Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Encryption Security

Ask Slashdot: Echelon Protection? 197

Posted by Cliff from the should-we-worry? dept.
An unidentified submittor had a worthy question and I want to submit it to you all for discussion: "How confidant should we be in private sector encrytion as a defense against ECHELON intercepts. The NSA probably has toys we will never hear about. Can we really trust PGP and FreeSWAN to defend personal and corporate data from the spooks? Should corporations begin hiring encryption experts to defend their data stream?" Slashdot has covered Echelon before, and in the midst of all the recent concern from Congress one can only sit and wonder how long it is before 'privacy' (or if you prefer, the illusion of privacy) becomes a thing of the past.
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Echelon Protection? More

Ask Slashdot: Echelon Protection?

Comments Filter:

  • I can successfully brute force any key... (Score:1)

    by Anonymous Coward
    if it's at the beginning of the key combinations I try. I don't care how many bits it is, if by chance it's the first key I try, i've got it. Solution: encrypt stuff twice or more.

    P.S. You know all the NSA guys/gals are laughing their asses off as they read this.

  • How to decrypt any message instantly (Score:1)

    by Anonymous Coward
    Abduct the sender and start cutting fingers off until he gives up the pass phrase to his private key.

    All that factoring and math stuff is just a red herring.

  • Privacy is already a thing of the past! (Score:1)

    by Anonymous Coward
    Here, in MN our attorney general just filed suit against US Bank because they are selling our private information to marketing companies who then (w/out permission) access the bank account for payment (which appears on the statement as a "service fee"). The state sells information to these same companies from lisences and other "public documents" (like court records, deeds, and so on). Even our school transcripts are fair game!

    What happens to your name when you enter a contest? That too goes into a big databank somewhere. When you write your grocer or super-store a check you give them your name, address, telephone number (and in most cases your work number). All this ends up in the same databank, it is information the retailer sells about you!

    At a minimum, Big Corporate Brother knows more about you than you would wish him to. He knows your approxamate income, he knows where you live, who you live with and wether you own or rent. He knows where you work, what you drive and where you shop. He knows your interests and your hobbies.

    He knows too damned much.

  • NSA (Score:2)

    by Anonymous Coward
    When I was studying math at UCLA, one of the number theorists there was blocked from publishing an article by the NSA. They 'classified' his work. They were nice enough to offer him a job, though!

  • Sigint to noise ratio (Score:5)

    by Anonymous Coward on Thursday June 10, 1999 @05:56PM (#1855890)
    Ever wonder why the US government seems just as afraid of low level encrytion that they can crack fairly easily as of high level stuff that would take them weeks? Its because if PGP keys became common and the use of even light encryption became standard policy, it would bring the Echelon sniffers to a grinding halt.

    Think about the traffic that any sort of large sigint operation like this needs to filter through. If it took even a couple of seconds to descramble each message just to check for any red-flag words the entire system would rapidly backlog.

    Want to fuck with the Echelon project? Put the words "nuclear technology transfer funding" in the subject line of all of your email and encrypt it. It could be fun ...
  • The way I understand this, basically a computer sits on the line between point a and point b, then searches for keywords on communications between the two. In theory couldnt the world just invalidate the results by making all (non business related obviously) personal communication have the keywords in it? Like have your .sig say "Im going to bomb building X on date Y"? I realize that it would probably be virtually impossible to do, but its an interesting idea. Another idea (for the conspiracy theorist) would be that the govt's could use distributed computing (seti, distrib.net) through some kind of front (like seti or distrib.net) so we would be "chaining ourselves unknowingly" (for lack of better term), by giving the govts the data they want to monitor. We would never know since the clients are binary only, sure we could decompile it, but being the govts of the world they would be able to jail you or whatever before you were able to tell many people since they are monitoring all personal communications.

  • Hmm... If it's any hope, an AC up above said that this is what he does. Unfortunetely, as he IS an AC, not much can be done 'bout that.

    It doesn't appear that CFS will quite do what you're looking for... Poking through the CFS documentation (what I can make out at the moment, being rather tired), I take it that you presently need to enter your password when starting each shell, before being able to access files under the CFS-mounted region.

    The clearing of passwords on suspend is not presently supported as best I know (If apmd lets you have a script to run before a suspend, that would help... but you'd have to be careful about what happens to open files), and I'm not sure if you can just put in your password on boot (as opposed to each login). This is something you could figure out by playing around with it a bit, though.

    Of somewhat more concern, it appears (from-what-I-can-make-out) that CFS may not work with the GNU linker (something about not supporting holes in files, though later it says that such holes are supported but filled with garbage... I'm tired, damnit!).

    It sounds like you could quite safely start a small directory tree under /crypt or somesuch; Indeed, it seems that an unencrypted bootstrapping area (at the very least) is required to get the machine up and running before CFS comes in. In this kind of limited testing, a reformat-and-reinstall is very unlikely to happen (and you could move files in gradually, as you gain trust for/experience with the thing).

    I hope this is at least slightly parsable and usable (though not necessarily in that order).
  • Everyone used to do this years ago, by putting a .sig with a whole lot of 'interesting' keywords in it on every usenet post.
  • Posted by Ydeologi:

    Just for the sake of it, I created a 4DOS batch routine a while ago which automatically encrypts/encodes/compresses the file through a ridiculous number of steps. The companion batch routine, which unpacked the beast, was stored on a floppy...

    I used more than fifteen archivers, several of which had their own crude internal encryption schemes, PGP plus two encryption programs, a uuencoder, and two steganography utilities, all variously arranged, with, of course, PGP, 2048+, at the beginning and end...

    The loose theory was, so many different things were used-- and of them, so many obscure-- that even if someone actually found the file, they wouldn't know what the hell to do with it...

    ...or if they were like me, and they did, they'd be frustrated as hell going through all the steps to undo it all. :)

    --YDeO
    "It's not down on any map;
    true places never are." --Melville



  • Posted by Kevin "The Hose" Ingersoll:

    In the interests of averting a lecture that would prove to be a HUGE digression, let me just make 2 points here:

    1) If you eliminate ANY key choices (say, based on the fact that you think they are uncomfortably close to the "beginning" of they key space), you have just shrunk the space of possible keys & weakened your cryptosystem!!!

    2) Depending on the crypto scheme you are using, applying multiple "encryptions" could easilly weaken your security. There are SOME cryptosystems where doing so can be provably more secure (DES, for instance), but my point is that this is not something you should be doing unless you fully understand what you are messing with...
  • Posted by Stephen "The Carp" Carpenter:

    better yet...setup a server in china that
    throws all emails away. Have a few differnt
    people start emailing it with streams of random
    data. have them call a phone there which
    connects to a tape recorder with a looped
    tape in it...have it send random tones made
    to sound like an encrypted message yet
    in actuality random.

    scare the shit out of them that some new
    encryption scheme exists thatthey don't know about
    and looks like random data :)
  • Posted by Stephen "The Carp" Carpenter:

    Well they can always do "The right thing"
    and immediatly distribute as many copies as
    they can as widely as they can and get copies
    (electronic and otherwise) into as many hands
    as they can before the NSA has a chance to stop
    them.

    Sure it will bring legal wrath down on them
    and if they patent then they don't care about
    doing the "right thing" anyway...hell they
    half deserve it...their intention was to keep
    it to themselves legally so they could make
    money...and instead the NSA said no..we are just
    going to keep it to ourselves and forbid you
    to use it openly.

    almost fitting but...the NSA shouldn't be allowed to keep secrets. They are the greater evil
  • I have a laptop. I have, periodically, searched around for information on how to use a cryptographic file system. I've found a few references to CFS:

    There is something notable missing from all of these pages: simple, easy-to-follow instructions on how to install and effectively (and securely!) use a file system like this.

    From the dearth of documentation, I get the feeling that this has only ever been attempted by file-system gurus, which means that I wouldn't even want to consider attempting it, because reformatting my disk and reinstalling the system is not something I look forward to.

