Comment on Mathematician warns US spies may be weakening next-gen encryption

• Touching_Grass@lemmy.world ⁨8⁩ ⁨months⁩ ago

  I have a pet theory that a lot of our passionate “movements” that get us all angry and upset are only those movements that benefit someone powerful.

  Its stuff like this that end up being just another coin that jar.

  Like this should piss so many people off. Its something enough people know about. It’s something that you would think would have all kinds of groups up in arms about. Like ask any self respecting 2A enthusiasts if the government should keep skeleton key to every lock in their house.

  Yet there’s fucking nothing but Daniel Bernstein

  source

  • guacupado@lemmy.world ⁨8⁩ ⁨months⁩ ago

    I, too, just finished watching Rabbithole.

    source

    • Touching_Grass@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Confused Kiefer Sutherland noises

      source
• otter@lemmy.ca ⁨8⁩ ⁨months⁩ ago

  it will be illegal if the government doesn’t have an easy way to break it

  Aren’t there a lot of existing standards already can’t be broken easily (by anyone)? That’s why we have all these recent attempts to force backdoors into encrypted apps

  source

  • hoshikarakitaridia@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

    I’m going to break things down a few levels. Disclaimer: I’m a nerd not a mathematician, so if anyone else can fix my errors that would be great.

    Cryptography is a cat and mouse game. There is currently no “perfect solution” so that A and B can communicate and C has no way of cracking the communication at some point.

    Cryptography is very complex for obvious reasons, but a lot of modern algorithms hinge on the time it takes to calculate prime numbers and test them against encrypted communication. Traditional PCs take an incredibly long time to calculate prime numbers.

    Quantom PCs don’t. The way they operate makes them incredibly helpful for calculating primes, that’s why a lot of cryptographic algorithms will be in jeopardy once it is more widely implemented.

    But back to your question. There are already rumors that NSA is using super fast traditional computers to calculate prime numbers and collect them in a database to make cracking traditional encryption easier.

    The only thing I can think about with is is that for the NSA they are not moving quickly enough to catch up or they suspect any future quantum key encryption will thwart any attempts they made.

    This would be in tandem with moves by the UK parliament to get a law going that implements backdoors in devices or apps (I assume that must be pushed by GCHQ?).

    Personal opinion: encryption with a backdoor is ridiculous. The government likes to represent that they’re the only one to access those, but it only takes one savant 10yo interested in penetration testing or one rogue government employee for this backdoor to be used for malicious purposes. And it’s not like these ppl already exist.

    source

    • Socsa@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

      So there was an extremely interesting CVE recently about TLS trust issues on Qualcomm modem firmware.

      Astute observers have been asking why modem firmware is implementing TLS exchanges in the first place, leading many to speculate that the NSA was using TLS to authenticate their backdoor, and the keys got leaked.

      source
• Blackmist@feddit.uk ⁨8⁩ ⁨months⁩ ago

  They seem to have calmed that down in recent years, and rely on the dumb public to store all their secrets on readily accessible corporate servers.

  The maths war is hard to win (bigger keys handle most of that), and I honestly doubt most current encryption can be beaten reliably even with quantum computing.

  source

  • Socsa@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

    It’s because they don’t care about encryption when they can just side channel the endpoints. You can infer device state from observing EM emissions, and in theory observe keys being loaded into the registers under the right circumstances. This has been demonstrated conceptually l many times over the past decade, using a wide variety of devices and methods.

    source
  • Restaldt@lemm.ee ⁨8⁩ ⁨months⁩ ago

    Ive never understood how the same crowd that spouts not your keys not your crypto would ever trust any password manager they havent personally read the source code for/compiled/self hosted.

    Not your server not your safe/secure password

    source

    • Socsa@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

      Because the pop security YouTube crowd goes through great lengths to avoid these conversations which reveal the limits of their own knowledge and abilities. Because a YouTube channel which just says “you are vulnerable to state actors and should focus on protecting yourself from more benign threats” doesn’t generate as much traffic as shilling VPNs.

      source
• RangerAndTheCat@lemmy.world ⁨8⁩ ⁨months⁩ ago

  Didn’t the same thing happen with TrueCrypt?

  source