Hacker News Reader

Comment by zeteo | Hacker News Reader

This doesn't follow. The article makes two points:

1. The NSA is allowed to store and analyze encrypted data longer than unencrypted

2. US citizens' encrypted data will be treated the same as non-citizens'

It still seems you have a much better expectation of privacy by encrypting your data and trusting to mathematical proofs that it would take thousands of years to break it; rather than leaving it in the clear, and trusting to five year storage limits and the supposed privileges of American citizenship.

View on HN

Keep in mind that as a rule of thumb, its useful to assume that the NSA is about 20 years ahead of the public in crypto research. Even if systems like HTTPS and Tor appear secure today, the NSA may already have knowledge of weaknesses that we don't.

Do you have any kind of source or citation for this? Where does "20 years" come from?

I think I first heard this when I took a crypto course in college and read Applied Cryptography, by Bruce Schneier.

There was a section in there about the development of DES. At some point the researchers at IBM showed their work in progress on DES to the NSA, and the NSA made a few suggestions on improvements, one of them was a different set of S-Boxes (basically a bunch of constants used as part of the cipher.) IBM analyzed the new S-Boxes and could find no weaknesses so they used the ones the NSA recommended.

Over a decade later, differential cryptanalysis was discovered and it turned out that the tweaks the NSA had suggested made DES particularly resistant to differential cryptanalysis.

After doing some googling, it seems like the gap has closed since that book was written. They are still ahead, but not as much as they were in the 80's and 90's. Or maybe that's just what they want us to think ;)

20 years feels a bit strong.

But, in general, NSA / GCHQ have many mathematicians working on crypto. Some of them are breaking existing products. Some of them are breaking newer algorithms. Some of them are working on creating newer algorithms.

One example of an important cryptosystem that was invented independently in secret before it was invented is public is public-key crypto. (https://en.wikipedia.org/wiki/Clifford_Cocks)

Employment opportunities for mathematicians are slim, and GCHQ is known for tolerance of the sometimes odd behaviour of people with Asperger's.

Tor is already vulnerable to anyone that can watch a large enough portion of global network traffic. Thanks to the NSA taps on US internet use & the (recently revealed) taps that GCHQ puts on EU internet traffic travelling through the UK it seems likely that the NSA can track Tor users in the US and most of Europe in real time if they choose to.

(It's fairly likely that the US has covertly tapped undersea cables elsewhere in the world as well.)

Yes, but at least Tor <-> Tor(.onion sites) traffic should still be secure. It's browsing the open Internet that is unsafe.

GCHQ monitors communications world wide.

This is recently reported, but has been known for many many years. (Longer than the lifetimes of some HN readers.)

It is the publicly stated mission of GCHQ.

Could you please provide sources to what you are mentioning?

see

https://news.ycombinator.com/item?id=5939782

Reply on news.ycombinator.com