    Here is what I would like to end up with:

    • I power on my machine;
    • Early in the boot process, it prompts me for a pass-phrase;
    • If I don't type the correct one, the machine is useless, and all non-trivial data on the disk is encrypted;
    • If I do type the pass-phrase, the machine boots up normally;
    • When I put the machine into suspend mode, it again prompts me for a pass-phrase when I try and un-suspend. If I don't type it, the machine remains effectively halted until I get it right.

    Is this dream even remotely realizable?

    Basically, the situation I want to protect against is simply that of the laptop being stolen while I'm away from the keyboard -- whether it is powered on at the time, or powered off.

    The problem here is that the usual crypto-heads are the types who use ssh and pgp and are already used to having to perform nontrivial system-administration tasks to get things up and running, and who don't mind wading through a command-line alphabet soup to do simple tasks, all day long. What we need is someone who is both a crypto-head, and who understands that their agenda is best served by taking the time to make this software be drool-proof.

    It doesn't matter how good the math is if no real users are actually using it. Crypto is only effective if widely deployed. If not, those few who use crypto stand out for targetting.

  • as far as I remember, there is a step-by-step description how to configure.

    Where? I haven't found it.

    i would suggest not to do this during startup, as you would immediatly reveal that you have crypted data.

    Then you believe in security through obscurity. Security through obscurity doesn't work. Repeat it until you believe it.

    I think the power of such software relies on the fact, that it is NOT stuffed into a corset of GUI and foolproof(impossible) usage.

    Then you believe that software is made more powerful by being obscure enough that only a vanishingly tiny minority of potential users are able to use it. You believe that software that is used by a thousand people is, for that reason, more powerful than software that is used by a million people.

    You are wrong.

    The more people who use crypto, the more effective cryptography will be for everybody. If one has to even understand what ``NFS'' is in order to install a package like this, then it's still too hard.

    That's why PGP and S/MIME are still so marginal that they can be completely discounted: only gurus use them, because they aren't so completely transparent that you don't even know that they're there until they have something to warn you about.

    Designing easy-to-use interfaces for crypto is one of the hardest UI tasks there is -- I know, I've tried. But, if you believe in cryptography at all, it's also one of the most important.

  • double encryption should NEVER lower the strength of encryption. That would mean the encryption is insecure. OTOH, it doesn't have to increase the strenght.

    In the case of DES, there is a known attack on double encryption that makes double encryption equal to single. Tripple DES (where you encrypt with DES three times) is more secure. Typical implimentations of tripple DES only use two keys, so you only have two keys to break. Not all tripple DES uses only two keys, some use three. There are also several different ways to apply this. (Typical is to encrypt with key A, decrypet with key B, and then encrypt with key A. Not the only possibal one)

    Please, before you comment on issues of encryption you owe it to everyone to read Bruce Schinder's work Applied Cryptography

  • In response to various musings on this page about key lengths, etc., a good reference is the paper "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security" [counterpane.com] by M. Blaze, W. Diffie, R. Rivest, B. Schneier, T. Shimomura, E. Thompson, and M. Weiner. Note that the claim "Moore's Law will catch up with encryption" is decidedly false: Both Moore's Law and decryption effort are exponential growth problems (Moore having a smaller growth factor)), while encryption effort is polynomial or less (N log N, generally). So encryption can get 'way ahead of even decryption aided by Moore's Law.

    Another interesting paper is "The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption, by H. Abelson, R. Anderson, S. Bellovin, J. Benaloh, M. Blaze, W. Diffie, J. Gilmore, P. Neumann, R. Rivest, J. Schiller, and B. Schneier.

    An interesting bibliography [counterpane.com] is on Bruce Schneier's Counterpane site. [counterpane.com]

  • The ABC was built *prior* to the war, and was an electronic digital computer. The colosus may have been the first to do something important, but it certainly wasn't the first.
  • I hope you're right, but I feel that all you'd achieve is tax hikes to pay for some hefty hardware upgrades - look at all the SGI supercomputers marked 'Classified' in the top 500 supercomputers list...

  • I have never had an interest in crypto, or even used it. I never thought I had anything worth hiding... But that hasn't stoped me from occasionally pondering the theory of it.

    Ok, I guess I understand a bit more that "it just takes the right password to decript a message." But basically, key management is the bigest risk I would see, isn't it? Because your "secret key" or whatever is kept somewhere on your computer, and it takes the right key to decript something. So, if your key is say 128 bit, it would take some serious horse power to crack it, BUT, wouldn't it be way easier for someone to crack into your system and steal your key, then just crack the password for the key? To me, stronger and stronger encription seems pointless if this is all it would take to break it.

    Also, I guess since I am getting older (and lazier), I wouldn't mind trying some pgp or gpg thing just for the heck of it, but a nice GUI front end, and maybe a Netscape Mail Plugin for it would be nice. Is there such a thing, a full GUI front end for pgp or gpg that is gpl and generates keys, incripts mail for easy sending, key management, and everything? the only thing I found is gpgp and that seems to be only key management. So, is there anyone who has done such a thing, or am I just going to have to spend 15 minutes reading the docs, and not have a good mail plugin, and realize that my less technical friends will never be able to read anything I would send them encripted. I guess it's not a big consern, because like I said, I don't think I have anything to hide, but I guess if it was an easy thing to do, I might just consider playing around with it.

  • How about your root password, is that worth hiding? Let's not forget that ssh is also crypto.

    You say, "wouldn't it be way easier for someone to crack into your system and steal your key?" Well, then use crypto to prevent people from cracking your system. Shut down services that aren't needed, and only allow ssh logins.

    --Alex
  • Not really ("you have to trust someone..."), but you do have to not distrust everyone. If the source code is open then anyone can examine it including people with sufficient mathematical knowledge. If any such person finds something of "interest" it will quickly become a matter of intense discussion on relevent newsgroups, mailing lists, and hallway conversations.

    There seems to be a repeated effort to convince people that an all powerful NSA will thwart any attempts to insure privacy. I guess the hope is that people won't bother to use what is easily and in many cases freely available thus making the prediction true by default. If people want to wallow in their cynicism, that is their privilege. I think the efforts to evesdrop promiscuously are doomed and the listeners know it. It is mainly a question of how long they can get away with their claims to "pay no attention to the man behind the curtain..." (quoting from the Wizard of Oz)
  • You Said:
    You don't need anything higher than 40-bit encryption to protect your computer, since you don't have anything worthy of stealing

    Oh really? Whats the value of a credit card number? 2-5 thousand dollar credit limit, and the number is good for a couple of years. Someone could spend a few $$$ on computers and crack it in a few days with 40 bit encryption, then move on to someone else's card number. The initial money spend on computers would be got back in a matter of weeks. Plus, I would have to deal with the hassle of convincing the card company that it wasn't really me.

    It really is no harder for me to use 128bit encryption instead of 40 bits. If it is worth encrypting, it is worth encrypting well.
  • I knew the NSA reserved the right to classify thw work of its employees but this is particularly scary. The fact that it is being classfied implies the work either A) contained a method for breaking a used cryptosystem or B) contained information that could lead to the development of a secure crypto system

    either option implies that they have methods of breaking most crypto software out their b/c otherwise they wouldn't care.

    That is both very nifty from a mathematical point of view and interesting from a political point of view
  • Can we trust the strength of the encryption? All I know about encryption is that some program, I enter a password, and it scrambles the text. BUT, when you have the source to an application, you can make sure there are no secret back doors that sends a copy of your e-mail to some government agency. I seem to remember something a while back about CC-Mail having a back door for some governments. It is kind of hard to hide a back door when you have the source exposed so that everyone can see, and compile their own "CLEAN" copy...
  • While you statement that most current crypto needs better UI work is quite correct, you are quite wrong when it comes to security through obscurity. Obscurity works as a part of the overall strategy but must never be relied upon. Just because obscuring the details is a part of the security you should not assume that it is the only part. Unfortunately in this case you are correct that the attempt to hide the existence of the encrypted data will not work, the person who is trying to do this needs to think long and hard about what sorts of results I would get if I searched his hard disk for long, contiguous chunks of data which seemed to be very random...

