Hacker News Reader

Comment by pvnick | Hacker News Reader

I've been saying this for a while now (well, a couple weeks anyway). The defeat of the cryptography behind SSL communication is an inevitability given sufficient time, so it would absolutely behoove intelligence agencies to store everything, including encrypted data. As Snowden said, one of the dangers of these programs is the possibility of going back in time to paint a normal life in the context of a wrongdoer. In a few decades, when powerful computers and algorithms have all but obliterated current encryption technologies, all of your current "safe" data might as well have been sent plaintext.

Or the NSA could just demand private keys via FISA letter.

View on HN

Why do people keep repeating this trope that it's only a matter of time before encryption will be broken?

Use a Diffie-Hellman style protocol to create and exchange a secret key for each session, use AES-256 if you're ultra-paranoid, then forget the session key. It even works today, and there are no known attacks against AES that can reduce the work enough to beat the heat death of the universe.

I'll bite.

Because we can't really predict the future and some far-fetched science-fiction sounding things such as quantum computers and future advancements we can't currently conceive of may completely and utterly change that, perhaps even overnight.

From a paranoid security point of view, it's definitely a bad idea to assume your cryptography is perfect and always will be.

Unless it's a one time pad with good RNG. In that case it is indeed a good idea to assume your cryptography is perfect and always will be.

Just don't lose the key... As I'm sure I don't have to tell you.

What book would you use? That's how "they" used to do it.

Perfect? Two people know the key.

And from a paranoid physical security point of view it's definitely a bad idea to assume I would survive my car trip to the grocery store every week.... I do it anyways, as it's still much better than the alternatives.

I believe this a logical fallacy. I didn't argue that due to said paranoia one should not engage in cryptography, any more than I would argue that one should not drive their car to the grocery store every week.

I'm talking about complacency, and how it's a better idea for us to assume that sooner or later (if not currently) our best-known cryptography will be broken. If I recall correctly, in 2008, Simple Nomad[1] told us to consider PGP broken by the government. He wasn't saying it is... just we should consider it as such and find something better, before it's too late.

[1] http://www.youtube.com/watch?v=N9AKpHtgpoM

And if I just told you to assume AES is broken by the government and find something better, would that be all the incitement you need? Or would you want actual evidence that at least hints it's probably instead of just assumptions?

You're missing the point. I already am thinking of it as broken, even without evidence, because I want to look ahead. This doesn't mean I don't use cryptography "because it's broken", it means I don't trust it as if it wasn't broken.

Also, to be a bit unfair, I have no idea who you are, but I know who Simple Nomad[1] is. If Simple Nomad told me the government had definitely owned PGP, AES, or anything else of that nature I'd be very concerned, no evidence necessary. The implication is that he already has the evidence, but maybe can't share it with me. Or he's really drunk and messing with me.... either way, good times ahead!

[1] http://www.soldierx.com/hdb/Simple-Nomad

> He has spoken at DefCon, BlackHat, ^Shmoocon^, and ToorCon, and he is known for his somewhat paranoid mindset.

The problem with cryptography is that you only have to be wrong once.

That's also the problem with switching to a new and untested solution. You only get to be wrong once. Is there any symmetric cypher with more cryptanalytic effort put into than AES? Is there even one?

You switch to something else out of paranoia and you could easily switch to something with a theoretical backdoor that NSA has already identified and exploited (after all, they're "10-20 years ahead of us", right?).

What about quantum computation? My (only slightly informed) understanding is that quantum computing's greatest strength lines up perfectly with the problem of brute-forcing encryption.

Quantum computing is a threat to RSA, DH, DSA, EDH, and ECDSA, but not to AES.

A sufficiently patient attacker can still eavesdrop on TLS sessions established via RSA or ECDHE today, wait for quantum computers to arrive (10+ years?), then break their public keys, and derive the symmetric keys used to encrypt the session from there.

The question then becomes how you're going to establish an AES key across a public channel without using quantum-vulnerable algorithms.

https://en.wikipedia.org/wiki/Post-quantum_cryptography

Presumably, you swap RSA for a code-based cryptosystem; the TLS structure itself could probably remain intact.

What does a "code-based cryptosystem" mean? You can approximate asymmetric cryptography using something like Kerberos, but these schemes requires a trusted third party.

You seem to be under the misapprehension that quantum computing threatens all asymmetric cryptosystems. It doesn't. McElice is an example of an asymmetric scheme that uses binary error correcting codes as its trapdoor function, rather than discrete logs.

McBits is a public key encryption algorithm which should be resistant to attacks by quantum computers: http://binary.cr.yp.to/mcbits.html

AES is not unbreakable, just very hard to break. Schneier in 2009: http://www.schneier.com/blog/archives/2009/07/another_new_ae...

