMO. They tried to pull the trick with that, but it didn't work because academics discovered the mathematical structure that made the backdoor possible. That has to make them worried that the same thing would happen again, and in fact the trick would be much harder to pull off with symmetric block ciphers. The thing about elliptic curves is that they have rich mathematical structure which can be exploited in clever ways (this is what makes them useful for public key cryptography) by choosing the right curves. But symmetric key block ciphers like SIMON and SPECK don't have that, making it much harder to design back doors in.
It's not impossible that the NSA has some technique that can break these ciphers -- which are actually quite similar to ciphers produced by public cipher designers -- but it really seems unlikely. Nevertheless, once burned twice shy. I don't blame standards bodies for being reluctant and waiting for public cipher designers to produce algorithms with the desirable properties of SIMON and SPECK, but without the concern about origin.
Re: (Score:2)
It could be that "crazy fast" is the main goal they're looking for. The NSA has an immense amount of compute that they can throw at cryptographic problems to try to brute force them. Reducing the amount of CPU it would take to test each guess increases their capacity by the same factor.
Now, all they have to do is make sure people use crappy PRNGs, and the NSA will be picking up the bar tab at the next FIVE EYES conference.
Re: (Score:2)
It could be that "crazy fast" is the main goal they're looking for. The NSA has an immense amount of compute that they can throw at cryptographic problems to try to brute force them. Reducing the amount of CPU it would take to test each guess increases their capacity by the same factor.
Now, all they have to do is make sure people use crappy PRNGs, and the NSA will be picking up the bar tab at the next FIVE EYES conference.
Hmm. I suppose. Seems like a stretch to me, but assuming they can get people to use crappy RNGs, making the algorithms X times faster would be the same as buying X times as much brute forcing hardware, so it could be worth doing.
But if that's what they're doing, there's no reason for people to avoid SIMON and SPECK. You may as well benefit from their high performance -- just make sure you have good randomness sources, which you need to do regardless.
Re: (Score:3)
Even $10 MCU have dedicated AES-256 hardware these days.
Sure, if you can afford such expensive hardware, AES is fine.
Re:Dual EC DRBG stuff...old news (Score:5, Funny)
Re: (Score:2)
Your sig is a lie!!! ;)
Heh. Sometimes I happen to see an AC comment and can't help myself :-)
However, when I get notified of AC replies, I delete them without looking. It's a policy that has made my slashdot commenting much more pleasant. I highly recommend it.
Re: (Score:2)
You reap what you sow (Score:5, Informative)
" In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them."
The NSA is widely believed to have done exactly this [slashdot.org] when it recommended particular elliptic curve constants quite a few years back.
Once you've betrayed people's trust, you're going to have a hard time convincing them you're worth trusting with anything that matters ever again.
Re: (Score:3)
Nevertheless, bust that bunny at your own peril. As easy as it was to forge, once broken, all the monarch's tetrapods cannot reassemble it.
Re: (Score:3)
Even worse, be a really bad actor and call on others to vouch for you and you destroy their reputation as well. Look at the reputation of the other members of the five eyes, the UK, Canada, Australia and even poor little New Zealand, all of their diplomatic reputations have been turned to shite by repeatedly falsely vouching the integrity of what have proven to be US lies. Used again and again, all the US has done is destroyed their reputation and make them worthlessly in pushing US lies on the rest of the
Re: (Score:2)
The toothpaste is out of the tube with regards to electronic surveillance. Governments will not relinquish the ability to eavesdrop, and indeed,
Re: (Score:2)
Governments will relinquish anything we insist upon, end of story. Don't believe me, you know once our nations used to be ruled be monarchies. Those mad insane homicidal maniacs would publicly torture to death anyone who disagreed with them, our not so distant ancestors forced change upon a bunch of completely unwilling homicidal maniacs (keep in mind publicly torturing people to death as an acceptable to them practice). How much fear were those arse holes able to instil in to the public, in the most insane
Re:You reap what you sow (Score:5, Insightful)
The thing is, I don't know that anyone every actually *proved* that the NSA elliptic cure constants were weak. But everyone suspects that they are because of other things they've done.
This is a point worth remembering. Once you get a bad reputation, people stop trusting you even if they can't prove that you're doing something wrong this time. And when they remember it later they'll remember it as a time they didn't fall into your trap.
And remember, perhaps those constants were good. Have you heard of anyone proving that they weren't? But would you want to trust them?
