Hacker News Reader

Comment by exelius | Hacker News Reader

Nobody has any proof, but it's strongly suspected. The NSA wrote or had a hand in writing every widely-supported encryption algorithm, and they have a military-scale budget (seriously; the NSA's non-clandestine budget is larger than the entire military budget of every country except the US and China) to spend on hardware to brute-force encryption. Cyberwarfare is a top strategic priority of the US Military, and cyberwarfare is made much easier when you can break encryption.

They have the motive, the resources, and the knowledge to break encryption routinely. It's also standard tradecraft for a spy agency to hide any proof that they have a capability to create uncertainty among their enemies whether or not they do. So no, nobody has proof that the NSA can break encryption, but we do have proof that they have everything they would need to develop that capability.

View on HN

So, no?

Brute forcing the strongest forms of modern crypto theoretically would take unfathomably amounts of energy and/or time. It's not a matter of bigger datacenters or faster hardware. Without discovering a flaw (which we have no evidence of) or inventing completely different computing paradigms (which don't exist) there's no reason to believe this is possible today.

Sure, some cryptography is weak and it's well documented. Others, well, we'd need a Dyson sphere to brute force...

> Others, well, we'd need a Dyson sphere to brute force...

Not that I'm disagreeing with you but the German High Command thought much the same about the Enigma.

The only rational response in the face of the Snowden leaks is to assume everything is compromised and either defend in depth or simply not commit it to a computer (under the assumption what you are keeping private is that important).

If I was a high end cryptographer or someone in that sphere I'd also likely be (if they aren't already) be using an air gapped machine, the threat is that pernicious.

As usual, with Enigma the human operators were the weak link. If they had used Enigma properly, it probably could not have been broken before the end of the war.

Snowden has stated that he doesn't think modern encryption algorithms have been compromised.

Which is reassuring but not absolute, if the NSA did have the ability to break that stuff the strategic advantage would be so high it might be classified at an entirely different level.

It is of course impossible to say without evidence.

The only safe assumption is that the NSA knows how to break modern crypto. Otherwise, you're taking a risk every time you encrypt something you don't want them looking at.

And if the NSA found a flaw in a crypto algorithm, do you really think they would leave evidence of that anywhere? You're talking about an organization that basically invented the entire idea of OpSec...

The Snowden leaks gave a pretty good picture of what the capabilities are. They do most certainly not have backdoors into every possible crypto system.

SHA1 should probably be replaced for example, but thats not all crypto by a longshot.

Their are good talks at the C3 confernce about 'Post Snowden Crypto', specially by 'ruedi'. He goes into detail about all the major crypto system and explains how risky they are, and what we know about the NSAs efforts to break them.

https://media.ccc.de/search?q=ruedi

What Snowden leaked is a lower bound on the NSA's capabilities, not an upper one. And even in the "best" case, where he and the journalists involved exercised no discretion about what he leaked and no data was classified beyond even his access, that data is now several years old.

You dont have any evidence and making assertinons. Im basing my information on the best information we have and on the optinions of reputal cryptigraphers.

Which part of that comment was an unsupported assertion? The "assertion" that documents leaked in 2013 are now several years old? The "assertion" that not every single capability the NSA has ever developed is now public knowledge?

Reply on news.ycombinator.com