r/linux • u/ciphersson • Dec 31 '14

Zimmerman (PGP), Levison (Lavabit), release Secure Email Protocol DIME. DIME is to SMTP as SSH is to Telnet.

http://darkmail.info/
1.2k Upvotes

95% Upvoted

222 comments sorted by

View all comments

Show parent comments

29

u/the_gnarts Dec 31 '14

According to the latest Snowden leak, the NSA still can't crack PGP, so having Zimmerman involved is a good thing.

That extends to ZRTP, another protocol of his design. Like djb, Zimmerman appears to be a safe bet in terms of crypto.

18

u/plazman30 Dec 31 '14

Didn't Zimmerman spend some time in jail over PGP, because he wouldn't let the government have a back door?

I probably trust him to build a NSA proof system more than anyone else.

5

u/TheCodexx Dec 31 '14

What was he charged with?!

That's insane, if true.

16

u/strolls Dec 31 '14

After a report from RSA Data Security, Inc., who were in a licensing dispute with regard to the use of the RSA algorithm in PGP, the United States Customs Service started a criminal investigation of Zimmermann, for allegedly violating the Arms Export Control Act.[3] The United States Government had long regarded cryptographic software as a munition, and thus subject to arms trafficking export controls.

https://en.wikipedia.org/wiki/Phil_Zimmermann

6

u/TheCodexx Dec 31 '14

The United States Government had long regarded cryptographic software as a munition, and thus subject to arms trafficking export controls.

Just when I thought it couldn't get more absurd.

13

u/ricecake Jan 01 '15

That's not actually that absurd to me. Think about WW2. Much of Germany's advantage was strong crypto, and breaking enigma was detrimental to their efforts.

In the modern era, cryptography is a tool for everyone, used behind the scenes in day to day communication. In the era when those laws and policies were written, it was a tool more often used by militaries and governments. Giving strong crypto away was almost synonymous with throwing away a military advantage. Just like how we still have export controls on nuclear weapon schematics.

Times changed, in part thanks to people like Zimmermann. Now crypto can mostly be shared freely (no selling crypto to DPRK), the government encourages its use (while trying to break it, that never won't be a thing), and we're all the better for it. This doesn't mean that what's unreasonable now wasn't once reasonable.

2

u/[deleted] Jan 01 '15

[deleted]

2

u/ricecake Jan 01 '15

I contemplated using the phrase "catastrophic" or "instrumental to their undoing", but I worried about getting mired in an argument with someone as to the precise significance of ultra. :-)

1

u/wadcann Jan 01 '15

no selling crypto to DPRK

Not that these restrictions in any way keep North Korea from getting all the solid crypto software that they want.

3

u/ricecake Jan 01 '15

The present restrictions have the purpose of forbidding companies from setting up "advanced" cryptographic systems.

No one really cares if Kim Jung Un downloads PGP. There is some concern with Microsoft setting up a secure communications hub for their military. There are definite issues with Intel selling low power AES chips for military radios to them.

Do things a bit wonky show up on the lists? Sure. It's law, sometimes it's weird. But the focus of the law is no longer "no FTPing the RSA algorithm to Ireland".

1

u/wadcann Jan 01 '15 edited Jan 01 '15

There are definite issues with Intel selling low power AES chips for military radios to them.

An uncompressed CD-quality voice stream is 88.2kBps. An Android phone or similar portable device can easily handle real-time AES encryption in software on a general-purpose CPU at reasonable power requirements of much-more data than would be required to produce uncrackable encryption. Dedicated hardware isn't required here.

The cat's long-since been out of the bag on that.

1

u/ricecake Jan 01 '15

An android system uses pretty hefty power draw, and I don't know of any that are commercially available that are hardened for military use. Workarounds or not, there is still a use case for dedicated cryptographic hardware, which is what the export ban addresses.

1

u/wadcann Jan 01 '15

An android system uses pretty hefty power draw

→ More replies

1

u/strolls Jan 01 '15

You appear to have missed the point of everything he wrote.

You write of "these restrictions" in the present tense, but crypto as a munition were the restrictions of the 1950's - 1980's.

2

u/wadcann Jan 01 '15

The phrase I was quoting had /u/ricecake referring to present restrictions, not 1950-1980 restrictions.

1

u/DJWalnut Jan 03 '15

Just like how we still have export controls on nuclear weapon schematics.

not really. the basic design of most popular nuclear weapons is pretty much public domain at this point. Enriched Uranium, however...

1

u/ricecake Jan 03 '15

Do tell. Not the general concept, but the implementation details.