    Too much current crypto uses iron doors to secure houses with tissue-paper walls anyway. Crypto does not just need a better UI, it needs to be integrated into the system from the very beginning. Unfortunately it is already too late for Linux (and unix in general), security cannot be added as an afterthought or it will never work as well as it should. If security is not a part of the foundation then the structure built will never be as strong as you think it is...
  • Even if P=NP, it might not help to solve the actual problem of factroing small numbers (as in no more than a few millions of digits).
    Suppose I prove P=NP by giving a Turing machine that factors a number of n digits in A(6)n^2 steps (where A(6) is Ackerman function of 6), how do you use it to factor a 2048 bit number in a reasonable time?
    (Actually, I have a proof for the existence of such a machine, but the margin is too ... )
  • The almost so called 1024 bit encryption they are talking about is probably not one of the as. it's brobably one of these large-key symmetric algos that all kinds of laymen are writing. Thease normally have a variable key size and require so 1Mbit of true random to be stored somewhere to be reasonably safe.

    To the gui above: PGP is not a assymmetric scipher. It's a program that uses one(You probably knew this(You just expressed yourself poorly)).
  • You mean NSA not RSA? I don't think that an algo. is much interested in peoples data, i don't see one being interested in much anything.

    It doesn't take any energy to move something. I guess that if one calculated the maximal number of times that elecron could be moved at the speed of light and divided this with the number of times this operation could be done in parallell. Then chose a reasonabe time. Then chose a risc factor like 10^-100 and said that only the risc factor times the key space could be seached in this time you get a key size to fit your req's.

    A one-time pad can be cracked! Even though the method for this whould be a joke for longer messages. Here goes: Use traffic analysis to figure out possible topics for the message. Use a dictionary attack to get all possible messages that confirm to the message lenght. Then filter out anything that doesn't confirm to the possible topics. Of course this can't tell the difference between "I HATE You!" and "I LOVE You!", but this would unscramble with old fashion psychosocial-analysis. |=8)


  • The chance that double encrypting a message weakens it is so small that there is no risk involved in doing so. Any system that whould commit suicide like this IS already weak since the attacker can doit too. I mean if you have a 128bit system then if it's more likely than 2^-128 that it gets weaker when repeated, then the attacker can benefit from either you or him doing it and it doesn't matter if you doit or not. That system IS weak anyway!
    Point: Cryptosystems that are vorse than "groups" are already crap repeat or no repeat.

    Here's how to choose a sufficent key size: Choose a risc-faktor(1k year). Ok now make sure that now one can search 1/10^100th of all the keys within that time. If someone can search 7e12keys a year and that doubles every 18monts you figure it out.

  • yes but their peed encreases exponentially.
    It whould only be 10^18 3 years from now...
    6: 10^16
    9: 10^14
    12: 10^12
    15: 10^10
    ...
    ??
  • If you're trying to protect what you're saying, there are a few points to consider:

    a) If you send your key over the Internet (or
    phone lines), then it's completely
    compromised (in case of symmetrical
    encryption), because Echelon will get a copy
    of the key as well... In case of PGP, if
    you transmit one half of the key, this might
    also give them something to work on to find
    out the other half.
    Remember: It's also no use to send a new
    key encrypted with an old one (that was
    transmitted electronically before).

    b) You won't get around having your email
    snooped by them, but we could all make
    their lives a hell of a lot more difficult
    if everyone were to encrypt everything they
    send over the Internet. Even if they have
    the keys, or if they can crack it easily -
    they will have to decrypt your message to
    be sure, that you don't do anything
    forbidden. And if everyone would do that,
    they would certainly spend a good deal of
    CPU time just trying to decrypt rubbish.

    c) If you want a good protection for your data,
    use a good encryption program, and then do
    something with the data, that isn't covered
    by any program, e.g. put a certain amount
    of random junk into your message (at places
    and using blocksizes that the recipient
    knows, like: add 1937 bytes of random junk
    at the beginning of the file, and then
    another 7 bytes of random junk after every
    234 bytes of encrypted data plus 1234 bytes
    of random junk at the end.
    Using that info, the recipient can easily
    restore the encrypted file and then decrypt
    it.
    Another way would be to swap blocks in the
    received file, e.g. swap the first two bytes
    then the next 2*2 bytes, then the next 2*4
    bytes of encrypted data.
    As long you tell the recipient in person,
    what to do with the file, you should be
    fairly safe (again, if you transmit the
    information on how to descramble the files,
    everything might very well be in vain, since
    that mail/phone call/fax/... is as likely
    intercepted, that your precious (or useless
    but still encrypted) data is.




    Let's put it this way, the worst part of the NSA is, that they either

    - in spite of having an undoubtedly HUGE budget,
    couldn't prevent China from getting the USs'
    nuclear secrets, or (even worse)

    - might even have China let them have
    knowingly (willingly even?)...


  • This is the fundamental problem of information protection outside the U.S. Government -- no one besides some ex-NSA'ers know exactly what the agency can and can't do. They employ more mathematicians than any other single employer, which is an impressive resource. And they do have tremendous computing power/research and development capabilities, with their own semiconductor fab facillities, etc.

    On the other hand, some of the worlds best and brightest rigorously pursue very public encryption research, and provide some indication of how difficult cracking an encryption scheme can be.

    Today's systems rely upon difficult mathematical functions and permutations for which, in over 2000 years of research (in some cases), shortcuts have yet to be found. Whether the NSA, in the space of 50 years or so, could break these riddles is, indeed, an open question. But I have my doubts. I think they tend to rely heavily upon people NOT using encryption.

    Kythe
    (Remove "x"'s from

  • --- snip ---

    So let's assume that the government has a hypercluster of computers that are a billion billion times faster, en masse, than the ENTIRE
    distributed.net.

    It would still take them 1e20/1e18=100 years to break _ONE_ 128 bit key.

    --- snip ---

    That's only true if they don't know about any analysis techniques or weaknesses in the algorithm that we don't. I don't think that's a safe assumption.
    ---
  • IMHO, the most amusing "weakest link" that I have ever heard of was also during WWII, only in the Pacific. It seems that someone picked up a piece of carbon paper out of the water, and that carbon happened to have been used several times by the secretary of some Japanese admiral. Unfortunately, I can't quote sources, but the long and short of it was that this sheet of carbon paper had all sorts of goodies - and was obtained in a very providential way. So it is most likely that which you are not now able to see that will come back and bite you in the ass. As is mentioned before, NSA strengthened DES against a type of cryptanalysis that would not be "discovered" for years yet.

    -Chris
  • Sorry, that is not correct. It is the specification of a machine which can not currently be built which will speed up one portion of a factoring process. It would make possible the factoring of 512 bit numbers in approximately 9-10 weeks, but 768 bit numbers will be factorable in 1038 years (Shamir's estimate), and 1024 bit keys in 10^6 years. This is not a very practical device, even if it could be built.
  • Interesting error messages from w2kb3 system & application logs.

    syslog: IPSec Policy agent started successfully.

    applog: Failed to obtain Kerberos server credentials for ISAKMP/Oakley service. Kerberos authentication will not function. The most likely reason for this is lack of domain membership.

    applog: The IP Security policy for ISAKMP/Oakley specified an encryption algorithm that is invalid due to export cryptography restrictions. All 3DES encryption used by ISAKMP/Oakley is weakened to standard DES encyption. Generally, this is benign. ISAKMP/Oakley will still be able to negotiate IP security parameters, and protect that negotiation with DES encryption. This should only be of concern if you demand that the ISAKMP/Oakley negotiation be protected with 3DES encryption. If this is the case, please contact your network administrator.

    I sure am glad I'm moving to a job that involves a Linux based company. M$ is limiting local subnet negotiations because of export restrictions? Big Brother is alive and well. Little Brother lives just outside Redmond.