Re: (Score:3)
There was the whole Dual_EC_DRBG debacle. RSA appear to have been paid to select a poor, likely backdoored random number generator by the NSA. For further conformation it was discovered that RSA had also adopted the NSA's "extended random" system, which adds zero extra security by does make the Dual_EC_DRBG backdoor tens of thousands of times faster to use.
It would be crazy to carry on trusting any of those people.
Re: (Score:2)
Correct. The RSA paycheck is the smoking gun. The benefit of the doubt ended with it.
E-521 is not weak... (Score:2)
...at least, according to DJB [cr.yp.to].
I do understand, however, that it is difficult to produce an implementation of any of the NIST curves that are invulnerable to side-channel exploits.
Re: (Score:2)
Enigma, DES should have been the warning from history.
Revealed: how US and UK spy agencies defeat internet privacy and security (6 September 2013)
https://www.theguardian.com/wo... [theguardian.com]
"..to have cracked the codes used by 15 major internet companies, and 300 VPNs."
Microsoft handed the NSA access to encrypted messages (12 July 2013)
https://www.theguardian.com/wo... [theguardian.com]
".. agency already had pre-encryption stage access.."
"..helped the NSA to
Re: (Score:2)
an algorithm with a novel quantum solution, or some other machine that the NSA already has functioning, would make any "version" of the techniques just as susceptible to cracking.
perhaps the quantum machine is actually made easier as the encryption becomes "more powerful".
you're all idiots.
Gotta love the guy who comes out with a load of fucking gibberish and proceeds to call everybody else idiots.
"Did IQ's drop sharply while I was away?" (Score:2)
Re: (Score:2)
Nope, they just changed it internally from "Security" to "Spying". Still NSA to the outsiders.
Re: (Score:3)
How so? The NSA exists to penetrate everyone's informational security. Pushing crypto they can break is exactly in line with their purpose.
Re: (Score:2)
Not so. Their name is the "National Security Agency". Their purpose is "National Security", not "Pushing crypto they can break".
Not so, at least not according to the NSA. Yes, their purpose is to be a part of the national security framework. Their role in that is informational security: mostly, subverting the informational security of other nations. Also, protecting domestic informational security. However, they don't consider being vulnerable to the NSA as counting as "vulnerable" in terms of domestic security.
The latter is a policy that the NSA has adopted, an interpretation of their purpose.
No, it is part of their mandate.
Unbreakable crypto is, in fact, becoming the norm.
It is? Where is all this unbreakable crypto? I'm only aware of one (one-time pads), but it'
Re: (Score:3)
From what we can see from outside, the NSA firmly believes it's the smartest one in the room, and that no one else can possibly figure out a backdoor it's put in place. They really believe in the 'NOBUS' (NObody But US) theory about certain things.
Couple that with a dual-mission agency (protect 'our' communications, break everyone else's) and you have a recipe for arrogance and disaster.
Re: (Score:2)
(protect 'our' communications, break everyone else's)
That's not too much of a conflict, really, when you consider that by "our" communications, they mean the US government's, not the citizenry's.
Re: (Score:2)
No Such Acronym
Re: (Score:2)
While there is suggestive evidence that the US spying agencies knew that 9-11 was going to happen and intentionally didn't act to prevent it (suggestive, not proof) I know of no credible evidence that it was an inside job. Being paranoid doesn't count as proof.
Re: (Score:2)
Re:"Yawn" (Score:1)
Re: (Score:1)
Watch a few videos of the WTCs coming down and compare that to controlled demolition jobs.
And to any *uncontrolled destruction of a building.
There is no doubt explosives must have been placed on beforehand. Especially in WTC 7.
Firemen testimonies about a sequence of explosions while WTC 1 and 2 came down is also indicative.
Or the testimonies about huge explosions in the basements as a preparation, a characteristic of controlled demolition.
Check prof. Steven Jones who found rem
Re: (Score:2)
There is a dutch phrase which is "unity sausage" which basically translated to a bad post-ww2 sausage, all the NSA crap the US has been pushing is exactly THAT...
And what does that translate to?
Trust is hard to gain and easy to lose (Score:4, Insightful)
To make me trust you, you have to give me a good reason to do so. Unfortunately the NSA has given all sorts of reason to not thrust them with anything. Not as an American, twice not as a foreigner.
Re: (Score:3)
What really needs to happen to regain trust in crypto algorithms generated by the US is to split the NSA into two separate organizations. Move the role of securing US government communications and computer systems into a new agency. Then assign the spy on foreign nationals role to a separate organization under the CIA.
While it would still take a long time to regain the trust of allies, this is a necessary first step.
Re: (Score:2)
A necessary first step would be to understand that screwing over your allies again and again has a negative impact on your trustworthiness.
