Encrypted file and unencrypted copy together, can password be calculated? - Page 1
Forum section: electronics / general

author: Infraviolet
author_rank: Super Contributor
timestamp: June 03, 2024, 05:57:28 pm
content: With classical ciphers if one had the plain text and the cipher text together then by comparing them, one could easily deduce the key, a "crib" attack in the case where part of the message was known. This was partly how enigma was cracked, by exploiting phrases that Bletchley park knew would be included within messages, such as one german observation post which sent almost every day a message "nothing to report", alongside using the fact enigma could never encrypt a letter as itself.In the case of modern symmettric cryptography, does this still apply? If a file, and an encrypted copy of that file made with something like gpg's symmetric encryption (aes256) command, or a folder and an encrypted 7z (again aes256) copy of that folder are together, does calculating the key become possible? If not, why not? Remember, passwords often get reused, despite it being bad practice, perhaps much more often fro encrypting specific files than for login passwords, so if this weakness does exist than anyone who's ever encrypted a not-very-secret file and an attacker somehow sees both the original file and its encrypted copy, could work out the password and then use it to decrypt more private files for which the person may have used the same password as the key.I'm not attempting to do this, it is well beyond my skill level or needs to actual reverse engineer a password from the "plaintext and ciphertext together" situation, but I would like to understand whether the existence of such a weakness is actually a serious possibility, or if something is done by gpg/7z/the underlying aes algorithm , to make it genuinely, or nearly, impossible.Thanks

author: JohanH
author_rank: Frequent Contributor
timestamp: June 03, 2024, 06:48:54 pm
content: My understanding is that it's very hard. I'm not into cryptography or ciphers other than as a user, so I don't really have any deeper information. But this is a topic that has been discussed frequently, so searching gives some answers.Here is one:https://crypto.stackexchange.com/questions/1512/why-is-aes-resistant-to-known-plaintext-attacks/64079#64079

author: ejeffrey
author_rank: Super Contributor
timestamp: June 03, 2024, 06:52:06 pm
content: No, all modern symmetric ciphers are designed to be resistant to this, so called "known plain-text attacks" and it's basically step one of the cryptanalysis for any new cipher.In fact, ciphers are additionally expected to be resistant to "chosen plain text attacks" such that even if the attacker can trick you into encrypting maliciously chosen data and then revealing the encrypted ciphertext, the attacker still isn't able to recover they key much easier than brute force.These analysis are usually done on reduced versions of ciphers with shorter keys and fewer rounds. So generally they will talk about this as a security parameter: how much you have to weaken the cipher before there is a known attack.asymmetric ciphers (such as RSA) generally *do* have at least chosen plaintext attacks. For instance, if you could get someone to encrypt "1" or "0" that might reveal the key. This is one of many reasons why asymmetric ciphers aren't used by themselves, but only for key exchange. The key can be chosen randomly and make sure it doesn't exploit known weak inputs.

author: Infraviolet
author_rank: Super Contributor
timestamp: June 03, 2024, 08:33:22 pm
content: Thanks for clarifying that.

author: Kjelt
author_rank: Super Contributor
timestamp: June 03, 2024, 08:45:20 pm
content: Indeed nearly impossible (takes at this moment millions of years of attempts) unless the quantum computer is mature. Then all possible combinations can be done at once hence reducing finding the key quickly.If the quantum computer will become mature and would be capable of doing this, then all encrypted messages from the past could also be decrypted almost instantaneous.There are law enforcement agencies and national security agencies already storing as much encrypted content from criminals and opposing countries as possible in the hope they can soon decipher them with these new computers.So there are now new quantum resistant encryption standards being developed.Especially for government and military applications where the data could be sensitive in tens of years when made publicly this is a hot potatoe.

author: Infraviolet
author_rank: Super Contributor
timestamp: June 11, 2024, 12:20:29 am
content: "If the quantum computer will become mature..."It is my understanding that quantum computers are a threat to asymmetric (public key private key) crypto, because a public key exists from which they can derive the private key by quickly factoring a product into its constituent primes, quickly factoring in to primes with Shor's algorithm being the unqiue selling point of quantum cpmputers, and the reason we should all hope there is some unforeseen practicality which makes them unworkable at scale...But for symmetric crypto, as this example discusses, I had thought a quantum computer could do nothing more than speed up the, very long, cracking times by a factor of 2, or 10, or something like that. A factor which is unwelcome, but against the many-orders-of-magnitude-more-than-the-age-of-the-universe brute-forcing time for symmetrc crypto with a decent key length, is still insignificant? Quantum computers threaten* the security of public-key private-key methods which are needed for parties who don't have a secure channel before they meet to exchange a secure key, they aren't predicted to have any effect on symmetric crypto for stored data?*threatening not only future communications, but any which various sinister 3 and 4 letter agencies collect today in a capture-now decrypt-later attack if they should ever get their evil hands on a quantum computer able to work reliably at scale

author: Bud
author_rank: Super Contributor
timestamp: June 11, 2024, 08:04:36 pm
content: Quote from: Kjelt on June 03, 2024, 08:45:20 pmI'd like to see this proved but i am sure you wont be able to prove it, as this is just a conspiracy speculation. The economics of that is very much questionable.