  • nono, it's the GREENs who LIVE underground what are doing the experiments on trailer park residents and politicians...

    The GREYs are merely observing. It's a lot like a big undergrad anthropology project. Rabbits are actual remote controlled, self-replicating monitoring devices DIRECTLy under their control...

    or maybe I just need to up my dosage...

  • An AC wrote:

    Abduct the sender and start cutting fingers off until he gives up the pass phrase to his private key.

    Which is, of course, why PGP users shouldn't use the "encrypt to self" option if they are operating in a hostile environment.

    If the sender is using a public key crypto system and encrypts the session key with only the recipient's public key (and not their own) then you're going to have to find and torture the recipient.

  • You know, that worked in preview before I submitted it
  • Y..d..n..n..t..e..t..m..i..s..G..l..m..d
    .o..o..o..e..o..n..o..a..n..t..R..i..o..i
    ..u.....t..e.....c.....k..f..r..E..v..r..f
    ............d.....r.....e..o..e..P..e..e..f
    ...................y........r..a..e..s.....i
    ....................p........m..m..r........c
    .....................t........a.....'........u
    ...............................t.....s........l
    ................................i..............t
    .................................o...............
    ..................................n...............

    Even....you......unassisted........to.read....fair ly.......
    .....if.....want............humans.........it..... ...simply

    Um, CmdrTaco, the preview screen strips the tags out of the comment field of the form, so if you submit from there you lose all your formatting. Sorry it made a junk post

  • Why do they need to crack your message at all?

    Traffic analysis, tempest, conventional espionage... I see no reason why they would even bother trying to decrypt anything. Unless your security methodology makes the encryption absolutely necessary to crack to obtain the information required... it's kinda pointless to bother with decryption.



    --
  • "Here, in MN our attorney general just filed suit against US Bank because they are selling our private information"

    Sounds like the system is working.
    It's not like the AG is in on the conspiracy...



  • Re:P != NP (Score:5)

    by hpa ( 7948 ) on Thursday June 10, 1999 @07:51PM (#1855929) Homepage
    Uh, could you give such an example? It's probably worth a Turing Award at the very least.

    In case you didn't know, P ?= NP is probably the biggest unproven assumption in theoretical computer science today. Although it is widely believed to be true, noone has succeeded in proving it.

    Furthermore, your definition for class NP is wrong (your definition instead most closely applies to a different class often called RP); NP is most easily described in the following way: if you are given a solution, you can verify that it is indeed a true solution in polynomial time.

    In addition, your definition for polynomial time is wrong! Polynomial is time n^k where n is the size of the problem, and k is a constant; not k^n which rather would be exponential time (class EXP). For exponential time, it has been proven that EXP = NEXP; i.e. that nondeterminism buys you nothing when you have exponential time to play with (because you can simply enumerate all the possibilities and try them all.)

    Now, public-key cryptography (but not traditional cryptography) relies on the assumption that P != UP, where UP is the class of problems solvable in polynomial time on something called a unambiguous nondeterministic Turing machine; UP is a subset of NP and a superset of P. The assumption P != UP is actually stronger than P != NP.

    It is widely believed that P != UP != NP, but neither has been proven.

    Reference: Papadimitriou, Christos H.: Computational Complexity, Addison-Wesley, ISBN 0-201-53082-1. Excellent book.

  • I don't quite know why everybody is scared of the US government reading their e-mail or seeing what they send to other people. Honestly, the US government does not care that much either. People who are going to blow up a building do not announce it in advance over the internet.

    The only form of electronic espionage being done over the internet from inside the US is that of smuggling high-level secrets out of the country (ie. nuclear warhead data). In those situations, the US government clearly was unable to intercept the data, despite it being taken without heavy encryption. In my honest opinion, Echelon is a lot of FUD.

    The only practical uses of complex encryption areby corporations transmitting valuable or sensative information over the internet, and, of course, government research labs. You don't need anything higher than 40-bit encryption to protect your computer, since you don't have anything worthy of stealing (if you do, you're either a corporation or you're holding something illegal).

    The US government is not the threat here, folks. Nor is it any other government trying to steal the data of the people. The only threat is from inter-governmental espionage resulting in the proliferation of advanced nuclear weapons systems (ie. Chinese/Russian spies dating from the late 1930's).
  • that's not as unlikely as it seems on the face of it. there are some very clever people out there...
  • NSA is responsible for COLLECTING intelligence. They are not counter espionage. The people who should have been looking for spies at the labs were 1) The FBI (they are counter espionage inside the US) and 2) The CIA (they are counter espionage outside the US).

    Let's not try to blame everything on the NSA. Actually, they are the most harmless of the bunch. They don't have field operatives with guns and itchy trigger fingers.

    I think way too many of you believe everything you see in the movies....
  • > At this rate, it would take Distributed Net over 10e20 years to break a 128 bit RC5 key.

    >Recent calculations by astronomers say that the universe is about 10e12 years old.

    Don't you mean that the universe is 12x10^9 years old?
  • I don't think the NSA not already being interested in you is going to keep you from popping up on their radar screens. I bet their topic ID can spot subjects of interest and distinguish it from "fribble drug deal bomb" gobbledygook.

    The NSA was selling topic identification in 1994 that sounds better than today's state of the art. See Bruce Schneier's note inside this linked article [deja.com].

    And I'm not willing to bet my life they haven't maintained their light-years-ahead headstart in breaking crypto (don't forget, these guys' predecessor had COLOSSUS with 56k I/O during WWII), and can read all our PGP messages.

    If I ever really have to hide something as I send it over the 'net, I'm gonna use steganography (layer 1) to hide the image of a handwritten note (layer 2, make 'em use OCR) that's in a dead non-Latin-alphabet language (layer 3) written in a mirror (layer 4) inside a PGP-encrypted (layer 5) Pamela Anderson pic.

    Well, maybe not. But I at least feel very confident that would be safe. I trust and use PGP, but I'm always uncomfortably aware that NSA has some very very smart people.

  • Postilion has a pgp autosiging option. That's a GPL app so you need linux or a *BSD.
  • The 'dictionay' you are talking about to store all keys would be prohibitively large. It is not possible for even a fraction of the 2^128 keys possible with 128 bit encryption.

    As for elliptic curve cryptography, this is a relatively new type of public key crypto. These algorithms are thought to be more resitant to cryptanalysis than RSA, which is used in PGP.
    Specificaly index calculus discrete logarithm attacks will not work. Also, they tend to be faster and require smaller key sizes than comparable public key cyphers like RSA.

    Reference: Applied Cryptography Vol2
  • strong encryption (128 bit+ for block cyphers, 2048 bit+ for asymetric - like PGP) should be adequate to protect any data from evesdropping. Even our US goverment with all the crays and clusters in the world could not brute force keys this big with much success. Cyptanalysis attacks are different, but good cyphers are resistant to this type of breaking. FreeSWAN and PGP would be a good, quite secure solution. Learn about cyptography if you are truly interested in this subject (Applied Cyrptography - second edition by Bruce Schneier is a great book) And remember, cyphers are only a part of your security solution. Your security is only as strong as the weakest link, and if you have other security problems (key management, training, etc) it wont matter how good your cyphers are.
  • The thing I thought of recently is that given Moore's law, eventually even all the long keylength stuff we're using to encrypt stuff is going to be crackable... And that's assuming someone like the NSA doesn't already have a crack, or some other weakness isn't discovered sooner.

    So...don't post anything securely on Usenet or any other archived public place that you don't want people reading in ten years (in case a security hole is revealed at a later date).

    W

    PS - It'll be fun to go back say in 2010 and crack all those PGP'd messages from 1995 and see what people were saying on Usenet and in other public places when they thought it was "safe"...

