Hacker News Reader

Comment by deelowe | Hacker News Reader

> They are pro encryption because they can already crack the algorithms

Got proof of that?

Nobody has any proof, but it's strongly suspected. The NSA wrote or had a hand in writing every widely-supported encryption algorithm, and they have a military-scale budget (seriously; the NSA's non-clandestine budget is larger than the entire military budget of every country except the US and China) to spend on hardware to brute-force encryption. Cyberwarfare is a top strategic priority of the US Military, and cyberwarfare is made much easier when you can break encryption.

They have the motive, the resources, and the knowledge to break encryption routinely. It's also standard tradecraft for a spy agency to hide any proof that they have a capability to create uncertainty among their enemies whether or not they do. So no, nobody has proof that the NSA can break encryption, but we do have proof that they have everything they would need to develop that capability.

The Snowden leaks gave a pretty good picture of what the capabilities are. They do most certainly not have backdoors into every possible crypto system.

SHA1 should probably be replaced for example, but thats not all crypto by a longshot.

Their are good talks at the C3 confernce about 'Post Snowden Crypto', specially by 'ruedi'. He goes into detail about all the major crypto system and explains how risky they are, and what we know about the NSAs efforts to break them.

https://media.ccc.de/search?q=ruedi

What Snowden leaked is a lower bound on the NSA's capabilities, not an upper one. And even in the "best" case, where he and the journalists involved exercised no discretion about what he leaked and no data was classified beyond even his access, that data is now several years old.

You dont have any evidence and making assertinons. Im basing my information on the best information we have and on the optinions of reputal cryptigraphers.

Which part of that comment was an unsupported assertion? The "assertion" that documents leaked in 2013 are now several years old? The "assertion" that not every single capability the NSA has ever developed is now public knowledge?

So, no?

Brute forcing the strongest forms of modern crypto theoretically would take unfathomably amounts of energy and/or time. It's not a matter of bigger datacenters or faster hardware. Without discovering a flaw (which we have no evidence of) or inventing completely different computing paradigms (which don't exist) there's no reason to believe this is possible today.

Sure, some cryptography is weak and it's well documented. Others, well, we'd need a Dyson sphere to brute force...

> Others, well, we'd need a Dyson sphere to brute force...

Not that I'm disagreeing with you but the German High Command thought much the same about the Enigma.

The only rational response in the face of the Snowden leaks is to assume everything is compromised and either defend in depth or simply not commit it to a computer (under the assumption what you are keeping private is that important).

If I was a high end cryptographer or someone in that sphere I'd also likely be (if they aren't already) be using an air gapped machine, the threat is that pernicious.

Snowden has stated that he doesn't think modern encryption algorithms have been compromised.

Which is reassuring but not absolute, if the NSA did have the ability to break that stuff the strategic advantage would be so high it might be classified at an entirely different level.

It is of course impossible to say without evidence.

As usual, with Enigma the human operators were the weak link. If they had used Enigma properly, it probably could not have been broken before the end of the war.

The only safe assumption is that the NSA knows how to break modern crypto. Otherwise, you're taking a risk every time you encrypt something you don't want them looking at.

And if the NSA found a flaw in a crypto algorithm, do you really think they would leave evidence of that anywhere? You're talking about an organization that basically invented the entire idea of OpSec...

Any proof would obviously be classified. But there is a lot of circumstantial evidence.

1. He made the statement in the OP. That implies that normal people using modern encryption does not impose a significant barrier to the NSA doing their jobs. Contrast with the 90s when the NSA pushed for the clipper chip, presumably because they couldn't eavesdrop effectively otherwise.

2. The NSA uses its own secret suite A algorithms for things they really care about keeping secret, not the suite B algorithms like AES that they recommend for the rest of us through NIST.

I'm sorry if this comes across as rude, but that all sounds entirely speculative.

Hopefully it sounds like exactly what I said it was in the first sentence. The only part I could reasonably see as being called "speculative" is the second sentence of the first item, which is clearly marked as an inference.

Reply on news.ycombinator.com