author: Nominal Animal
author_rank: Super Contributor
timestamp: June 11, 2024, 08:45:36 pm
content: Quote from: Bud on June 11, 2024, 08:04:36 pmSo, you claim thatPRISM,RAMPART-A,Bullrun,TRAFFICTHIEF, andXKeyscoreare "just a conspiracy speculation"?Nah, mate. I think you should do at least minimal research before making such ridiculous claims.

author: pcprogrammer
author_rank: Super Contributor
timestamp: June 12, 2024, 05:47:50 am
content: Quote from: Bud on June 11, 2024, 08:04:36 pmCan't remember how long ago and on which channel, but there was a documentary about how in the UK the overseas internet and telephone cables (fiber) are tapped to listen in on all the (internet) traffic passing by.Lots of articles on the net about GCHQ doing this. One example:https://www.vpncompare.co.uk/uk-tapping-undersea-cables/When needed they will store data as evidence for possible court appearance.I'm not a conspiracy theorist, but do believe that governments and their agencies spy on all of us, and not per se for our best interest.

author: Kjelt
author_rank: Super Contributor
timestamp: June 12, 2024, 05:17:06 pm
content: Quote from: Bud on June 11, 2024, 08:04:36 pmIt is just happening. Everybody was shocked when Snowden revealed the practices of the NSA. Do not think one second that has stopped.Privacy? The data is encrypted so no one can touch your privacy..... yet.To give a real world example on small scale, the dutch police had years a problem. Criminals had encrypted cellphones and they texted eachother continuously.Everything was stored and one day they were able to decrypt some messages then more and more. Article below is in dutch but it states that the police was able to de rypt one billion of the stored encrypted messages , could arrest 10000 persons world wide and were able to solve murders commited tens of years ago because the criminals were just talking about it because they thought they were secure.https://www.agconnect.nl/business/security/ruim-miljard-ontsleutelde-chatberichten-zijn-goudmijn-voor-politie

author: iMo
author_rank: Super Contributor
timestamp: June 12, 2024, 05:33:16 pm
content: I wonder where all that data get stored.. The storage manufacturers must be pretty happy about it..PS: there are many situations where it does not make much sense to decrypt some content as the info in it could be out of date, not useful/applicable anymore..

author: radiolistener
author_rank: Super Contributor
timestamp: June 27, 2024, 03:05:14 pm
content: Quote from: ejeffrey on June 03, 2024, 06:52:06 pmBut plain text presence allows to do brute-force in order to restore encryption key. It may take long time and many computational resources, but still much more easier than doing it without plain text

author: radiolistener
author_rank: Super Contributor
timestamp: June 27, 2024, 03:13:31 pm
content: Quote from: Kjelt on June 03, 2024, 08:45:20 pmthis is a naive delusion. There are too many examples of algorithms which were advertised as impossible to decipher and looked really strong from cryptographic point of view, saying it would take billions of years and all computers in the world. And then apparently you can find some tool which can restore key with just 60k samples using some cryptoanalysis tricks. And then after some time you can find tools that can do it with just 10-20k samples, and then just 1k or even 8.... With current computation resources this is almost on the fly.COMP128 A3A8is the most known example of that...

author: Kjelt
author_rank: Super Contributor
timestamp: June 27, 2024, 04:41:53 pm
content: Quote from: radiolistener on June 27, 2024, 03:13:31 pmThe reason why I stated "at this moment".If a security issue will be found in the future or computational power increases exponential, or a mature quantum computer is released, all things in the future.

author: Nominal Animal
author_rank: Super Contributor
timestamp: June 27, 2024, 05:31:33 pm
content: Key derivation also plays a significant role. Your passphrase provides most but not all information used to derive the actual key or initialization vector (depending on the cipher mode). It is usuallysalted, and often some kind ofnonceorcounteris included to ensure that even though the same passphrase is used, the actual key or initialization vector differs, reducing the usefulness of and risk in comparing different files or messages encrypted with the same passphrase to their corresponding plaintexts.Essentially, every encryption method we know is breakable, and the point is to make that as costly as possible: to take more CPU time than even the three-letter agencies have available.After all, if someone really, really wants the data, they can simply grab you and either bribe you, drug you up, or threaten you or your close ones to force you to decrypt the data. Governments are pretty ready to incarcerate you nowadays if you don't provide access; in particular, when entering a country you're not a citizen of. Sometimes steganography –– hiding data –– is more valuable than plain encryption...

author: JohanH
author_rank: Frequent Contributor
timestamp: June 27, 2024, 07:23:28 pm
content: Obligatory

author: golden_labels
author_rank: Super Contributor
timestamp: June 27, 2024, 09:09:59 pm
content: Rubber-hose cryptoanalysis doesn’t work against entire populations and is tamper-evident.Regarding quantum computing: don’t treat it as a magical item, that gives +20 to speed. It doesn’t work this way. In particular quantum computers can’t do multiple calculations in parallel; not in the sense of word “calculation” used in other contexts.A quantum system needs to be able to evolve in a way, that exploits particular properties of the problem in question. If the problem has no such properties known, a quantum computer is useless. Only a limited number of problems can benefit. Those are many important problems and there are many cryptographic primitives explotable with quantum computing. But it’s not like just any classical encryption is going to be broken. There is also a long route from the cryptography meaning of word “broken” to deciphering collected messages. It’s not that bad.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 27, 2024, 10:21:56 pm
content: Quote from: Nominal Animal on June 27, 2024, 05:31:33 pmYes. Well, strictly speaking, any "good" encryption scheme should not enable anyone to distringuish it from "random" data. At which point, no one can claim that you own encrypted data. You may as well just have a bunch of random or corrupted files, or some binary format that is proprietary and that no one has a clue what it is.