Re: (Score:2)
Useless.
Re: (Score:2)
What really needs to happen to regain trust in crypto algorithms generated by the US is to split the NSA into two separate organizations.
I disagree. Doing so would be a necessary precursor to developing trust, but there would be exactly zero reason to trust the new "defensive" agency any more than the NSA as it exists now.
Trust is earned, and the way people or entities earn trust is to demonstrate trustworthiness over time.
Re: (Score:2)
I'm a huge fan of properly-done one-time pads. They're the only actually unbreakable crypto out there.
But I'm curious about how you would solve the problem that limits their utility: key exchange.
Re: (Score:2)
Hand carried in tamper proof containers?
Expensive, but effective, high bandwidth and secure..
Re: (Score:3)
Yes. However, given that the key has to be the same length as the cleartext and can never be reused, that makes it an unworkable solution for two-way electronic communications.
It's just barely feasible for things like numbers stations.
Re: (Score:2)
Like I said, hand currier is a high bandwidth (and high latency) option. It's expensive, but with some pre-planning you can have enough key material in place to send whatever messages or data you want. You can put a whole bunch of one-time pads in a brief case if you can store them securely in small enough packages. Personally, I'm envisioning a large batch of USB keys or SS Drives with pads on them. Once you transmit the message, you destroy the pad by grinding the device into dust or overwriting it en
Re: (Score:2)
Yes, everything you've said here is correct!
But perhaps we should reset. The comment I was replying to was asserting that algorithmic encryption shouldn't be used, and OTPs should be used instead. My assertion is that's not right, because OTPs cannot be used for most of the things we use algorithmic encryption for without eliminating the good part of OTPs -- that they're unbreakable.
Re: (Score:2)
True.. Using bruit force crackable cyphers is common for one reason, it's cheap and easy to set up. If you use large keys and change them often, you will deny the adversary access to your communications for enough time to make it safe.
If it's going to take 80 years on average to find your key by bruit force attacks, and there are no back doors in your encryption algorithm, then you can be pretty sure that your adversary won't be able to read it for a couple of years. If you rotate your keys regularly, ev
Re: (Score:2)
Yes. However, given that the key has to be the same length as the cleartext and can never be reused, that makes it an unworkable solution for two-way electronic communications.
It's just barely feasible for things like numbers stations.
These days you can fit 256GB on a microSD card. For point to point communication that's quite a lot. You could also smuggle two or more separate versions by different routes and XOR them together at the destination to guard against a single courier being intercepted.
Re: (Score:2)
Grandma is using a Windows computer, and the pictures on her Hard Disk *are* already in the possession of the NSA.
Re: (Score:2)
And *that* is why it has no use for Grandma to use encryption.
Re: (Score:2)
Yes. However, given that the key has to be the same length as the cleartext and can never be reused, that makes it an unworkable solution for two-way electronic communications.
It's just barely feasible for things like numbers stations.
These days you can fit 256GB on a microSD card. For point to point communication that's quite a lot. You could also smuggle two or more separate versions by different routes and XOR them together at the destination to guard against a single courier being intercepted.
It would be less secure, but easier to do say among a team that gets together every week or once a day in the morning (for a bit of coffee, a status update and a pad exchange) ... if you periodically see people, then just have an app running in the background that does a one time pad swap in the background while you are in direct wireless communications range. Say transfer 300 Mb per person... ten people that is 3 Gb... which is doable.
Sure, people can be listening in on the pad exchange (or have a network
Re:One time pads (Score:5, Informative)
The key doesn't need to be the same length as the cleartext, it can be considerably shorter. This does weaken the encoding, but not fatally. You just need to encrypt the message before you encode it with the one-time pad with a code that's difficult to recognize. The more you shorten the key, the weaker the encoding, but shortening it by 50% is still quite safe if you use a decent encryption of the cargo.
Perfection isn't impossible, but is hideously expensive.
That said, any code that depends on factoring large primes is weak when used against quantum computers. And they may not be here today, but I wouldn't make strong bets about next year in secret government offices. So if it's worth it to you, by all means use one-time pads. And most of the expense of using them is in the transmission of the info, so you might as well use the most secure version. You can get a pretty good set of random numbers by processing a web cam of a candle flame, but turning that into terabytes of good random numbers could take awhile.
Re: (Score:1)
> The key doesn't need to be the same length as the cleartext, it can be considerably shorter.
Then it's not a One-Time Pad!
> This does weaken the encoding, but not fatally.
Then it's not a One-Time Pad!
> You just need to encrypt the message before you encode it with the one-time pad with a code that's difficult to recognize.