    W
    -------------------
  • Well its not just about brute Force attacks... Some encryption scheme may have backdoors, intentional or not, that make it easier to break them. With all the sepculationa bout quantum(sp? :) ) computers and DNA computers, who's to say the NSA doesn't already have one?
    xm@GeekMafia.dynip.com [http://GeekMafia.dynip.com/]

  • An article in Business Week (May 31, 1999), of all places, has the following to say about Echelon:

    "Encryption is no guarantee of privacy either. The NSA, which is bigger than the Central Intelligence Agency and runs Echelon from its headquarters at Ft. Mead, MD., has little trouble unscrambling messages encoded with most commercial encryption software. With a little more time, NSA can probably break 'crypto' schemes with so-called Keys almost 1,000 bits long, says Lisa S. Dean, vice-president for technology at the Free Congress Research and Education Foundation..."

    I'm assuming they're talking about asymmetric ciphers here. However, if these numbers are to be believed, it does seem to imply that 1024-bit keys are on the verge of being vulnerable to attacks currently used in Echelon. So strong-er encryption (namely longer keys, as suggested above) would be advisable for anyone worried about Echelon. :) Do it before they get their hands on a Beowulf cluster. Of Crays.

    Hmm, I wonder why the U.S. government has banned the export of strong encryption... 8)

    Output of M-x spook (for the Echelon folks):

    South Africa Clinton supercomputer kibo Legion of Doom PLO Serbian
    cracking terrorist colonel [Hello to all my fans in domestic
    surveillance] North Korea Ft. Meade fissionable ammunition
    -W-
  • A friend who works at A.N. Major global financial institution tells me that they do indeed have their own internal crypto group. They really seem to know their stuff; they have a largish number (~50) of throbbing-brained academic mathematicians, programmers, cryptographers etc. Eg: I'm no expert, but apparently the generation of as-random-as-possible random numbers is a crucial part of the deal; well this organisation allegedly were or are planning to install dedicated cards in all their PCs that use (IIRC) radioactive decay to seed the RNG for the hard-core crypto they use on all sensitive internal stuff.

    OTOH I have personally worked for [another large business services firm] with tons of extremely sensitive info on clients. We're talking billion-dollar deals on a daily basis, market-moving deals too. Naturally they take client security to paranoid lengths; yet they're completely clueless when it comes to IT security (eg: straight win95 as standard, no intrusion detection whatsoever, not even a formal written RFC-site security handbook - style security policy.) They just happened to be based in the US ... (I'm in Europe.) Of course it would be pure paranoia to suspect that they might be deliberately allowing all this sensitive commercial info to whizz around the net in plain text to make it easy for ECHELON to intercept ...

  • Okay, everyone's talking about putting a mess of keywords in their .sig to overload Echelon systems. I suggest that such efforts are worthless:

    Flag Message If
    (~ [keywords])
    Unless
    (~ ([keyword]\s*[keyword]){3+})

    (or something like that). The point is, it should be fairly easy to auto check a message to see if it contains a string of keywords in a row.

    Better to randomly distribute keywords throughout your text, methinks.


    Also, correct me if I'm wrong, but this whole discussion centers around traffic going out of the country, right? There's (to my knowledge) no real way for the NSA to monitor every single internet pipe in the country (and the backbones are far too busy to sniff--can we really build a terabit sniffer?)

    david.
  • Maybe Distributed Net is a dummy org for the NSA and they've duped the world into participating in monitoring itself.
  • I suspect that any widespread use of encryption, even "weak" 40-bit encryption, would cause severe problems for Echelon. The amount of work required to decrypt and scan the traffic would be enormous.

    If the NSA or other TLA is seriously interested in what you are doing, PGP is not going to help. Not because they have cracked PGP, but because there are many other easier ways to get the information.

  • From what i've heard, the freeswan guys have to do a huge re-write before it will work with 2.2.x kernels, so this is definitely useless for those of us who have upgraded their kernel in the past year....i can hardly remember the last time i used a 2.0.x kernel.

    Does anyone know of an alternate that doesn't force you to use ancient kernels?

    -Doviende

    "The value of a man resides in what he gives,
    and not in what he is capable of receiving."

  • *LOL* Right now I'm on Slashdot and taping the movie "Sneakers", one of my favourite movies - and one that deals with the NSA. Curious the coincedences that abound...

    Know ye not that ye are Gods???
  • except for one-time pads, encryption methods today cannot be "proven" in a rigid scientific manner, which means that you can never trust them 100%. There have been a number of conspiracy theories over the years about NSA. For example DES, was initially developed by IBM. NSA suggested a change to S-box which supposedly made the algorithm more secure. I believe IBM never commented as to why they accepted this change, but many people feared it added a backdoor. Through the years many symmetrical algorithms have come and gone and DES was one of the few that held it's ground against newer crypto-analysis.
    Depends on your definition provably. Since transfering a one time pab is as hard as the orginal message this is not a very interesting method. A more reaonable soultion is the time X money cost to break, eg. $ 6M and two years, if this is good enough for the given secret then this is a good system for that secrect. This is sort of an insureance policy way to look at cryptography. There is a new class of public key systems which are secure provided P!=NP. Meaning if you could break this system then P=NP. This is as hard as a public key system can get since you can aways guess someone key and try and decript it.

    Check out

    Generating Hard Instances of Lattice Problems M. Ajtai. ECCC on line Tech reports TR96-007 [uni-trier.de] http://www.eccc.uni-trier.de/eccc/ [uni-trier.de]

    of course I'm not say the system proposed is pratical at the moment.

  • Funny thing. I use a mailer called Voodoo that makes transparent use of PGP very easy. It uses some standard (or at least I thought it was a real standard) called PGP/MIME. Once you get Voodoo set up, day to day use is effortless. I had great plans for switching over all of my email communications, at least among close friends, to PGP encrypted.

    Know what I found out? Most emailers don't support PGP very well at all. You have to manually save the message to a file, run it through PGP, and read it. Not hard, but not nearly as easy as reading a "regular" email message.

    My friends weren't using Amigas, so they couldn't run Voodoo. Stuck with elm, pine, etc. They eventually got sufficiently annoyed with all my PGP messages that I was asked to stop. They were happy with encryption, but didn't have the tools to make it easy. So now I just use PGP for "secret" stuff. Kinda defeats the whole purpose, no?

    I don't think that widespread casual use of PGP is going to happen anytime soon, unless better email readers start to become more common.

  • Beware. I've heard that double-encrypting messages can actually lower the strength. IANACryptologist, but check before doing this.
  • Works fine until you run into the wacko libertarian fanatics that would rather die an unpleasant death than give in. Same with any other group this could happen to: a poison tooth's always effective.

    Actual (well, paraphrased) conversation I overheard:

    Parent: So, this PGP key you made for me, what's the chances of it being broken?

    Child: Universe will die of heat-death first. Only real chance anyone would have is to get the passphrase.

    Parent: So, if the NSA held my life for your passphrase?

    Child: Oh, I'd give it to them... Parent sighs right now. I haven't done anything that would justify that... yet. Mutterings of 'paranoia'

  • Che... I hate to say it, but something like this exists for Win9x. The new PGP 6.0i (always go for the International version!) has a PGPDisk which creates encrypted drives that unmount when a key combination is hit or a screensaver goes on.

    Hopefully, a similar product will be come from them for Un*x type OSes soon.

  • A coalition of San Francisco bay area GNU/Linux user groups and Bay Area Cypherpunks are sponsoring a (the first?) Linux-IPSEC (FreeSWAN) installfest at the Oakland convention center at the "Austin Computer Show" 12-4pm this coming Saturday (6/12/99). The "Austin Compuer Show" is basically a computer flea market. There is a $5 admission charge to the show, but apparently you can get in free if you register at http://www.robertaustin.com in the "VIP passes" section. You can also get the travel directions there.
  • While it's true that a one time pad may be as hard to transfer securely as an original message, you only have to do it once and then you can transfer as many other original messages, in complete security, as you want (until you use up the pad).

    And you may not even have to transfer the whole pad if you can both (again, by secure channel) agree on some commonly available text to serve as the one time pad (which has the advantage to looking innocuous if you're subjected to physical search.)

