On the new Snowden documents
blog.cryptographyengineering.com
blog.cryptographyengineering.com
Not everything is being published, however. There are details from GCHQ STRAP3 (location of individual listening sites) but only STRAP2 documents, and all details of personnel and telephone numbers has been redacted by the journalists (perhaps a little too broadly - for example as in the GCHQ "refer requests for disclosure to" telephone number, you could actually Google it! I think they know by now, however <g>). Snowden wanted to end mass surveillance and sabotage of public security products; not reveal their cryptanalytic advantage to targets. It's the journalists who are doing most of the selection, I gather - but they've seen the whole haul, including what is not being published, and the picture is consistent, though (yes) incomplete.
My impression has been for some time that their cryptanalytic advantage is not actually vast, but their operational resources truly are. Throwing money at things doesn't magically give you breaks to the DLP - but it totally can buy you computing resources that can break 1024-bit Diffie-Hellman. (It mentions Cavium cores - suggesting large, parallel RSA/DH-optimised multipliers were on their HPC shopping list. They are much faster at 1024-bit than higher.) It can buy you insiders, or let you conduct operations that threaten or coerce insiders, or conduct astroturfing campaigns to frighten people away from encryption you can't break, or further the goals of your agency (which do not necessarily align with the government paying your way - it's not so much "oversight" as "don't get caught doing anything you shouldn't"). You can throw (a lot of) money at military contractors and hope some malware-by-committee comes out that you can use to hack anyone that looks interesting, grab intelligence or keys, or any of the above. And they typically attack from every angle at once.
My take on the HPC resources is that they're mostly used as brute force CPU/GPU power for low-entropy situations - anything where passwords are involved may be vulnerable. Email an encrypted DOC, ZIP or RAR file to someone? They're going to at least try it as a matter of course, even en masse, but they're not going to give it much juice unless you're tasked.
Money can't give you magic. However you very, very rarely need magic.
It doesn't take away from your larger point, but we can't presume they know more than they've published. They probably do, but we don't know what they know and what they don't (either because it was omitted or destroyed).
It's inherently dangerous to assume that NSA doesn't pay much of attention to the breaking of fundamental crypto math based on these documents.
If they did find a practical weakness in RSA and such, I think it's safe to assume it would be assigned the highest level of secrecy and simply won't be in range of Snowden's document sweep.
The very fact that these low-level staffers were able to do as much damage as they're credited with should have been enough to force a house-cleaning of every affected agency, from the top down.
Additionally, one of the lessons learned from the 9/11 attacks was that keeping data too "Need to Know" might prevent people who actually need to know information from knowing about it.
When you have 10,000 documents labeled "top secret", instead of just 100, who really knows what's really important from that list, and doesn't need to be "as shared" anymore?
If they do indeed - surely they would at least employ it in the backend to decrypt data? The documents we are seeing are geared towards analysts and provided from the groups implementing various attacks/capturing/decryption functionality. They wouldn't even have to reveal anything - just "give us data, we'll send you back decrypted results". Yet they frequently set rather low expectations for decryption. And then theres the organizational question. Why have groups targeting VPNs, IPSec, HTTPS etc. when breaking RSA gives you a golden key to any of these?
What I'm saying is these arguments routinely devolve into "it's so secret, they can't tell their own employees or analysts and they can't use it for the capability could be leaked". At that point the consequence is that the magic RSA breaking sauce becomes pointless as you can't use it, certainly not for the objective the NSA has spent the last decade on: capture everything.
I'm not saying they have it, but if they had it, they would be foolish to use it all over instead of only on key targets.
That's not what I said. Don't make shit up.
I said that one cannot rule out NSA sitting on an RSA weakness merely because it's not mentioned in the Snowden document dump.
http://www.amazon.com/The-Snowden-Operation-Greatest-Intelli...
EDIT: I will acknowledge that the paragraph starting with "This book is not based on complacency about the status quo" does indicate, at least to me, that he's not 100% anti-Snowden though. Perhaps I could grossly, and only based on the intro, paraphrase his opinion as "Snowden just took things a bit too far". I can see that as a reasonable position to take. Even I don't think USA should just shutdown all secretive intelligence and pretend that there are zero terrorists.
I was taking issue with that bit. There are good reasons to think what Snowden did was wrong that don't involve paranoia about "plentiful" terrorists. You could, for example, draw a distinction between responsible whistleblowing and irresponsibly fleeing to a foreign country with literally thousands of classified documents.
Ah, okay then. This position is completely reasonable.
I have to wonder if academic progress (like defeating cryptographic algorithms) can be achieved under a climate of secrecy. Without the free exchange of ideas and knowledge, how much progress can be had?
Whereas the new key system relies on hardening of packaging to offset any flaws in the one-way functions.
His analysis that there are unreported vulnerabilities in TLS implementations sounds definitive enough to think he knows some of these vulnerabilities.
If he wasn't aware of at least one unreported exploitable vulnerability then I would expect him to say "There are almost certainly still other, unreported vulnerabilities".
From the article, it would seem that side-stepping this, and going directly for the routers, or even the employees, is more efficient in actually circumventing encryption than hunting for vulnerabilities in encryption implementations.