Why would you encrypt something before, again, encrypting it with a One-Time Pad? Compression ok, but prior 'encryption' is absolutely unnecessary.
Re: (Score:2)
The key doesn't need to be the same length as the cleartext, it can be considerably shorter. This does weaken the encoding, but not fatally.
I suppose that we may differ on the definition of "fatally", but by my thinking, it weakens it fatally. (I count something as "fatally" weakened if it can be broken in a reasonable amount of time using readily available resources).
Even using a source of random numbers that isn't close to being complete random fatally weakens it, as several entities discovered during WWII.
NTRU Prime (Score:2)
I am betting that NTRU Prime [cr.yp.to] will likely be the post-quantum asymmetric winner of the NIST competition [slashdot.org].
Re: (Score:2)
One time pads are absolutely a form of encryption. They mathematically transform the cleartext. They don't just "move things around" (they don't move things around at all).
Re: (Score:2)
It's not really just splitting data. You can generate a one-time pad, distribute it to everyone you want, and then at a later point use the pad to encrypt an arbitrary message to them.
Re: (Score:1)
Wouldn't that be a terrible way to distribute pads?
You'd simple need to listen to them, and then try various alignments until decrypted.
Also, 1 byte a second isn't much throughput.
Re: (Score:2)
The NSA trusts the NSA.
No one trusts the USA (Score:1)
No one inside or outside of the USA trusts america anymore, you don't have any friends you have allies that are compliant out of fear and nothing else. ask anyone in Canada or the UK, your closest allies, and closest cultural parallels how they feel about the united states, and you'll find that it is almost invariably, disgust.
Re: (Score:2)
Re: (Score:1)
Electing a fucking moron doesn't appear to be helping much.
Right. Am I glad we didn't elect that fucking moron...
How did the NSA become the decider of "good"? (Score:2)
How is it there wasn't a community of, I dunno, open source crypto developers, paid for by, I dunno, college research grants across the globe to figure this stuff out?
tl;dr You rely on a spy agency for 30 years for your crypto protocols, don't be surprised they cheated. One word: Sucker!
Re: (Score:2)
How is it there wasn't a community of, I dunno, open source crypto developers, paid for by, I dunno, college research grants across the globe to figure this stuff out?
There was (not open source, but not secret either). It just wasn't in the US.
The laws in those days presented a very strong disincentive to engage in crypto work within US borders.
Four eyes better than two, but Five Eyes worse... (Score:4, Interesting)
The U.S. is spearheading Five Eyes [wikipedia.org] which will propose mandatory backdoors [theregister.co.uk] in all strong encryption. I don't think that this is a coincidence.
ISO? (Score:2)
Re: (Score:2)
SIMON and SPECK are simple block cipher designs. You don't need an ISO for that. What's next? An ISO for HTML header tags?
You need ISO for getting WTO protection for selling your implementation internationally.
Closed door meetings at ISO? (Score:4, Informative)
>The dispute, which has played out in a series of closed-door meetings around the world over the past three years and has not been previously reported, turns on whether the International Organization of Standards should approve two NSA data encryption techniques, known as Simon and Speck.
I was in a couple of those meetings in ISO/IES SG27/WG2.
Indeed, the NSA were there and were pushing Simon and Speck.
Indeed a handful of other countries were arguing against Simon and Speck, but not on the merits of the algorithm, but on the history of the USA in crypto standards and SP800-90A in particular.
They couldn't muster any real criticism of Simon and Speck, and that's because they are excellent algorithms. They are 3X more efficient that AES in whatever metric you choose (size, performance, area, power). They are easily extended to 256 bit block sizes (although NIST and the NSA have declined to do that while leaving obvious holes in the spec where the larger block sizes go. The security analysis is aided by the simplicity of the algorithms - a simple round function iterated many more times than for AES.
ISO is a political organization and the arguments are political. Don't let technical considerations muddy the waters.
Re:Closed door meetings at ISO? (Score:4, Insightful)
that's because they are excellent algorithms.
Says you and the NSA.
Here's the thing -- if the algorithms include an intentional weakness, it could take years of study to find it. That nobody's found weakness yet isn't compelling in terms of increasing trust.
Because of this, a large amount of trust is required when accepting them. When the entity that is very eager to get these adopted is one that has clearly demonstrated that it can't be trusted, rejecting the algorithms is completely reasonable.
Perhaps they're fine, I don't know, but it seems prudent to be extraordinarily cautious about them before blessing them as standards. Let everyone study them for a few years to reduce the need to trust the NSA.