author: radiolistener
author_rank: Super Contributor
timestamp: June 28, 2024, 01:10:16 am
content: Quote from: Kjelt on June 27, 2024, 04:41:53 pmI suspect all cipher approved by NSA is already compromised just out of the box, otherwise they will not approve itAnd they already using special FPGA based hardware with incredible computational power and optimized to for specific cipher algorithms.The only thing that you can hope is that it is not available yet for a usual hackers, these toys for a big government mafia.

author: golden_labels
author_rank: Super Contributor
timestamp: June 28, 2024, 04:27:27 am
content: Quote from: SiliconWizard on June 27, 2024, 10:21:56 pmUnless you can be jailed indefinitely under the suspicion of possessing encrypted data and not revealing the key to it.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 28, 2024, 05:39:07 am
content: Quote from: golden_labels on June 28, 2024, 04:27:27 amWhich is impossible to prove. So that would be intimidation based on nothing tangible. That's actually a pretty interesting question.

author: ejeffrey
author_rank: Super Contributor
timestamp: June 28, 2024, 02:46:13 pm
content: Quote from: radiolistener on June 27, 2024, 03:05:14 pmIn practice it doesn't make a difference. It's essentially always easy enough to tell the real plaintext from an incorrect description. Usually there are predictable patterns in the first few bytes (message headers) but even if you have to brute for decrypt several blocks to check that's only ~10x harder. And 10x is just not that much, considering that increasing the key size from 192 to 256 is expected to make brute force billions of times harder. And if a significant weakness is found in the cipher that actually makes it feasible, then your 10x is mostly irrelevant anyway.

author: ejeffrey
author_rank: Super Contributor
timestamp: June 28, 2024, 03:02:55 pm
content: Quote from: SiliconWizard on June 27, 2024, 10:21:56 pmThat's true of the ciphertext itself, but rarely in context. Encrypted communication and storage almost always has metadata around it, either explicit or implicit to let the receiver know how to handle it. To be fair that's also true about traditional stenography, you need to communicate out of band how to extract the data. But the purpose of stenography is to give an appearance of normalcy sufficient to keep someone from bothering to look deeper.

author: golden_labels
author_rank: Super Contributor
timestamp: June 28, 2024, 03:35:25 pm
content: There is a third option, but very inefficient. Not using encryption at all: the secret is sent in plaintext, interleaved with its own inverse. Each bit receives its own authentication code, but only the right bits have valid codes. The recipient distinguishes the secret from its inverse by validating each bit separately. The adversary sees the secret, but can’t tell it apart from its own inverse.The technique was developed to circumvent cryptography export bans. Since PGP achieved the same in a better way and the method itself is a performance nightmare, it’s not usually deployed. But it remains in the portfolio of available options.

author: helius
author_rank: Super Contributor
timestamp: June 28, 2024, 04:24:03 pm
content: Recovering a key from data both encrypted and decrypted is called a "known plaintext attack". Generally cryptosystems are designed to resist this type of attack, although it may sometimes be considered as a lower priority than some other attacks.The reason that you want to resist known plaintext attacks is that there are some very common situations where the plaintext is known or predictable. If an attacker knows the format of the communications, much of the management information ("headers") are predictable. There are also situations (like with HTTP and HTTPS) where the same data can be sent encrypted or unencrypted. Being able to recover keys in these situations would make the cryptosystem worthless to protect secrets sent over the same channels.The weak encryption in PKZIP archives is an example of a system that is broken using known plaintext attacks. It is weak because by guessing a few bytes in the beginning of the plaintext, the cipher can be inverted to recover the key.

author: Nominal Animal
author_rank: Super Contributor
timestamp: June 28, 2024, 05:26:48 pm
content: Quote from: SiliconWizard on June 27, 2024, 10:21:56 pmI habitually use LVM2 whole-disk encryption. Simply the fact that when you boot up it asks for the passphrase, reveals its presence.Thus, "indistinguishable from noise" applies to the ciphertext only, not toencrypted datain general, and not to the associated metadata in particular.Using say a custom FUSE driver (userspace application) to convert some innocuous-looking files into a standard encrypted filesystemissteganography: you hide the metadata, while the ciphertext itself is in plain view.Quote from: radiolistener on June 28, 2024, 01:10:16 amThey did that with NIST SP800-90 / Dual_EC_DRBG, yes. (Which is a good reason why you shouldn't trust HW-RNGs, and only use them to add entropy to your cryptographically secure pseudo-random number generators.)However, most of the algorithms NSA approves are used by communication between the US government and contractors. Using anything backdoored for those would compromise security if the backdoor was revealed to antagonists. Becausehumansare involved, such secrets do get revealed, sooner or later.