    Consider that pressings (from the same master) of, say, a music CD would make a great ~650 Mb worth of one-time pad.
  • I'm rather surprised nobody has mentioned this before. First off, when people say, "Oh, distributed.net is the fastest computer in the world, and look how long it's taking to crack only 64-bit keys...". We do not know the full extent of NSA's hardware. It is believed that a quantum computer would be able to crack a RSA-encrypted message rather quickly, generally regardless of length. Why? Because a quantum computer will attempt to solve all the possible keys *at once*. Bah, but there is no such thing as a quantum computer (yet), right? Recently (at least 3-6 months ago now) IBM completed testing on a very simple quantum computer capable of adding 2 'qbits' or quantum-bits together. While this might seem elementary, there exists a chance that the NSA already has a fully functioning quantum computer. Considering that they decided not to classify such technology, despite their paranoia in classifying other crypto-related technology, it makes one wonder. Granted, the immediate use for quantum computers is not crypto-cracking I would think.

    Secondly, if one looks at the top 10 supercomputers in the world, they will notice that around 3 of them are of the "classified" category. Combined, these three supercomputers provide more power than the top computer which is at Sandia. Some of these have been in operation for at least 2-3 years. It has also been acknowledged that dedicated systems with custom-designed chips are able to crack DES, etc, at much higher rates than conventional technology - DeepCrack or whatever by EFF is a good example, and that only cost them $100k-200k. Imagine what an intelligence agency with a multi-billion dollar budget can do. So I wouldn't rely on distributed.net to be the benchmark in crypto cracking.

    Finally, there is the matter of limited manpower. Yes, the NSA's weak point would probably have to be their inability to focus on *everybody* cause they just don't have the resources to do so, however, the nature of Echelon lends itself to more economic interests as well as national security ones. Thus, there has been concern that corporations which donate mucho $$ to the current administration might be slipped occasional interceptions of their competition. Given the willingness of our current administration to cater to the Chinese government, I'm not sure they wouldn't hold back against our own national companies. But unless you're some major multinational corp w/ some big competitors sitting around, I wouldn't be too worried.

    So for the most part, I must agree with the rest of the posts that one need not be too concerned with NSA intercepting their transmissions - even if they did, the odds of it being used for malaligned purposes is very slim. While the NSA might possess the technology (and the money), there are many other factors which appear to work in our favor.
  • The present up-to-date FreeSwan snapshots work quite well with 2.2.x kernels. Get a new snapshot, rather than the v1.0.
  • Distributed Net is presently working on breaking a 64 bit RC5 key. They are presently testing about 70 GigaKeys per second. (70,000,000,000/sec).
    Distributed Net is undoubtedly the fastest computer on the planet, even assuming that the NSA has some pretty state of the art stuff.

    At this rate, it would take Distributed Net over 10e20 years to break a 128 bit RC5 key.

    Recent calculations by astronomers say that the universe is about 10e12 years old.
  • It should be noted that the FreeSwan project - which I've been following for quite a while now - is merely an implementation of the IPSEC standards from IPv6. As such, the FreeSwan team is highly concerned that it interoperate with any other program, commercial or free, that also uses IPSEC. Much of their present work is interoperability testing, and so far, FreeSwan works with almost all of the IPSEC products its been tested against. They're working on the others.

    Those of us in the US owe a tremendous debt to the people in the free worls who are doing this. We can't help, but we can test and report. If you want to help, or just see what's going on, go to the FreeSwan site at http://www.xs4all.nl/~freeswan

  • Echelon and Freeswan (Score:3)

    by Checkered Daemon ( 20214 ) on Thursday June 10, 1999 @06:01PM (#1855958)
    When properly used and configured, FreeSwan, using high quality encryption, should be proof against even the NSA. (And yes, it DOES work with 2.2.x kernels.) BTW John Gilmore refused (thanks, John!) to include standard DES in the FreeSwan implementation, even though some people wanted it for backwards compatibility.

    High level encryption, 128 bit symmetrical keys and 1024 bit public-private keys, would take more computational power to crack than presently exists on the planet. Check out how long Distributed.net has been working on a 64 bit key.

    The problem with all this is traffic analysis. Even though they can't read the messages, they can tell a LOT about things just by keeping track of who's talking to whom.

    So just by keeping track of who is sending encoded messages to whom, they can find out a lot.

    The real power of FreeSwan, and especially IPSEC, won't be seen until it operates as a standard, and everybody uses it. Then Echelon disappears into history, along with all the other police states that have plagued us recently.
  • Look at
    http://www.heise.de/tp/english/inhalt/te/2898/1. html (it is in english)
    -----------
    Giant US software manufacturer Lotus has been
    lowering the profile of information about how
    they have installed an NSA-only trapdoor into e-mail and conference systems used by many European governments,
    including the German Ministry of Defence, the
    French Ministry of Education and Research and the
    Ministry of Education in Latvia.
    ----------------
  • In the past, the U.S.A. has been able to crack any code. The Nazis were cracked early in WWII.

    If you are referring to the Engima machine, you are completely wrong. The US wasn't involved with the deciphering project until 1942, for a start. And although the Polish had discovered how to crack Engima ciphered messages from 1932, it was not until very late in the war that the British were able to regularly decode a large number of intercepted messages. Alan Turing was the chief designer of the 'Bronze Goddesses', which helped calculate the keys used with the Enigma machine.

    And do not forget that the Germans also had 'Secret Writer' (known to the Allies as 'Fish') which was far more difficult to decipher than Enigma, and led to the creation of the first electronic computer, 'Colossus', built by a Cambridge mathematics professor and a Post Office engineer. Colossus didn't start working on ciphered messages until 1943.

    I would not consider this 'early in WWII', and the US contribution to the effort came quite late, compared to the Polish and British, who had been working in various forms since the early 1930s, and set up Bletchley Park as a central location for cryptography work.

    And a big part of the reason why Enigma ciphers were broken was not the fault of the code itself, but the poor training and laziness of the operators who often used insecure keys and 'known' words.

    As you will have heard people say before, security is as strong as it's weakest link. Often you will find than lazy or poorly trained humans will be a weaker link than anything else. Why have a fantastic cipher if the user is going to enter their passphrase via cleartext telnet?

  • Really? Sorry. I was getting my information from a WWII book, and I didn't cross-check everything. I don't remember any mention of the ABC in any computing history books I've read, I shall have to go and have another look...
  • The British were certainly involved, they set up the site at Bletchley Park for the purpose of deciphering intercepted messages. However the Polish were involved far before the British (as early as 1932 I think) and made alot of the early discoveries, especially reguarding Enigma. They actually started to be able to crack the Enigma cipher before the war even started...

    The Americans became involved in Bletchley fairly late (around 1942 IIRC), and I dare say clever people from other Allied sides were involved as well at some stage.
  • Echelon doesn't need a secret backdoor in your source code. It's about intercepting the stream of data as it crosses the network.

    The open source part comes from making sure your encryption is pretty darn strong (and not just trusting some one else) -- not in preventing interception.

    NSA (and UK & AUS equivalents) has gobs more money and dedicated circuits to use in decrypting messages -- but they aren't light years ahead of everyone else. So I believe estimates as to how long it would take to decrypt an x-bit encrypted messages using xxx method under todays technology are probably good ball park estimates.
  • In Germany they came first for the Communists, and I didn't speak up because I wasn't Communist.
    Then they came for the Jews and I didn't speak up because I wasn't a Jew.
    Then they came for the trade unionists, and I didn't speak up because I wasn't a trade unionist.
    They they came for the Catholics and I didn't speak up because I was a Protestant.
    Then they came for me, and by that time there was no one left to speak up.

    Martin Niemoeller


    For people who are having difficulty relating to this, here is a modernized version:

    First they came for the fourth amendment, and I did not speak out, because I didn't deal drugs.
    Then they came for the fifth amendment, and I was silent because I owned no property involved in crimes.
    Then they came for the sixth amendment, and I did not protest because I was innocent.
    Then they came for the second amendment, and I said nothing because I didn't like guns.
    And then they at last came for the first amendment, and I could say nothing at all.