Re: (Score:2)
that's because they are excellent algorithms.
Says you and the NSA.
Perhaps they are good. And the NSA doesn't want them adopted. But playing upon the suspicions of the rest of the world that they are a bunch of lying scum, they promoted them. Knowing that this would call the algorithms' security into question and get them rejected.
Re: (Score:2)
that's because they are excellent algorithms.
Says you and the NSA.
Perhaps they are good. And the NSA doesn't want them adopted. But playing upon the suspicions of the rest of the world that they are a bunch of lying scum, they promoted them. Knowing that this would call the algorithms' security into question and get them rejected.
Do you have an interest in turtles?
Re: (Score:2)
>Let everyone study them for a few years to reduce the need to trust the NSA.
How many more years would you like? It's been 4 and a half so far and it's been very well studied.
I don't think the number of years of study is actually something you care about or you would know how much is enough. If you don't know how much is enough, then asking for more years is just a way of trying to make it go away by delaying it.
Who else other than the people who have published all the papers in IACR journals would you h
Re: (Score:2)
When you dispense with the technical arguments, all you have left are arguments about parentage, which don't really help with understanding the worth of algorithms.
This is true -- and pretty much the point I was making. There is no set amount of study that can guarantee the algorithms, but the more study, the better the chance that they're OK. So the amount "required" depends in large part on how much you trust where they came from. The parentage of these is not trustworthy, so it's not unreasonable to avoid them. In fact, it's the smartest thing to do from a security standpoint.
Re: (Score:2)
The problem is that people won't find out what's wrong with those proposals until awhile after they start depending on them. Saying "study them" doesn't convince. I've tried to debug too much code that everyone said was bug free...until they found it wasn't.
Re:Closed door meetings at ISO? (Score:5, Interesting)
The "merits of the algorithm" is communally undefined if the design party is keeping secret the existence of differential cryptography—or any other advanced mode of attack—as IBM and the NSA once did with the DES. It was pretty clear that something fishy had gone into the design of the S-boxes. Whether fair or foul is impossible to decide when you're on the outside looking in (turns out, for DES, it was fair—foul play was confined to mandating a short key length).
What people don't understand is that as much as the Americans would like to read everyone else's traffic, it's far worse if any backdoor leaked to an adversary (your whole financial system is protected by these codes), so they were sensibly reluctant to put one in—until they invented the one-way back door, where only the designers could ever know. Unable to resist the siren call of this new brass ring, the NSA immediately blew their entire history of trust (which had always been more out of enlightened self-interest than gentlemanly) into a giant mushroom cloud.
It remains difficult to decide whether "merit" can be debated in these matters on a level playing field.
On the other side of the coin, while I'm far from a serious cryptographer, Specks' ARX design does not appear to leave many places for newly discovered snookery to hide itself.
That said, banning the runt versions smells like prudence to me, as any covert American attack is probably a combination of a downgrade attack—tricking a cipher to operate at less than full strength (world and dog are not freaking out over the Intel Management Engine for no reason)—perhaps injecting some known plaintext, finished off with a giant can of precomputed whup ass (the mechanism of attack one can best keep confined to your side of the fight is a multimodal attack).
Once you take the downgrade attacks off the table, it's a lot easier to swallow the inequitable debate on merit as a pure cipher.
Not buying it. I really don't see how you performed that neat dissection of history from technology from capabilities, without the use of a white glove and a black hat.
____
Addendum:
Researchers Find a Way to Disable Much-Hated Intel ME Component Courtesy of the NSA [bleepingcomputer.com] — 28 August 2017
True to form, the NSA's greatest terror is being hoist by their own petard.
They don't advertise this fear, because they prefer to viewed through the do-unto-others side of the lens. Trying to turn these weapons into technological diodes is an enormous practical constraint.
That, and resource saturation (what they can do and what they can afford to do are two different beasts) are in my experience the only reliable external vantage points for 99.999999% of the planet's population incapable of wading into the merit debate at anywhere near eye level.
Re: (Score:2)
>That said, banning the runt versions smells like prudence to me,
This part is sound. At the NIST lightweight crypto workshop, there was a clear consensus among cryptographers that we didn't want weak algorithms with small block sizes and small keys. We wanted strong algorithms that were more efficient than current standardized algorithms like AES.
So Simon and Speck were reasonable examples of such algorithms, provided you stuck with 128+ key sizes and block sizes.
However my primary criticism is the lack
Solution: (Score:2)
Use all encryption methods from all countries on top of each other. That way no one entity can unwrap the whole thing. Only the person with all 190+ keys.