author: golden_labels
author_rank: Super Contributor
timestamp: June 28, 2024, 09:20:49 pm
content: Even if humans wouldn’t fail, that’s a very poor choice. It’s like putting your own door on weak hinges and telling only a few trusted friends they can, in emergency, remove the door through that vulnerability. Makes sense until you realize one thing. Each day the door is hit with sledgehammers by thousands of very experienced and dedicated sledgehammer users, with a dozen states providing a never-ending supply of very best sledgehammers.You thought about putting a backdoor in encryption. And you aren’t particularly qualified in the field. Those much more experienced also thought about that. And they have all the knowledge needed to invent a thousand potential methods to weaken the algorithm. One of them is going the very same you used.Of course even such an obvious thing is not enough to stop people from trying! Contrary to what some imagine, governmential agencies aren’t filled with exceptionally bright people. Where they do happen, they aren’t the decisionmakers. So, over and over again, absurd decisions are made. But it shouldn’t be assumed this is the expected course of action.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 28, 2024, 10:50:10 pm
content: Quote from: ejeffrey on June 28, 2024, 03:02:55 pmYes, but that's entirely possible to avoid it by not using standard containers with metadata in clear.Just saying.If you don't want to give away that some data is encrypted, it's relatively easy, but not by using standard formats.And if there is no evidence there is usable data, that it is encrypted, and what kind of encryption it could be, then it becomes nearly impossible to make any use of it in any kind of reasonable time.Again, just saying.

author: radiolistener
author_rank: Super Contributor
timestamp: June 29, 2024, 01:48:51 am
content: Quote from: helius on June 28, 2024, 04:24:03 pmOld https uses crypto suites which can be easily hacked with 'man in the middle' attack. And they was used everywhere for a long time. Now many known web servers removed them from supported list (and this is the reason why you can't connect to it with old applications/OS which don't supports new crypto suites).So, I wouldn't look at https as an example of proper encryptionAnd even with a new strong crypto suites, I would not expect good security from https, because it's not so hard to detect application which is used to connect through TLS channel and do some activity analysis even without decryption. This is how smart firewall can detect and block some protocols even if you use HTTPS connection.

author: golden_labels
author_rank: Super Contributor
timestamp: June 29, 2024, 03:37:54 pm
content: This isn’t how things work. One can’t say something is broken, because a thing in the past was named the same way and it used a component — no longer in use — which was faulty.First of all, HTTPS is not encryption or any kind of a security scheme. Helius used HTTPSand HTTP(a pair!) to explain, how an adversary may know the encrypted plaintext without ever accessing it. Actual security of either plays no role there. They could use Caesar’s cipher and the example would work equally well.(1)Helius never touched the subject of HTTPS security, so I’m not sure, what you are referring to.Authentication and encryption is done with TLS. Where “TLS” stands for three separate families of protocols,(2)each of them with multiple versions. Weaknesses in one don’t transfer to the other. MitM-ing SSL 2.0 in the 90s isn’t telling much about security of TLS in 2024.In the second part you make a strawman: you choose some properties and then show how they are not provided. Sure they aren’t, because they were never the goals and aren’t among desired properties of this kind of a protocol. You know what else TLS can’t do? Be used as a lock in my door. Such a security failure! /sWhat’s next on the plate? Expecting absolutes?(1)Though Caesar’s cipher is so weak, such a big cannon would be a waste of time.(2)Yes, three. SSL3 is separate from SSL2.

author: Nominal Animal
author_rank: Super Contributor
timestamp: June 29, 2024, 04:45:46 pm
content: Quote from: SiliconWizard on June 28, 2024, 10:50:10 pmIsn't that exactly steganography for the metadata, though? It is to me.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 29, 2024, 10:03:20 pm
content: Quote from: Nominal Animal on June 29, 2024, 04:45:46 pmYes, I think you can call it that.

author: Infraviolet
author_rank: Super Contributor
timestamp: July 03, 2024, 07:17:49 pm
content: "weak encryption in PKZIP archives is an example"I'm guesing that doesn't apply to the more modern 7z archive format though? That is a weakness in the algorithm pkzip used? Not a natural weakness in all and any form of compressed file format which would still apply at the implementation level even where a stronger (like the default aes256 in 7zip) algorithm was used?

author: Infraviolet
author_rank: Super Contributor
timestamp: July 03, 2024, 07:32:42 pm
content: "Using anything backdoored for those would compromise security if the backdoor was revealed to antagonists"We have to remember, politicians, governments, civil servants... have an absolute belief in their own infallibility. They genuinely believe that if they demand the creation of a backdoor that only they can access, then nobody else will ever be able to access it, despite the many examples to the contrary. "we'll do it right this time" they think "all those who tried before just weren't doing it properly". Governments afterall have shown that they think they can defeat an extremely contagious virus by destroying democracy and the economy, despite no virus ever having been stopped before except when natural herd immunity was eventually reached (vaccines being something that helped eradicate the worst nasties after they'd already become stable and endemic). They are now insisting that we can abandon fossil fuels in under a decade, and can do it without nuclear power. They believe if they mandate that nobody may ever say anything offensive, then nobody ever will. They believe increasing tax rates always leads to more tax being collected... Governments, and the type of people attracted to jobs near the top of them, really cannot imagine that they could ever make mistakes. I wouldn't put it past them to do something as stupid as place backdoors in their own systems.

