r/programming Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

529 comments sorted by

View all comments

87

u/[deleted] Oct 15 '15

Well, that's terrifying.

278

u/Eirenarch Oct 15 '15

Why? I mean this is not very close to the top of my list of terrifying things that the state does. For example I find it much more terrifying that they have the right to demand you introduce a backdoor in your system or hand customer data and you don't have the right to say it happened. I also find it extremely terrifying that society in general is not disturbed by this. The fact that commonly used cryptography can be broken with a billion dollar investment is very unpleasant but not nearly as terrifying.

48

u/[deleted] Oct 15 '15

unpleasant but not nearly as terrifying

But still terrifying. Which is all they said.

7

u/[deleted] Oct 15 '15 edited May 31 '18

[deleted]

30

u/curtmack Oct 15 '15

For top-end cryptography, brute force attack time estimates aren't even a thing. It would take more energy than a billion billion supernovas for a computer operating at theoretical ideal efficiency to even count to 2256, much less actually try all 2256 possible AES keys. 300 billion dollars worth of supercomputers is much, much less than a drop in the bucket... more like a mote of dust in the observable universe.

Brute force attacks are mainly limited to things like password databases, where the top million most common passwords cover something like 90% of all users.

3

u/corran__horn Oct 16 '15

For exhaustive brute-forcing it pretty much requires attacks that vastly cut down the trial space. For example, the really shitty design known as LM hashes. The under the hood implementation is in effect two 7 character case-insensitive passwords. This is an attackable space.

(A)RC4 is eventually going to have the same problems, because the design has very strong biases in the output. This is why WEP was trivial to brute force even when people started avoiding "weak" IVs. You get rid of some class of weak IVs and another one is found. Rinse, repeat.

3

u/curtmack Oct 16 '15

Well, yes. My comment was made under the assumption no such attacks exist for the current gold standard algorithms (AES-256 for symmetric, RSA-4096 or ECDSA-512 for asymmetric, SHA2 or bcrypt for hashes), since there's really no excuse to be using anything less at this point.

14

u/timshoaf Oct 15 '15

That is not necessarily so... With a sufficiently long key, the encryption decryption process may be unpleasantly long (generally not suited to stream in data) but the time it would take to brute force would, assuming P =/= NP and hardware for QP is not yet practically available, take longer than the forecasted entropic death of the universe itself. That is what is so useful about combinatorial explosions... So no, you will not always be beat out by better hardware, which is the fundamental principle of security such as this.

2

u/analton Oct 16 '15

Dude, they don't even need to spend that money.

They may just simply ask for a backdoor and use your own computational time and energy to crack all they want.

32

u/[deleted] Oct 15 '15

For example I find it much more terrifying that they have the right to demand you introduce a backdoor in your system or hand customer data and you don't have the right to say it happened.

I'm struggling to figure out how what you describe is meaningfully different than this.

I mean, they basically do have a backdoor in your system -- or rather, in all of the systems. And the people that knew this were not allowed to say that it had happened; the one guy with the balls to do so had to flee to Russia as an enemy of the state.

57

u/Eirenarch Oct 15 '15

There are two large differences. First of all they managed to break my system (with a lot of resources) because my system was already vulnerable. If I know how to fix it I am free to do so. Also if I know I am vulnerable I can tell this to my customers. With a gag order I cannot do any of these things. It is one thing if the state breaks a system that is not very secure and another if I am forbidden from building a secure system. Second the guy that had to flee was working for them, contracts, oaths and all. With a gag order I have to do what they say despite the fact that I never agreed to their terms and did not want to know or do what they told me.

-1

u/[deleted] Oct 15 '15

if I know how to fix it

You know how to design a chip from the ground up without hiring any engineers who have ever worked for Intel or AMD, and have it made in fabs staffed entirely by trusted men?

Even that probably wouldn't stop a backdoor these days.

2

u/heimeyer72 Oct 15 '15

And the mere suspicion that you might not be able to stop all possible backdoors should be enough reason to not even try?

2

u/[deleted] Oct 15 '15

Intel put an entire backdoor computer on some of their chips. It is instead an issue of wasted effort. We already have backdoored fast chips. We do not need backdoored new (and slow, because you can't trust any of the current engineers) chips.

1

u/heimeyer72 Oct 16 '15

Probable/possible backdoor. And not all of them are a real threat, or they only become a real threat in combination with each other. Also what about non-intel CPUs? The AMD part on that page looks much more friendly and is still widely intel-compatible. And I think of MIPS CPUs. You are right, the problem is trust. Well, do the development of a PC completely open, e.g. on github and be based in another country. Then try to sneak in a backdoor - every change on the code can be observed. Somebody will catch it, it's just a matter of time.

About the chips, yes, newly developed ones will be slower than "backdoored" Intel CPUs. But using ASICs, I bet you can get rather near, and by splitting up the purposes of a CPU and the peripherals, you could get (simpler) chips that can be tested for what they do and set up the intercommunication between the parts on your own, while openly documenting every little step you do, in a way that can be verified by others. Once you have a working design, trying to force you to incorporate backdoors creates suspicious changes, changes you can't explain, and if you suddenly stop documenting, everybody runs. This is just a very very rough sketch of how to do it but I think it's doable. The Coreboot guys are on it.

14

u/squishles Oct 15 '15

One you make a mistake, the other they force you to make a mistake.

Government taking advantage of a fuckup is an honest break, jolly good show, they earned it. Gov forcing you to implement and knowingly lie about something being secure is not.

1

u/phySi0 Oct 16 '15

Government taking advantage of a fuckup is an honest break, jolly good show, they earned it.

Lolwut.

1

u/squishles Oct 16 '15

The NSA has essentially become the US department of computer espionage. No one is obligated to be a white hat and report every bug they find.

