Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #4410 > unrolled thread

How the NSA Could Stop Sucking and Be Awesome Instead

Back to article view | Back to comp.misc

Contents

  How the NSA Could Stop Sucking and Be Awesome Instead Rich <rich@example.invalid> - 2014-08-16 06:22 +0000
    Re: How the NSA Could Stop Sucking and Be Awesome Instead RS Wood <rsw@therandymon.com> - 2014-08-16 20:06 +0000
      Re: How the NSA Could Stop Sucking and Be Awesome Instead Rich <rich@example.invalid> - 2014-08-16 21:58 +0000

#4410 — How the NSA Could Stop Sucking and Be Awesome Instead

http://teddziuba.com/post/58735980543/how-the-nsa-could-stop-sucking-and-be-awesome-instead

   I applied for a job at the National Security Agency in 2006.

   I was about to finish my undergrad degree in Mathematics. My favorite
   classes were abstract algebra, a subject whose only footing in reality
   is cryptography. I also felt some amount of national pride: my high
   school was a boarding school in Connecticut, so I experienced September
   11, 2001, with many friends from New York City.

   There?s an inscription in the marble floor of the building at my alma
   mater that houses the Mathematics department: "Reality favors symmetries
   and slight anachronisms". Only now do I appreciate that quote, since I
   received my full-time offer from Google while I was in the interview
   process with NSA.

   I e-mailed my NSA recruiter and said thanks but no thanks.

   ...

[toc] | [next] | [standalone]

#4430

On 2014-08-16, Rich <rich@example.invalid> wrote:

Hmm.  Here's his list:

1. open source code [especially crypto]
2. public key signing for American citizens
3. security training for American developers


His naivité makes clear what he says in the first two sentences: he
finished his bachelor's degree in 2006.  Nice to be young and
idealistic!  Stick around for when you'll be cold, bitter, disheartened,
disillusioned, and find yourself bitching about it endlessly on Usenet
;)  Well, off to go trim my neckbeard.  Nah, maybe I'll keep growing
that bastard out.

[toc] | [prev] | [next] | [standalone]

#4434

RS Wood <rsw@therandymon.com> wrote:
> On 2014-08-16, Rich <rich@example.invalid> wrote:

> Hmm.  Here's his list:

> 1. open source code [especially crypto]
> 2. public key signing for American citizens
> 3. security training for American developers

> His naivité makes clear what he says in the first two sentences: he
> finished his bachelor's degree in 2006.  Nice to be young and
> idealistic!  Stick around for when you'll be cold, bitter,
> disheartened, disillusioned, and find yourself bitching about it
> endlessly on Usenet ;) Well, off to go trim my neckbeard.  Nah, maybe
> I'll keep growing that bastard out.

Yes, his naivité is clearly apparent when he suggests they write create
the crypto and write the libs.  Even if they are open source, Crypto is
so hard and math heavy that small changes to the values used for things
like Sbox lookups can have devastating effects on the ease of breaking
the encrypted stream.

One just has to look to the history of the NSA involvement with
creating DES from Lucifer to see the possibilities:

  Some of the suspicions about hidden weaknesses in the S-boxes were
  allayed in 1990, with the independent discovery and open publication
  by Eli Biham and Adi Shamir of differential cryptanalysis, a general
  method for breaking block ciphers. The S-boxes of DES were much more
  resistant to the attack than if they had been chosen at random,
  strongly suggesting that IBM knew about the technique in the 1970s. 
  This was indeed the case; in 1994, Don Coppersmith published some of
  the original design criteria for the S-boxes.[9] According to Steven
  Levy, IBM Watson researchers discovered differential cryptanalytic
  attacks in 1974 and were asked by the NSA to keep the technique
  secret.[10] Coppersmith explains IBM's secrecy decision by saying,
  "that was because [differential cryptanalysis] can be a very powerful
  tool, used against many schemes, and there was concern that such
  information in the public domain could adversely affect national
  security." Levy quotes Walter Tuchman: "[t]hey asked us to stamp all
  our documents confidential... We actually put a number on each one
  and locked them up in safes, because they were considered U.S.
  government classified. They said do it. So I did it".[10] Bruce
  Schneier observed that "It took the academic community two decades to
  figure out that the NSA 'tweaks' actually improved the security of
  DES."[11] (Wikipedia: http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design)

Non-random changes to numerical values used as lookup tables increased
the resistance of DES to differential cryptoanalysis.  However, the
changes could just have easily been for the opposite reason.

And given the current NSA hoovering system, there is reason to suspect
that changes they would make would be to weaken the schemes against
attacks that they know, but that others do not.  Doing so would let
their hoovering system be more "effective" in their twisted mindset.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web