author: radiolistener
author_rank: Super Contributor
timestamp: August 25, 2024, 02:34:40 pm
content: Quote from: Kjelt on June 03, 2024, 08:45:20 pmI think this is just rumors. 3 letters services have access to a special acceleration hardware which allows to do brute force at incredible speed and they have exploits for popular cipher algorithms which allows to significantly reduce computation cost. So, in most cases they can crack popular cipher in a pretty short time. If they certified some cipher, then they have exploit for it or computation power to crack it within short time period. If it don't works there is no sense to store a lot of garbage data.Quote from: golden_labels on June 29, 2024, 03:37:54 pmTLS is abbreviation for Transport Layer Security. This is just protocol envelope which provide standard approach to use encrypted channel. It can use different cipher suites with different cipher altorithms and different key exchange algorithm.TLS itself doesn't guarantee that it will use good cipher suite, it depends on client and server implementation and configuration. And it may confuse user, because he may think that he using channel with strong cipher, but actually it may use weak and vulnerable cipher suite.Also TLS has serious security issue, because it allows to see a lot of data about connection which is sent unencrypted at handshake. For example, it sends host name. Also it allows to detect client and server applications which by their handshake fingerprint. All this is major security issue, even if you use custom made cipher suite with a strong cipher and key exchange algorithms.I suspect these TLS vulnerabilities were implemented deliberately to make traffic analysis more easier for 3-letter agencies. I understand that weak TLS security also has some pros, for example it allows to detect and trace malicious traffic from internet worms despite the fact that its encrypted. But at the same time it makes secure channels vulnerable and this is a major con.So, saying that TLS is secure and its vulnerabilities is good because allows to analyze malicious traffic is the same as saying that HTTP is secure, because it allows to read private conversations and passwords in a plain form

author: dietert1
author_rank: Super Contributor
timestamp: August 25, 2024, 05:17:22 pm
content: Yes, not an expert here but i already suspected the standards inside TLS could only become standards after the three letter agencies knew how to deal with them efficiently. When implementing security for internet things one may have to use something different.Other news of today: Telegram CEO Pavel Durov detained at airport in France. Don't know what ciphers Telegram is using.

author: golden_labels
author_rank: Super Contributor
timestamp: August 26, 2024, 07:06:26 am
content: Quote from: radiolistener on August 25, 2024, 02:34:40 pmDo you also happen to “know” about extraterrestrial civilizations helping them? Or maybe gained access to “state secrets” indicating replacing all the scientific world with radio-controlled clones to hide “real knowledge”? This can’t be rejected, if I read that somebody can break known physics and maths, and even plausible hypothetical future physics.Quote from: radiolistener on August 25, 2024, 02:34:40 pmTLS allows the use ofdifferent(meaning: multiple) cipher suites, but it doesn’t allow the use ofanycipher suites. And the primary changes between TLS versions are in the set of permitted cryptographic features, including ciphers.Quote from: radiolistener on August 25, 2024, 02:34:40 pmTLS prohibits such cipher suites.Quote from: radiolistener on August 25, 2024, 02:34:40 pmThis is RFC 3546 (§3.1), not core TLS. TLS itself doesn’t even have provisions for doing so, much less requires it, and one can use TLS without this “terrifying vulnerability.”The “horrible privacy leak” is of minor relevance, because this is routing information. The same kind of information that is held in IP headers. This is why it isn’t encrypted: one can’t hide name and apartment number on an envelope, if a postman is expected to deliver a letter.The need for using SNI arises from a single IP address hosting more than a single domain name. The alternative is having one IP address per domain name. Which would reveal exacty the same information in the IP header, making SNI no worse than the alternative without it.The entire issue is mostly of interest to historians too, given that now TLS supports encrypted hello and it’s deployed in all major browsers.Quote from: dietert1 on August 25, 2024, 05:17:22 pmSo, do you find your way of thinking reasonable? It seems to boil down to: “I’m not an expert, but I’ll ignore what experts say, because they must be on government payroll, since what they say disagrees with what I think”.Quote from: dietert1 on August 25, 2024, 05:17:22 pmWhich is only tangentially related to encryption.Quote from: dietert1 on August 25, 2024, 05:17:22 pmUsually none. Most of Telegram communication is unencrypted and, despite advertising itself for “private chats”, the company designed UI in a manner that makes enabling chat encryption inconvenient. That’s the point of criticism for almost a decade now and Telegram continuously refuses to fix that issue or make encryption default. If you enable encryption, they still roll out their own crypto and they retain full control over the endpoint. The solution is properly named “MProto”, but it’s not recognized or known elsewhere, so it may as well be called “the Telegram thing”.