    Unknown

    Think about it, OK?




    Kaa
  • First: Closed source encryption products shouldn't be trusted. There are quite a few stories about leaking key bits in headers and the like. None are confirmed, but the NSA did manage to infiltrate Crypto AG. One of the "merits" of the Digital Signature Algorithm is that there is the possibility of a subliminal channel where key bits are leaked in a cryptographically secure way to an eavesdropper. This is possible by very careful choice of the random number used in the signing.

    Second: Open source ones must be closely scrutinized. Consider that it took 10 years for anyone to find a problem in the key generator in Kerberos IV. (Lodin and Dole at COAST, 94?) Everyone assumed that it was safe because it was open and many people had surveyed the code. Lodin and Dole could break the session keys in ~1 second on a Sparc 5.
  • I can see it now... hard working guys (and gals) at Black Helicoper Central working hard over their super-duper-computers....

    G-Man 1: I finally got into Foo, Inc.'s email...
    G-Man 2: Ohhh, Ohhh, what does it say...
    G-Man 1: Quick, wake the President this says they are going work on improving their customer satisfaction and ultilize syngeries between units of their company to beat their competitors...

  • Talent at the NSA (Score:3)

    by noom ( 22944 ) on Thursday June 10, 1999 @06:24PM (#1855967)
    Does anyone think it is likely that the NSA has mathematicians/computer scienties working for them who might have solved (or are close to solving) the problems upon which most cryptographic protocols are based (i.e. factoring or NP completeness)? An AC posted that a mathematics professor had his work censored by the NSA and I heard a rumor that someone at Berkeley had proven that P=NP (this was last fall some time), although I haven't heard anything about it since (although I'd guess it was because his 'solution' was WRONG).

    Somehow, I doubt that the most talented people end up working for the NSA. How many intellectuals could bare to work in secrecy? It would be as if Shakespeare never showed anyone else his works, never had them performed, and burned them upon his death. It seems pretty unlikely that any creative person could work in such an environment...

    ... but I suppose there's always a chance...


  • Yes! I'm glad someone else loves that movie. It pretty much put my childhood spy fantasies up on the big screen for me.
  • "Government cryptanalysis may have been ahead in WW2, but this is a drastically different time. Now, crypto is in the hands of Universities and hackers. We've literally taken the field of cryptology from the hands of the NSA, and they're annoyed. That's why they come up with insane ploys like Echelon. " But SigInt was initiated in 1947-1948. http://www.theage.com.au/daily/990523/news/news3.h tml
  • (And yes, it DOES work with 2.2.x kernels.)

    From http://www.xs4all .nl/~freeswan/freeswan_trees/freeswan-1.00/INSTALL [xs4all.nl]:

    FreeS/WAN does NOT work with 2.2.xx kernels yet, and fixing that is not simple.

    Has this changed? I've been interested in trying it out, but the fact that "2.0.36 only!" is plastered all over the site and documentation kept me from looking at it more than cursorily. I wound up using tunnelvision for now, which is probably equally as difficult to intercept (and a fsck-load easier to set up, from the look of the freeswan docs!) although not necessarily as strong in terms of authentication.

    If so, what's the lowdown on getting it to work in a 2.2 kernel environment?

  • In the earlier days of the net, it was quite common to see .sig files that looked somethign like this:

    ------
    Chet Blodack, Yoyodyne University |
    argyle@mindspring.com |
    "You are in a maze of twisty tunnnels" |
    libya soviet nuclear encryption Reagan warhead money secret israel china |
    oil submarine NSA CIA FBI KGB MI6 IRA Basque communist russia |

    The idea was that if everyone put Echelon keywords in their email, the Echeleon system would flag way too many emails and make the system unworkable. Now that the vast majority of people on the net have no idea what a .sig file is, the tradition has fallen to the wayside.

    Anyone else remember doing this? Any other good sig files?
  • Is this dream even remotely realizable?

    no problem right now :)

    I am using CFS for quite a while now.
    Hm, I don't think it's too complicated, (ok, maybe it took me some time to make it work ;) as far as I remember, there is a step-by-step description how to configure.

    after installing the daemon with an init.d script you can mount crypted filesystems. It's straight forward.

    i would suggest not to do this during startup, as you would immediatly reveal that you have crypted data. ... but if you need that, you could add the corresponding command to the init.d script.


    If you think about crypting your whole filesystems, that might be possible, but you would lose LOTS of performance. Just create a directory for your sensitive data.

    Then, inside your favorite Windowmanager, you may have two icons, that let you attach and detach the crypted directory

    hm...about reentering the passphrase after suspension...
    I personally would add a line to my log-watcher (something like "SWATCH" or "WOTS") that looks after apmd's messages to syslog. if a "resumed after suspend" (dont know the exact text and my notebook is at home ;) ) appears -> detach the crypted fs.

    I think the power of such software relies on the fact, that it is NOT stuffed into a corset of GUI and foolproof(impossible) usage.

    if you need help, send mail.

    nuts

    p.s.
    Has anybody here experience with sfs ?
    Steganographic FS :)) fscking cool.


    -----
  • Some believe NASA faked the moonlandings because they couldn't have to tech to get there. Some believe the NSA is so far ahead of the crypto game that they look over their shoulder all the time.

    Ok, that is plain paranoia, right.

    NSA is government so it's acronym should probably stand for 'Not So Advanced'.

    Huh? I hear you say "US Army is government so it's acronym [...] stands for 'Not so Advanced' ".

    And that's plain wrong.

    If you're concerned about them, thats not paranoid. Being concerned is, IMHO, our duty, and we should give the average users a slight idea about whats going on.

    I am surprised that ppl, that are not so much into computers and stuff know almost NOTHING about NSA, crypto and so on. You almost never hear anything about that on TV, Newspapers...

    I am concerned, not paranoid. There's a difference.

    nuts


    -----
  • Then you believe in security through obscurity.

    No, that's not my point.
    I just don't want anybody to see AT THE FIRST GLANCE, that there's something crypted.

    Ok, you are right when someone takes a closer look, that doesnt help.
    But if you have to enter the key all the time you
    reboot your machine, you must always unlock the
    crypted fs. Ain't i right?

    The more people who use crypto, the more effective cryptography will be for everybody. If one has to even understand what ``NFS'' is in order to install a package like this, then it's still too hard.

    You are right. Maybe RedHat or Suse will add it to
    their distributions. Then it will come correctly set up. Oh, wait, it seems RedHat has included it already: http://www.replay.com/redhat/cfs.html

    That's why PGP and S/MIME are still so marginal that they can be completely discounted: only gurus use them, because they aren't so completely transparent that you don't even know that they're there until they have something to warn you about.

    Try KDE's kmail. Or read Pine's documentation on how to embed pgp.

    But it will always be the users part to understand what he does, why there are public/secret keys and so on. I think it can never get fully transparent.

    I've written a PGP-GUI too, 2 years ago. The problem is, a user always has to worry with his keyrings manually, there are some points that cannot be automated.


  • Excuse me, i forgot:

    There is a short howto, for setting up cfs:
    ftp://ftp.research.att.com/dist/mab/cfs.notes.ms



    ----
  • I believe you have the NSA and RSA confused the NSA, or National Security Agency is a part of the government that I believe is responsible for some sort of spying. They also ran the ECHELON
    project that had, (and still has) the capability to tap any and all communications. RSA, who's name stands for the people who founded the company and figured out public key cryptography

    the NSA would have no reason to try and keep any cryptography "off the shelves" so to speck, because they aren't a for profit company. While they couldn't forcibly get someone not to post there ideas, there's nothing stopping them from buying them off...

