I guess what I would do is XOR your message with random strings into n parts which would all need to be combined to reconstruct your message, then encrypt each of those strings with n independent shared key ciphers. Now split those shared keys into m parts for m independent public key ciphers and store the encrypted shared keys with your message.
That would require them to either defeat all m public key ciphers; or at least n-1 shared key ciphers to get any information even with a known plaintext. I guess I recommend m=n=3 or 4 for a decent compromise between filesize and paranoia.
Then, put your private keys on a computer that is never connected to the Internet, ideally with a different OS and processor than the one that you do connect with. You might want to double the air-gap with another disconnected computer to make sure youâre not sharing your USB thumb drive between the online PC and the one with the keysâŚ
OK, this is getting ridiculous. Call me crazy, but Iâm starting to wonder if it may actually be easier to elect people to disassemble the NSA than develop a secure message channel.
Funny how we get told weâre getting screwed with encryption, but we donât know whatâs safe and whatâs vulnerable. Where are the hard facts here? What has the NSA broken⌠exactly?
My browser just crashed when I opened up Bruce Schneierâs article on how to be safe against the NSA! Uh oh!
Well, letâs see. I would assume:
-
any domestic USA internet company (Google, MSFT, Apple, etc) allows NSA to see unencrypted contents of any user messages that pass through their servers.
-
any clear-text content you send across the Internet is visible to the NSA through backbone taps.
The only thing thatâs safe is true end-to-end encryption where client software on your computer initiates the encryption with your personal private key, and the message only ever touches the Internet in encrypted form.
âTrust the math. Encryption is your friend.â
What the NSA has done is convince technology producing businesses to weaken their encryption. I wouldnât call it an innovation or âground breakingâ. The NSA has been strong arming corporations since DES.
Open source, publicly available, peer reviewed crypto appears to be good. Stay professionally paranoid.
Since the NSA surveillance story broke open I have been reading Bruce Schneier closely.
Indeed. I would generally assume that if there is any information that the NSA could request of a company with a NSL, then they will. And if they canât, then they will hack it and steal it. There is simply no way to be able to trust any company, foreign or domestic, with your data right now.
We pretty much have to assume that all electronic correspondence is crackable - given enough time and resources: which the NSA has plenty of both.
The only sure-fire way to ensure secure communication is to go analog. Maybe weâll see a resurgence in the US Postal Service again?
Where is that substantiated in the articles? What encryption exactly is not vulnerable to NSA exploitation, and what is?
According to the Bullrun doc from the guardian (http://www.theguardian.com/world/interactive/2013/sep/05/nsa-project-bullrun-classification-guide) it is explicitly stated that, âBecause of multiple sources involved in BULLRUN activities âcapabilities against a technologyâ does not necessarily equate to decryptionâ.
This, along with the analysis done by many in the field, strongly leads me to believe that the underlying algorithms for strong crypto remain strong. The danger comes from closed sourced software that has been backdoored/weakened without us knowing about it.
No, thatâs a crazy tin foil hat assumption. Public open source crypto has been massively peer reviewed over decades.
Stay professionally paranoid.
Considering they pluck many business and trade secrets at will, thatâs actually the professional thing to do.
Right, and not to mention the government and quasi-governmental entities use the same encryption and they sure as hell donât want other factions of the government getting into their classified infos through a backdoor.
All encryption is eventually crackable - infinite monkey theorem and all thatâŚ
These reports show documentary evidence that many (most?) of the encryption algorithms we depend on today for secure transactions have been compromised. Itâs naive to presume that open source crypto is somehow immune just because itâs been peer reviewed. I donât need a tin foil hat to make the leap that all of our online information is not as secure as weâve been lead to believe.
That doesnât necessarily rule out decryption either.
Some Secure Sockets Layer (SSL), virtual private networks (VPNs), and security used for 4G smartphones is vulnerable with backdoors according to the Times.
I think everyone is still sifting through to see whatâs screwed with backdoors or just more impervious to brute force attacks. Not to mention, I wouldnât doubt that the Times and Guardian are pre-emptively redacting a lot of it so the government doesnât decide to drone strike them (or at the very least raid their press offices and trash their computers).
Remember, freedom isnât free, war is peace and money is money.
I think you have a misunderstanding. First of all, if it takes infinite time to do something, thatâs not âinfinite monkeysâ, thatâs shorthand for âimpossibleâ.
Most of the evidence weâve seen is about backdooring, where the NSA and US Government can compel companies to allow back-door access to their systems⌠and then force them not to talk about it with anyone, too. This is shitty, but governments can do things like that.
Iâm not aware of any credible evidence whatsoever that well-known, public crypto has been compromised by magical unknown-to-the-world mathematics, or magical yet-to-be-invented quantum computers. If you have such evidence, please to be sharing it.
What cipher suites and key exchange algorithm? What SSL versions?
The details are extremely important overall in this discussion.
Like I already said, I think everyone is still trying to figure things out. And, like I said, I wouldnât doubt that the Times and Guardian are pre-emptively redacting a lot of it so the government doesnât attack them in some manner. Thatâs our reality.
Hopefully more details will reveal themselves when/if they can. The solution to some of this is political, not technological. Businesses are putting backdoors into their products at the behest of our government. Thereâs no technological reason to do that.
In the meantime, I do agree that everyone should share as much details on whatâs safer and which is probably compromised as well. As the NSA certainly already knows, knowledge is power.
Hereâs what theyâve said so far:
The secrecy of their capabilities against encryption is closely guarded, with analysts warned: âDo not ask about or speculate on sources or methods.â
A GCHQ team has been working to develop ways into encrypted traffic on the âbig fourâ service providers, named as Hotmail, Google, Yahoo and Facebook.
âŚ
The files show that the agency is still stymied by some encryption, as Mr. Snowden suggested in a question-and-answer session on The Guardianâs Web site in June.
âProperly implemented strong crypto systems are one of the few things that you can rely on,â he said, though cautioning that the N.S.A. often bypasses the encryption altogether by targeting the computers at one end or the other and grabbing text before it is encrypted or after it is decrypted.
âŚ
The full extent of the N.S.A.âs decoding capabilities is known only to a limited group of top analysts from the so-called Five Eyes: the N.S.A. and its counterparts in Britain, Canada, Australia and New Zealand.
If youâre looking for things that the government will have issues with, do researchâŚ
And a PGP protocol with a surreptitious Clipper Chip installed is effectively useless - only you donât know it. So what if the original protocol as designed is strong if there exists an exploitation on the front or back end or even at the hardware layer itself. There is no appreciable difference in the outcome - your data is still not secure.
The NYT article offers some insight into the documents that NSA is not solely looking for backdoor opportunities from service providers but secretly altering the specs of encryption designs at the source. The article confirms that at least one attempt was made to write vulnerabilities into the standards being adopted and others were put into the chips by the hardware manufacturer directly.
Nobody really knows what other exploitations may or may not have been successful. Thatâs my original point - you canât assume that any data is truly secure. Frankly, I think tin foil hats should be in short supply right about now.