author: radiolistener
author_rank: Super Contributor
timestamp: August 26, 2024, 12:21:32 pm
content: Quote from: golden_labels on August 26, 2024, 07:06:26 amI don't know if there is some "extraterrestrial civilizations helping them". But I don't see the reason to involve "extraterrestrial civilizations" to explain it.This is not a secret information that almost any cipher algorithm has some vulnerabilities which allows to make exploits to significantly reduce cipher crack computation cost. You can find examples of software which uses these exploits in practice.The most impressive example is COMP128. When it was invented, it gave the impression of being practically unhackable due to billion years for brute force. But in 1990 hackers released software which was able to hack it with just 30-40k attempts and later it was reduced to about 8k or even less.And this is not a secret information that you can use special hardware to significantly increase brute force speed. The simplest publicly available example isJohn the Ripper jumbowhich can utilize power of specialized hardware like GPU or FPGA. And this is not a secret that such specialized hardware is designed and used by these services.Therefore, I don't see any reason to introduce some entities like aliens to implement these tasks.I can advise you to use Occam's razor principle in order to avoid involving useless entities to explain the essence of things.Quote from: golden_labels on August 26, 2024, 07:06:26 amI don't see the reason why you cannot implement your own cipher suite with any cipher and use it for your own need with TLS. TLS doesn't limit you. The only issue here is that third party client/server which don't implement your cipher suite will be unable to communicate with your client/server. But your client and your server can successfully use your custom cipher suite. And you can use existing TLS channel infrastructure to establish communication using your custom cipher suite.I implemented custom TLS stack for existing cipher suites like TLS_CHACHA20_POLY1305_SHA256, and I don't see the reason why I can't do the same for my own cipher.And by the way I suspect that high popularity of TLS_CHACHA20_POLY1305_SHA256 is because someone trying to reduce cost for message scanning. Because CHACHA20 don't looks like good replacement for AES256. So it's very suspicious that it become so popular...Quote from: golden_labels on August 26, 2024, 07:06:26 amTLS don't prohibits it. Your client/server configuration may be configured to prohibit it, but it doesn't means that any client/server is configured to prohibit it.Quote from: golden_labels on August 26, 2024, 07:06:26 amI well understand why it is implemented in that way and how you can explain the requirement to send part of information unencrypted. But this is a big security hole from my opinion. I think the only reason to keep it unencrypted is to allow 3-letter agencies to use cheap devices to scan it, but this is definitely not about security. And I think it will be fixed soon, because now we can see that it become obvious how dangerous this way for security.

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 26, 2024, 08:22:57 pm
content: That's a bit of a tangent from the original topic, but surely full, almost-impossible-to-crack encryption and surveillance do not mix very well. This is a major concern actually, because as long as we, as a society, claim that surveillance is necessary to ensure the security of people/countries, then the security of data cannot be guaranteed. If we consider that for some authorities not being able to access some data is a threat for national security, then allowed encryption can only be a toy that will be "good enough" as long as "most people" don't have access to the tools and equipment necessary to access encrypted data. But that's also why "quantum computing" is currently seen as the next big thing.

author: helius
author_rank: Super Contributor
timestamp: August 27, 2024, 01:02:05 am
content: The threat from quantum computers is basically to RSA, DSA, and Elgamal, because there are quantum algorithms for factorization and discrete logarithms (Shor 1994).Quantum computers can't help to solve symmetric algorithms like AES; at best, they might gain a constant factor, but that is squared against the advantages classical computers have in speed and cost.Even the application of quantum computing to RSA is speculative. To recover a 512-bit RSA private key, it would take a 2564-qubit machine around a billion operations without decohering. You can look at papers from the field to see how close they can get to that in the public research. These days, a 512-bit RSA key is considered very weak, and 2048-bit keys are common.What nation-state actors have is a budget. With a budget, you can build or buy a lot of computing power for brute-force cryptanalysis: many hands make small work. A 256-bit AES key seems formidable if you're trying to crack it with a single CPU, but this is one of those "embarassingly parallel" problems. What if you instead put a million CPUs on the problem? A billion? A trillion?

author: dietert1
author_rank: Super Contributor
timestamp: August 27, 2024, 07:37:15 am
content: If modern hardware (like huge NVIDIA chips) relates to Turings machine like modern ciphers relate to Enigma, then you can estimate how safe modern ciphers are. Though it may require another Turing to actually do it. Don't know how well AI performs on these riddles. There you may have your "extraterrestrial".

author: iMo
author_rank: Super Contributor
timestamp: August 27, 2024, 08:27:22 am
content: Quote from: golden_labels on August 26, 2024, 07:06:26 amInterestingly all the "well informed" bloggers on all sides of the barricades shout today the Telegram is the main communication channel of the Kremlins gov, military, TLA services and their spies abroad. How such an inconvenient tool could be used by all those folk then?

author: radiolistener
author_rank: Super Contributor
timestamp: August 27, 2024, 12:06:55 pm
content: Quote from: helius on August 27, 2024, 01:02:05 amUsing CPU is not a good choice for that task. Professional equipment for such tasks is based on a specialized machines which contains a lot of very powerful FPGA. You can imagine it as a large array of very powerful GPU which is highly customizable for specific algorithms optimizations. It's a kind of very powerful and flexible cryptographic accelerator. Such machines are very expensive and its price can exceed a million dollars, but just one such machine can replace a huge datacenter with usual computing servers. For a personal use it's too expensive, but special agencies can spend a lot of money to buy a bunch of such machines and its power allows to get impressive speed to brute-force cipher algorithm...

