Friday, September 06, 2013

Strong Decryption and its Consequences

This week's NSA disclosures push the ball much farther down the field.

There were inklings.

1) One wondered why border security felt they needed the power to examine and even confiscate laptops and other electronic devices.  I reasoned that "bad guys" would send incriminating messages or data across networks using some secure mechanism, so why bother.  But, actually, physical transportation of data was a leak because it bypassed the compromised security of the Internet.

2) One also wondered why the NSA seemed to be less concerned about SSL some time ago.  It did occur to me that they must not have felt obstructed by SSL anymore, and I even wondered if they had broken crypto math or just leveraged the weak implementations of SSL everywhere.  It even occurred to me that they perhaps had a program to acquire private keys of SSL providers.  But I also thought that was probably just me in a tinfoil-hat moment.

3) Schneier and others had speculated in the past that NSA was maybe influencing crypto and security standards to incorporate secret weaknesses and trapdoors only they knew about.

This week's revelations that NSA does have a program for collecting private key material is sobering, but I guess given other recent news, its not that much of a surprise. I have been worried about the global PKI infrastructure being fragile and needing re-architecture, but actually its fragile by secret policy. We know about this because Snowden removed documents from NSA and let us all know. What other NSA employees, not so scrupulously patriotic, have leaked those databases of private key material to bad guys or true adversaries?

The revelation that NSA has indeed worked hard to influence standards and even vendor products and services to incorporate security weaknesses is very dismaying.  Broken security protocols and broken security products are broken for everyone.  Even if we trust the NSA (?) to respect the boundaries between looking for bad guys and ignoring ordinary business uses, bad guys who inevitably will find those same vulnerabilities will not.

Here is one consequence, discussed before: the USA will lose its privileged position as arbiter of the internet. David Meyer in GigaOm says it the best I've seen so far: http://gigaom.com/2013/09/06/dear-stupid-stupid-nsa/

Here is another consequence, also discussed before: these revelations will foster incredible innovation that will make NSA's real job much harder, and offer, for a time, better security for all of us. Where that could lead next should be the subject of another post.  As for the flowering of related innovation: http://www.wired.com/threatlevel/2013/09/the-scramble-to-build-encryption/

Thanks to businessinsider.com for the photo.

Selected inks from the news and analysis this week:

ProPublica: http://www.propublica.org/article/the-nsas-secret-campaign-to-crack-undermine-internet-encryption

Schneier: http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-internet-nsa-spying

More Schneier: https://www.schneier.com/blog/archives/2013/09/the_nsas_crypto_1.html

Bamford: http://blogs.reuters.com/great-debate/2013/08/26/nsa-listening-to-everyone-except-oversight/

Time: http://swampland.time.com/2013/09/05/five-revelations-from-snowdens-newest-leak/

Even More Schneier: http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance

Wired: http://www.wired.com/threatlevel/2013/09/nsa-backdoored-and-stole-keys/

Atlantic: http://www.theatlanticwire.com/technology/2013/09/how-nsa-made-sure-it-can-decrypt-your-online-communication/69094/

Update
Cato Institute: Julian Sanchez nails it:  http://www.cato.org/blog/nsas-war-global-cybersecurity


No comments: