I wonder if the NSA can crack open-source public-key encryption

[LandR]

I suggest anyone that wants to send encrypted messages that they write the code themselves. There are several ways to encode messages that do not involve prime numbers. Though not many use a one way function.

This is awful advice. Implementing crypto is hard, incredibly hard and even very subtle bugs can lead to devastating attacks.

Never do crypto yourself.

 

[LandR]

This topic came up in the comments on Bruce Schneiers blog post on the NSA. Someone asked if precompiled open source binaries could be being compromised by the NSA inserting their own, hacked version, into the stream when you think you're pulling the proper legitimate one from your open source repository. He said he thinks they could be.

 

[Beanbag]

The Enigma code was broken by exploiting the weaknesses in the HUMAN operators. MUCH time and effort was spent figuring out what bad habits the Enigma operators might develop, what shortcuts they might take, where they might get sloppy and careless.

The BIGGEST fault in the Enigma was NOT the reflecting cylinder, which cut the search space in half because whatever key you pressed COULD NOT be the encoded error. Even with this "fault," there are roughly 10e214 (ten to the 214 power) permutations you'd have to sort through.

The hole through which Enigma could be unlocked was a procedural one. You set your machine to a pre-agreed three-character daily code also known on the receiving end. Then, you picked three different letters, supposedly at random, that would be used to encode the ACTUAL message. You typed those new letters TWICE through the Enigma using the daily code, writing the results down. THEN you set your machine to the second, random three digits, and encoded your message.

At the receiving end, you got your encyphered message. You typed it back through your machine set to the daily code. You knew the first six characters should be two identical groups of three letters that were the settings for the following message. They repeated the three-letter key so you could be sure on the receiving end nothing got garbled, or if it did, then you could try decoding the message using the first group, and if that didn't work, try the second one. The odds of BOTH three-letter groups getting garbled were relatively small.

This left wonderful exploits for the codebreakers to use. You didn't have to look at the whole message -- you just concentrated on the first six letters. Any solution that gave you two identical three-letter groups was the correct day code. And once you had the day code, then anything else sent that day could be read as well.

Couldn't get the day code for some reason? Then work on the three-letter message code. Cypher clerks get careless. It's a repetitive task. Need three letters? Well, just strike three adjacent keys, either across, diagonal, or vertical.

This is somewhat simplified, but that's how Enigma was broken, by exploiting the human side. The Germans introduced complications through the plugboard, an extra non-rotating thin cylinder in the naval Enigmas, and by changing the shared "daily" keys hourly toward the end of the war. In each case, the codebreakers were down until somebody tweened out what changes had been made and came up with a procedure to work through them.

The Enigma USED CORRECTLY is cryptographically secure. It's still vulnerable to Rubber Hose Cryptography, where you take a rubber hose and beat the person on the receiving end until they give up the solution.

Beanbag

 

[Charlie Wilkes]

This topic came up in the comments on Bruce Schneiers blog post on the NSA. Someone asked if precompiled open source binaries could be being compromised by the NSA inserting their own, hacked version, into the stream when you think you're pulling the proper legitimate one from your open source repository. He said he thinks they could be.

I would think that would show up in a check sum.

I guess you have to run Linux, compile your own encryption software, and do all your sensitive, unencrypted work on a computer that is physically separated from any network. Inside a concrete bunker.

 

[Andy_Ross]

The Enigma code was broken by exploiting the weaknesses in the HUMAN operators. MUCH time and effort was spent figuring out what bad habits the Enigma operators might develop, what shortcuts they might take, where they might get sloppy and careless.

The BIGGEST fault in the Enigma was NOT the reflecting cylinder, which cut the search space in half because whatever key you pressed COULD NOT be the encoded error. Even with this "fault," there are roughly 10e214 (ten to the 214 power) permutations you'd have to sort through.

The hole through which Enigma could be unlocked was a procedural one. You set your machine to a pre-agreed three-character daily code also known on the receiving end. Then, you picked three different letters, supposedly at random, that would be used to encode the ACTUAL message. You typed those new letters TWICE through the Enigma using the daily code, writing the results down. THEN you set your machine to the second, random three digits, and encoded your message.

At the receiving end, you got your encyphered message. You typed it back through your machine set to the daily code. You knew the first six characters should be two identical groups of three letters that were the settings for the following message. They repeated the three-letter key so you could be sure on the receiving end nothing got garbled, or if it did, then you could try decoding the message using the first group, and if that didn't work, try the second one. The odds of BOTH three-letter groups getting garbled were relatively small.

This left wonderful exploits for the codebreakers to use. You didn't have to look at the whole message -- you just concentrated on the first six letters. Any solution that gave you two identical three-letter groups was the correct day code. And once you had the day code, then anything else sent that day could be read as well.

Couldn't get the day code for some reason? Then work on the three-letter message code. Cypher clerks get careless. It's a repetitive task. Need three letters? Well, just strike three adjacent keys, either across, diagonal, or vertical.

This is somewhat simplified, but that's how Enigma was broken, by exploiting the human side. The Germans introduced complications through the plugboard, an extra non-rotating thin cylinder in the naval Enigmas, and by changing the shared "daily" keys hourly toward the end of the war. In each case, the codebreakers were down until somebody tweened out what changes had been made and came up with a procedure to work through them.

The Enigma USED CORRECTLY is cryptographically secure. It's still vulnerable to Rubber Hose Cryptography, where you take a rubber hose and beat the person on the receiving end until they give up the solution.

Beanbag

ANother bad habit was ending messages with Heil Hitler

 

[nathan]

This is awful advice. Implementing crypto is hard, incredibly hard and even very subtle bugs can lead to devastating attacks.

Never do crypto yourself.

Correct. Or you'll end up with WEP. Whose essential flaw is even stupider than the human factors error beanbag describes for Enigma.

 

[aggle-rithm]

Use a Code, don't encrypt. A Coded message will read like boring bland text but have the real message hidden in it.

'Aunt Irma is coming to stay this weekend'

Believe it or not, that was the code used by Stalin in WWII.

"Mr. P will be meeting with Mr. X to discuss tomorrow's counterattack against the Wehrmacht...I mean, the Lady's Auxiliary."

 

[Soapy Sam]

It should be fairly easy to find out.

Just encrypt a message to that nice Mr.Assad, referring to the shipment of neurotoxin you have awaiting collection in a warehouse.
Use your own address and start a timer.

Let us know how it pans out...

 

[Darat]

Interesting news report today: http://www.bbc.co.uk/news/technology-24048343

...snip...

US intelligence agency the NSA subverted a standards process to be able to break encryption more easily, according to leaked documents.

It had written a flaw into a random-number generator that would allow the agency to predict the outcome of the algorithm, the New York Times reported.

The agency had used its influence at a standards body to insert the backdoor, said the report.

...snip...