author: golden_labels
author_rank: Super Contributor
timestamp: August 27, 2024, 03:44:04 pm
content: Quote from: helius on August 27, 2024, 01:02:05 amNothing happens. At this scale there is no difference between one and a trillion.The number is gargantuan. It’s so enormous, that not only the number is incomprehensible, but its incomprehensibility is almost impossible to comprehend.It’s not possible to brute-force a 256-bit key in symmetric crypto. Period. The limit is set by the lower bound of energy requirements for merely iterating over the keys. This is a physical limit, not technological or organizational one, and it doesn’t cover energy needed for actual calculations. For 128-bit keys the limit is low enough to make it hypothetically not impossible, but not even sci-fi offers realms where this may be done.Quote from: iMo on August 27, 2024, 08:27:22 amHow does inconvenience prevent usage? Or how does it relate to anything I said, other than incorporating a few words I also used?

author: radiolistener
author_rank: Super Contributor
timestamp: August 27, 2024, 06:21:10 pm
content: Quote from: golden_labels on August 27, 2024, 03:44:04 pmThis is true if you use stupid straight in the forehead attack (for example stupid straight brute-force on a usual PC).But if you use exploits and optimizations for specific cipher algorithm, which utilize it's vulnerabilities, it allows to significantly decrease computation cost. And then 1000000000x acceleration with specialized hardware starts to play significant role, because allows to do attack almost in realtime...Just smart approach and gargantuan turns into several seconds...

author: Stray Electron
author_rank: Super Contributor
timestamp: August 27, 2024, 07:02:39 pm
content: Quote from: Bud on June 11, 2024, 08:04:36 pmNo, it's not speculation. You can go on the NSA's website and read copies of the Vernona intercepts that were only decrypted much later and the real names and the code names of Soviet agents in the US and Britain that were identified by those decrypted messages. And by Soviet agents I don't just mean just Russians but the names of US, British (and other nationalities) citizens who willingly supplied them with information.Start reading and then follow some of the linkshttps://en.wikipedia.org/wiki/Venona_projectThe NSA's webpage on the subjecthttps://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Venona/

author: Infraviolet
author_rank: Super Contributor
timestamp: August 30, 2024, 07:10:18 pm
content: "Don't know what ciphers Telegram is using."He fell in to the "roll your own crypto" trap, or rather he had his brother write the crypto algorithms. There's been a lot of cryptographers warning his encryption has vulnerabilities which the protocols underlying Signal are not vulnerable to. That said, while his crypto might not be up to scratch, his philosophy is really quite excellent. There's an interview clip of him here:https://x.com/TuckerCarlson/status/1827460234887008277(rather long) in which he discusses his attitude, I really like the way he opposes censorship and surveillance and criticises bureaucratic overload and HR departments, just a pity the practicalities of his crypto don't quite live up to his noble goals. He's been making a point that he's as happy for any opposition group (in any country) to use his services as he is for any pro-government (any country again) groups, strict neutrality, that's a rare and honourable thing. I saw some reports saying the opposition in Belarus (where the dictator is a mate of Putin's) are very happy with Telegram, as are the opposition in Russia, unless something very major has changed suddenly then Durov is more a foe to Putin than a friend, if Putin's goons are making use of Telegram then the only reason Durov lets them is his strong neutral stance. Durov's right where the French regime are wrong, lets hope he can get out, by legal or any other means, from the sticky situation those censorious creeps have put him in. I say all this as someone impressed by his interview, not as a fan of Telegram, I don't use a smartphone so both Telegram, and Signal, are pretty useless to me."What if you instead put a million CPUs on the problem? A billion? A trillion?"The largest supercomputer documented as existing is called Frontier and has half a million CPU cores, others on that scale could exist in three letter agencies' basements, but I don't see any way they could plausibly be in possession of things 1000 times the "size" of that without very major distortions being visible in CPU production, supply and demand. So one is probably looking at a worst case, in the abscence of quantum computers, of cracking at a rate several million, or even tens of millions, times faster than high performance ordinary computers? The real risk is surely quantum computing, an advance in anticipation of which it makes sense for totalitarians to seek to store all the data they can posibly get (storage is cheap, especially if they're willing to take a risk of losing some random fraction of that data, as they know only a small fraction of it is stuff they desperately want to know, and decide not to have highly redundant backup copies) now, so they can decrypt later if a powerful enough quantum computer can be built. If I remember rightly, Snowden's leaks included some notes of the scale of storage facilities the NSA was building at the time?