    ---------------
    Chad Okere
  • I would think that encripting somthing twice at the same bit lenth with with the same function wouldn't produce anything more secure, I don't really know much about "real" encription, but take the example of XOR encription:

    ((m xor b) xor b) = x, so b is your key.

    if (((m xor b) xor c)) = y, then you might be tempted to think that you'd need to use (((y xor c) xor b) to find x. but you could also use (y xor (b xor c)) as well, and if you were searching the entire keyspace, you might find (b xor c) first... but I assume that the stuff there talking about is nothing like xor encription...

    If you used two keys of diffrent lengh though, it would be more difficult, especaly ones that don't "resonate" for instance if you used a 64-bit key, and a 128 bit key, it would be the same as using one 128-bit key, just make sure they arn't both factors of any small number...
    ---------------
    Chad Okere
  • There was a big artical in a recent issue of wired about some guy in england who though up Public key stuff. he worked for the intelegence agency, and no one there beleved it could work, then when RSA figured it out as well, he got a lot of internal credit, I doubt they would have told the NSA though, (but maybe they were listening in??)
    ---------------
    Chad Okere
  • I doubt it, no one would ever say "12e9" they'd all say 1.2e10... :)
    ---------------
    Chad Okere
  • well, the problem with that is, if you use encription a, b, c, and d, you only get a*b*c*d security, where as if you just add 32 to the number of bits in a message, you make it 4 billion times as hard to crack, so all that crap may not be worth the time in comperison to just using longer bit lengths,

    besides, I'm sure the NSA knows about every encryption system, from RSA to delmoi's wacky ass 8-bit xor encryptor :)


    ---------------
    Chad Okere

  • nothing to fear, except fear itself (Score:3)

    by jonathanclark ( 29656 ) on Thursday June 10, 1999 @06:24PM (#1855987) Homepage
    Except for one-time pads, encryption methods today cannot be "proven" in a rigid scientific manner, which means that you can never trust them 100%. There have been a number of conspiracy theories over the years about NSA. For example DES, was initially developed by IBM. NSA suggested a change to S-box which supposedly made the algorithm more secure. I believe IBM never commented as to why they accepted this change, but many people feared it added a backdoor. Through the years many symmetrical algorithms have come and gone and DES was one of the few that held it's ground against newer crypto-analysis.

    I think most conspiracies are just that. While symmetrical algorithms are breakable by brute force, there is very little else you can do. The field symmetric encryption has enough study that many cryptographers would be willing to risk their life on such methods. Choosing a long enough key will make brute force impossible (considering the amount of energy required to move a single electron that many times the distance of one nanometer).

    Asymmetrical encryption is a different matter. RSA (used by PGP and SSL) has the largest amount of study, so it is often trusted more than Elliptical, or some of the newer matrix based asymmetrical algorithms. RSA's breakability depends on the ability to factor large numbers. Over the years new factoring methods such as quadratic sleeve factoring have been invented that make RSA weaker and weaker. In general you need N*N number of bits to be as secure as symmetrical algorithm. Improvements to factoring have been incremental and not ground breaking and many people they will never go beyond ~O(sqrt(N)).

    But there are practical reasons why you shouldn't be afraid of the government snooping on you. First, you are most likely boring. Unless you work for a foreign government, or you are involved in the weapons industry the RSA probably doesn't care about you. Even if you use PGP to trade child pron, the RSA has bigger problems to worry about. If they RSA had some magically decryption algorithm, there is so much information out there, that they cannot dedicate hardware to decrypting messages unless they believe it is a matter of national security. Most, if not all, of the information they collect is in plain-text form. If everyone used PKZIP to encode their messages, this would be probably require more processing power than they could handle to scan the data.

    Local officals are a million times more likely to just raid your house and use "find" rather than try to tape your phone line. In fact I've never heard of a single case where local officals have tapped a modem-line and decrypted a message. It's much easier, cheaper, and faster to go straight to the source.

    Bottom line is using PGP with any length key is probably safe. Use keys >2048 bit keys if you are selling nuclear weapons.

  • So many of these posts are concerned about echelon picking up every little bit of data going around on the net. It is probably true the NSA can monitor all traffic at various international chokepoints, as well as a large percentage of phone conversations. They keep logs of suspicious activity, while dumping the content and most of the innocuous stuff immediately. Chances are most slashdotters and everyone else doesn't make it past the first level of filters, but I would bet a copy of this discussion makes it to someone's desk for analysis(buy me a pint, J) and a good laugh.

    What worries the ones who are paid to worry about things like this is directed surveillance. If the echelon filters pick up something and it gets you onto a watch list, then any messages from/to you get collected and analyzed by a human. At that point they can determine whether you are just some snot-nosed college brat using PGP for fun or whether you should be monitored more closely.

    The watch lists can probably number around 100,000 to 300,000 targets, with AI-like knowledge engines flagging only the most interesting changes to the watch list for humans to review. I understand there is a much fought over pecking order within the ranks of echelon/NSA analysts to get their filter to be on one of the higher tier alerts when they think their project is important. Each target gets a dossier opened on them and stored in a big case management database [remember INSLAW?], with various bits of info and analysis added as necessary.

    Directed surveillance of embassies, terrorist communication channels, high ranking political types, and business leaders is the highest tier of alerts, producing reports of activity every day. Lesser tiers cover suspected drug activity, crackpot political fringe groups, key players in telecoms operators and military suppliers, and business and entertainment movers and shakers.

    On the back end, post-event analysis of collected material can often reveal a bunch of information to analysts and law enforcement liasons, giving them all kinds of leads. [did anyone notice how the gay navyman on AOL just happened to have the exact same name as a convicted terrorist? coincidence, or the result of a very deep analysis of stored material?]

    I'm too lazy to log out to AC, I figure someone [them!] grabs the /. logs on a regular basis and use the IP address to match AC postings to possible accounts. C-taco and Hemos have never stated they dump the logs on a regular basis or never back them up, so AC is a bit of a farce if it ever comes down to serious law enforcement action.

    the AntiCypher

    P.S. I especially like the people who go through tons of iterations just to hide something, is what you do so important that it needs hiding?

  • Actually, the NSA can classify any work that is submitted to the patent office. The way it works is that if the NSA sees something that is submitted for a patent and they think that it is interesting enough to them, they have the authority to classify that patent. So what happens is that a crypto researcher will attempt to patent their method for encryption/decryption, and it comes back that while they got the patent, it's been classifed, and there isn't a whole lot you can do about it!
  • This is why people should distribute (electronicqally) things that the NSA might have an interest in to as many people as possible. It would be nice if there were groups of non-math people who tried to follow the research specifically to keep the NSA from being able to fuck with people. Luckaly, most research dose not occure in a vacume and there are to many people working to try and understand it for the NSA to stop things. You have made me curious now, what was he working on? (I'm a math person)


    This brings up an intersting and related point.. How do we best discurage/save smart people from working for the NSA? We need to explain to people with an interest in number theory and algorithms research that they really do not want to spend their lives keeping secrets. It's hard enough to not be able to talk to people because they can't understand you.. I can not imagine not being allowed to talk to them.. Communication is a part of being human.
  • So let's assume that the government has a hypercluster of computers that are a billion billion times faster, en masse, than the ENTIRE
    distributed.net.

    It would still take them 1e20/1e18=100 years to break _ONE_ 128 bit key.

    2099: "Well, Fred, it took a hundred years, but we finally decoded the message! And those pesky Slashdotters thought they were so smart."
    "What does it say, Bill?"
    "It's printing out now... M... A... K... E... space... M... O... N... E... Y... space... F... A... S... T... space..."
  • Current USGOV policies remain merely a holding action to deter the widespread deployment of a PKI (public key infrastructure) and its integration into commonly used electronic messaging products, such as email, until they can figure out how to make domestic use of encryption illegal or force key escrow.

    When the letter instituting this policy was finally released under FOIA, I placed a copy up on the wall next to my desk.

    The NSA is not concerned about message traffic volume, this remains a red herring despite the growth of the internet. Parallelism works fine in this application, and traditional budgetary issues simply do not apply. Think about it.

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close