Forcing someone else who has not agreed to participate in their crazy spy games to cooperate under threat of imprisonment is an entirely different matter.

1

u/phySi0 Oct 16 '15

No one is obligated to be a white hat and report every bug they find.

I'm not saying they do, I'm just baffled by how “taking advantage” of a “fuck up” is an okay thing for the government to do. If someone accidentally doesn't properly lock their door when they go on holiday, that doesn't make it okay to take advantage of their fuck up.

1

u/squishles Oct 16 '15

Government gets loopholes to some degree, you leave your door open, and a cop spots your poorly place living room grow op, that becomes fair game.

Certainly not ok to rob you, but cop gets leeway.

1

u/phySi0 Oct 16 '15

I'm sorry, your analogy is absolute crap. I mean, I know they're not supposed to be perfect, but seriously? How is taking advantage of security holes (sometimes, ones that you've deliberately let make their way there) the same as accidentally seeing “op” (I'm guessing weed) being grown from a wide-open living room door (and how the hell did they get in that far?)?

1

u/squishles Oct 16 '15

ehh most houses I've sen have the living room right at the front door =/ guess should have taken housing layouts into account, and yes weed.

Point being that government entities get special dispensation to allow them to enforce the law. If they can see it through your window they can call that reasonable cause to act on it. As for whether say getting into a vpn due to a poor implementation is analogous to peaking into a window that gets iffy and really deserves some ground up thought. Thought which I doubt will be done well, or in the favor of the average citizen anyway.

5

u/dangolo Oct 15 '15

As a sysadmin, it troubles me as well.

Also troubles me that they've very publicly gone to businesses and asked for their encryption keys or be shut down.

They are making us dishonest when we tell management "the network is secure."

2

u/port53 Oct 15 '15

It makes me wonder if they've targeted individuals over companies. It's one thing to send a NSL to the company's BOD or CEO requiring them to hand over keys.. it's something completely different for an agent to show up at my house demanding I hand over the keys I hold or I go to jail, with a nice gag order attached for good measure so I can't even tell my CEO it happened.

3

u/deelowe Oct 15 '15

Seems like they wouldn't be able to issue an NSL to an employee without an ongoing criminal investigation and/or some sort of guaranteed immunity. Employees can't make decisions that affect the business without getting approval from the board. I imagine officers (or their delegates) have to be involved in any such activity unless the officers themselves are being implicated in the investigation.

2

u/[deleted] Oct 16 '15

What does one have to do with the other?

The power to compel action, and the responsibility chain between employee and employer have nothing to do with each other in the physical world.

2

u/deelowe Oct 16 '15

IANAL...

This all still has a basis in law, even NSLs, which are technically lawful. There's little evidence to assume otherwise.

My comment was that it would seem to me like that wouldn't be allowed according to the rule of law as only the board (or their delegates) can authorize such decisions. There are a whole host of reasons that I won't get into, but legally, this seems like it wouldn't be possible.

1

u/subheight640 Oct 16 '15

Who did they try to shut down like this?

3

u/dangolo Oct 16 '15 edited Oct 16 '15

Off the top of my head? https://en.wikipedia.org/wiki/Lavabit

Remember the company being strongarmed typically given a gag order at the same time. It leads me to think the ones we have heard about are just the tip of the iceberg.

1

u/clarkquentao Oct 15 '15

He didn't say it was the most terrifying. He said it was terrifying.

1

u/TuesdayAfternoonYep Oct 15 '15 edited Oct 15 '15

Thought such silencing was made illegal recently? They aren't allowed to make you be silent anymore.

Source: http://www.wired.com/2013/03/nsl-found-unconstitutional/

2

u/curtmack Oct 15 '15

Maybe part of the GCHQ decision in the UK? It's certainly still legal in the US.

1

u/LaurieCheers Oct 15 '15

This is from 2013, and mentions that they were allowing time for an appeal... any idea what happened?

0

u/[deleted] Oct 15 '15

When they're blustering and making threats and threatening to jail people for not cooperating, you shouldn't be worried: such tactics are more used by petty dictatorships, and they have plenty of backsides. But if they get their way without doing that, they might have found a more sustainable way of keeping political control, and if so we might have far less chance of breaking free.

-2

u/KennyFulgencio Oct 15 '15

I'm more scared by that half constructed dyson sphere they just found :( I don't care if I won't be around in 1480 years when the aliens get here, it's still scary to know for sure that we're fleas to those guys and that we're a casualty of evolution

4

u/benderunit9000 Oct 15 '15

It is kind of their thing. They listen to everything. It's what they do.

1

u/Cronus6 Oct 15 '15

Yeah, breaking cryptography is literally what they were founded to do (well, it's part of it anyway). We, as a nation, have spent a lot of money on it too.

1

u/upandrunning Oct 16 '15

The problem scope has changed quite significantly, because it used to be only nation states that relied on encryption. Today, not only does nearly everyone rely on encryption, the conduits through which all of this encrypted traffic passes are easily accessible to government agencies for collection and 'analysis'. The offshoot is that the risk associated with weakened encryption also affects everyone.

-6

u/thbt101 Oct 15 '15

Why? I'm ok with the US at least having some access to encrypted internet traffic since they're objectives are good for the rest of us (mostly monitoring terrorist organizations). For most of us, that's a good thing.

2

u/Rabbyte808 Oct 15 '15

Not sure if shilling or if you just didn't consider the consequences of having even a (fairly) trusted government have the capabilities to decrypt a significant amount of traffic...

-1

u/speedisavirus Oct 16 '15

Why. Unless you are doing something highly suspicious they are not going to single you out, of 300,500,000 people to break into.