I didn't say AES was "unbreakable"; that's a meaningless term. I said it wasn't threatened by quantum computing.

Grover's algorithm halves the keysize. It's not a theoretical problem (just double the keysize) but plenty of sites today use 128-bit keys for their block ciphers. Even though quantum computers don't rival classical computers for speed yet and therefore saying that these keys are "effectively 64-bit" would be slightly disingenuous, there's no reason to expect that QCs won't make that a reality within our lifetimes.

This is basically what OTR messaging does. But you're still vulnerable to man-in-the-middle attacks when using DH, unless you're already on a secure channel. And the most common solution to authentication is SSL/TLS, which the defeats the purpose of the whole thing.

So we need to utilize other channels, like key-signing parties.

Or, I suppose you can communicate using something like SRP to avoid this issue, though it sounds like a complicated layering of crypto that is destined to be screwed up at some point. However, this is what ZRTP does, and it seems to be pretty widely adopted.

>It even works today, and there are no known attacks against AES that can reduce the work enough to beat the heat death of the universe.

Well, that's the problem isn't it? The known attacks aren't the ones you have to worry about. Nearly every form of cryptography to date was expected to last longer than it actually did. I would not be at all surprised to find AES-256 broken before I'm on the wrong side of the grass.

>Or the NSA could just demand private keys via FISA letter.

I don't think you're legally obligated to retain private keys. If they start doing that I'll generate a new set of keys every day.

I think this can get you into some trouble in the UK, if not the US.

http://en.wikipedia.org/wiki/Key_disclosure_law

Oh wow (from the wikipedia article):

Australia

The Cybercrime Act 2001 No. 161, Items 12 and 28 grant police with a magistrate's order the wide-ranging power to require "a specified person to provide any information or assistance that is reasonable and necessary to allow the officer to" access computer data that is "evidential material"; this is understood to include mandatory decryption. Failing to comply carries a penalty of 6 months imprisonment. Electronic Frontiers Australia calls the provision "alarming" and "contrary to the common law privilege against self-incrimination."

I wonder how that would work if you own the server, but only the individual users held their private keys?

Hmmm. As someone under the jurisdiction of the Australian Cybercrime Act... I wonder if it's time to have policies in place for private keys - much like many corporate email retention policies. "We keep private keys for twelve months only. We create and deploy new keys every six months and securely delete all keys older than 12 months along with their passphrases - including physically destroying all drives that ever contained the key and/or backups of it. Any data not transitioned to new encryption keys before private key destruction is considered irretrievable."

"Yes Agent Smith, that's a mighty fine $5 wrench you have there - here's _both_ my current private keys. Last year's? No sorry, here's the video of those disk drives being hammered to bits then melted down to sludge. (Ouch! Why are you hitting me? This plan was _flawless!_)"

I think you could probably make the case you had no reason to believe sessions were "evidential material" because you aren't storing them and you have no reason to believe anyone else is either.

Of course, once you get a notice there's probably nothing you can do.

Probably the same as if you were renting an apartment to a criminal, and you gave him the keys and all the copies.

How would you know he's a criminal?

Also, why is it that everytime the authorities get away with making analogies with stuff in real life, like encryption compared to a locked box, or something, but when it's the other way around, say e-mail vs snail mail, suddenly they are not the same anymore, and they need to be treated differently (authorities can't look into your mail, but but get all your e-mail after 180 days).

I have found that the Crypto Law Survey is remarkably more detailed than wikipedia for crypto policy questions. Sadly the site is not as well known as wikipedia:

http://www.cryptolaw.org/

That hostname isn't resolving for me at the moment.

  $ dig www.cryptolaw.org @8.8.8.8

  ; <<>> DiG 9.8.3-P1 <<>> +nocomments www.cryptolaw.org @8.8.8.8
  ;; global options: +cmd
  ;www.cryptolaw.org.		IN	A
  www.cryptolaw.org.	1801	IN	A	77.74.54.129
  ;; Query time: 45 msec
  ;; SERVER: 8.8.8.8#53(8.8.8.8)
  ;; WHEN: Tue Jun 25 19:27:38 2013
  ;; MSG SIZE  rcvd: 51

Well, I'm not to worried about trouble in the UK.

> If they start doing that I'll generate a new set of keys every day.

Doesn't that require getting a CA to re-sign your keys every day?

Yes. The certificate contains a signature of your public key (and other data), which is derived from your private key.

Might be why Google is upgrading all SSL certs to 2048 bit

http://googleonlinesecurity.blogspot.com.au/2013/05/changes-...

Reply on news.ycombinator.com