{"id":954,"date":"2013-09-05T21:02:39","date_gmt":"2013-09-06T02:02:39","guid":{"rendered":"http:\/\/www.nathanhunstad.com\/blog\/?p=954"},"modified":"2013-09-05T21:04:56","modified_gmt":"2013-09-06T02:04:56","slug":"breaking-encryption","status":"publish","type":"post","link":"https:\/\/www.nathanhunstad.com\/blog\/2013\/09\/breaking-encryption\/","title":{"rendered":"Breaking Encryption"},"content":{"rendered":"

The big news today is that the NSA has \u201cbroken\u201d much internet encryption<\/a>. Details are scarce, and comments are plentiful, but it\u2019s important to understand at a high level what it means to \u201cbreak\u201d encryption. There are essentially three ways to \u201cbreak\u201d encryption, and they all mean different things.<\/p>\n

<\/p>\n

The Math:<\/strong> Cryptography is based on math. Strong symmetric-key algorithms<\/a> like AES<\/a> are thought to be pretty much invulnerable to realistic mathematical attacks. Public-key cryptography<\/a>, because it relies on what are thought to be \u201chard<\/a>\u201d mathematical problems, are a bit more at risk. There\u2019s always the chance that we will find more efficient factoring or discrete logarithm algorithms (say that ten times fast). However, based upon what little is known, it\u2019s unlikely that the NSA has made advances in math that are unknown to the rest of the world. The math behind cryptography remains secure.<\/p>\n

The protocols:<\/strong> Just because the math is right doesn\u2019t mean we can\u2019t divulge information from the improper use of it. There are a number of attacks against certain protocols, like the CRIME<\/a> attack against TLS. The math isn\u2019t at fault here, but how it is used at the protocol level is. Nevertheless, it sounds like the NSA isn\u2019t taking advantage of these poor protocols for much of their interception, which leaves\u2026<\/p>\n

The implementation:<\/strong> From what we know, the NSA is \u201cbreaking\u201d cryptography by getting software developers to put backdoors into their products. This is no more of a \u201cbreak\u201d than if the government made a copy of your house keys and kept it for themselves. Even further, for all we know Gmail, Hotmail, Yahoo, AOL et al have happily given the NSA their private encryption keys, which no more breaks things than believing your lock is broken when you leave the front door open. Until we hear differently, it\u2019s likely that all of the NSA\u2019s \u201cbreaks\u201d lie at this level.<\/p>\n

What does this mean? First, putting backdoors in products leaves us all at risk. I\u2019m old enough to remember the Clipper Chip<\/a> controversy, which was essentially an encryption method supported by the NSA that conveniently included a \u201ckey escrow\u201d portion that gave them the ability to decrypt any phone conversations they wanted. This plan proved to be not at all popular and went down in flames, because key escrow, besides sounding gross, is an inherent huge backdoor that could have been used by bad guys to defeat the encryption. You can\u2019t guarantee that only the good guys will use your master backdoor key. Also, if the public gets wind of it, they\u2019ll probably revolt, which is why the NSA likely decided to take a more covert approach in the future to building backdoors into things.<\/p>\n

Second, this is beyond the pale. It\u2019s one thing to collect data that is being collected anyway and analyze it better (the point I was making earlier<\/a>); it\u2019s quite another to build a backdoor that can and will be used by anybody to defeat the encryption that powers internet commerce today. I don\u2019t\u2019 think it\u2019s hyperbole to claim as Bruce Schneier does that the internet has been betrayed<\/a>.<\/p>\n

Third, there is hope. The math behind encryption is probably still secure. If we can\u2019t trust large software companies to not put backdoors in products, there\u2019s open-source software that shows the source code for the world to see. Not all of us can interpret that code, but enough people exist in this world that both have the ability and have the desire to ensure that backdoors don\u2019t exist to give us some confidence.<\/p>\n

This is likely the biggest revelation so far about the NSA\u2019s abilities. What happens after this is anybody\u2019s guess.<\/p>\n","protected":false},"excerpt":{"rendered":"

The big news today is that the NSA has \u201cbroken\u201d much internet encryption. Details are scarce, and comments are plentiful, but it\u2019s important to understand at a high level what it means to \u201cbreak\u201d encryption. There are essentially three ways to \u201cbreak\u201d encryption, and they all mean different things.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[127],"tags":[239,237],"class_list":["post-954","post","type-post","status-publish","format-standard","hentry","category-security","tag-cryptography","tag-nsa","entry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t