author: radiolistener
author_rank: Super Contributor
timestamp: August 30, 2024, 08:05:35 pm
content: Quote from: Infraviolet on August 30, 2024, 07:10:18 pmusing CPU is very-very inefficient way for such task. Much more cheap and faster way is to use large array of high performance FPGA.Less efficient, but also high performance way is to use a farm with many top-end GPU accelerators. The same as used for crypto-mining.Usual CPU is very bad choice for this task, due to low performance, low scalable parallelism, and high power consumption. Usual CPU is more suitable for a regular software than for cryptography acceleration.As for telegarm, I think this is just yet another project for mass consumption and Durov is probably just a talking head representing a project that is actually run by a hidden organization that lay in the shadows. The same as Tesla, SpaceX, Instagram, Facebook and many other projects...At least if I were creating a similar project, I would not become a public leader, but would hire some actor for these purposes and would organize similar performances to attract new users. This is obvious way to control such kind of business...So it would be naive to believe that such projects can provide any kind of confidentiality. All these scandals resemble a theatrical performance for the public with the aim of making the public believe in the ideas of the project.But credit should be given to the Telegram. It has become a major modern mass media platform. However, this is more due to the fact that traditional mass media have turned into breeding grounds of trash-propaganda for idiots, which somewhat reminiscent the pictures from the movie'Idiocracy'. I sometimes get the impression that the scenarios unfolding now are based on the ideas from that movie.

author: dietert1
author_rank: Super Contributor
timestamp: August 30, 2024, 11:12:47 pm
content: As far as i remember from the movie, they did not crack Enigma by brute force, but because they had some encrypted files and partially unencypted copy together (a constant header). That certainly weakens a given cipher. Certainly when using TLS ciphers for https something similar could be used.

author: iMo
author_rank: Super Contributor
timestamp: September 02, 2024, 12:08:58 pm
content: In this FT article they talk about the Durov team (incl. the indication of the salaries of his 30 core people), etc.. Interesting when true..https://www.ft.com/content/429f9092-5447-4e4c-b3b6-ffa2bc357ca4Quote from: radiolistener on August 30, 2024, 08:05:35 pm

author: Kjelt
author_rank: Super Contributor
timestamp: September 02, 2024, 01:23:19 pm
content: Quote from: iMo on September 02, 2024, 12:08:58 pmPaywall perhaps give a summary or it is useless

author: iMo
author_rank: Super Contributor
timestamp: September 02, 2024, 03:50:28 pm
content: I can read it fine incl. comments no paywalling here so far..

author: peter-h
author_rank: Super Contributor
timestamp: November 10, 2024, 01:07:06 pm
content: Always fun to read threads on comms securityQuoteVenona is an unbreakable OTP which was cracked because the Russian OTP printing shop was unable to cope with the demand, due to the sheer number of spies they were running in the WestSo they duplicated some print runs, and a smart cryptographer spotted the resulting matching patterns. It was a valuable programme and it ran until about 1980, but which time any remaining agents (and other relevant factors) would have been out of action. That was decrypting traffic whose vulnerability ended about 1944! (Philby blew the break to the Russians c. 1944).QuoteEven today, Enigma is very hard to crack by brute force. At a primitive level, the key size is (IIRC) of the order of 100 bits. And there were many versions of "Enigma", with the naval version using 2-letter lookup tables to break the obvious weaknesses which enabled the early breaks. But it can be done, with specific approaches, with a lot of computer power and a lot of time. With a dedicated box, say 1M FPGAs, it would be much faster but nobody would bother building such a box now.QuoteTG stores the stuff in plaintext on its servers. That is actually a very handy thing because you get multiple devices syncing perfectly and in real time. Unlike say Whatsapp which sends everything via the one phone and has stupid limits on how many other devices it can be installed on. 99.9% of people with a brain will assume the NSA and probably the FSB can read it all but they don't care because who cares about the FSB knowing you are going to the village cross-stitching competitionThe bottom line is that in some 99.9% of applications, nobody will have the opportunity to collect the ciphertext anyway. And in nearly all embedded contexts, there is negligible security around the hardware, and without physical security you have no security at all. And if a State agency is decrypting AES256 (we must assume the NSA can do this) they won't be advertising it by using the crack to put away some bank robbersAnd finally some 99.9% of data is completely worthless to an attackerLots of civil liberties people get excited about GDPR for example. As anybody running a forum will know, you get a steady stream of people who threw their toys out of the pram and demand the deletion of their forum posts. GDPR actually explicitly protects forum posts... only the person's profile info can be demanded to be deleted. Then they moan about google analytics (resulting in the stupid cookie consent popups) when their GSM phone location is logged, essentially for ever, every 10 mins, both google and apple log the GPS position much faster than that (which is how google maps knows where the traffic jams are). And nearly all data breaches involve no crypto at all.In the 1980s, Zilog and AMD made a DES chip (they were supposedly 2nd sourcing each other but many 2nd sources were actually fake, and were just different markings). I was told by a Zilog rep back then that the NSA placed a huge order for these chips. To be expected I am sure... That was 40 years ago. But 25 years ago it was easy to unroll the whole DES algorithm (eliminating the loops) and pop it into a Xilinx XC3090 FPGA, with a propagation time of ~100ns, so testing 10M keys per second. Now buy say 100k of these FPGAs, and you have a near real time known-plaintext cracking capability. Around 1992 I was making some DES line encryptors (banking customers) and you could sell (and export) them freely if it used plain DES, even if you used RSA to change the key every minute. Go figure...

author: Nominal Animal
author_rank: Super Contributor
timestamp: November 11, 2024, 05:50:20 am
content: Quote from: peter-h on November 10, 2024, 01:07:06 pmThis.I've finally ordered some ATECC608B chips for experimenting with, for storing encryption keys and offloading certificate validation. While the chips are at least resistant to physical attacks, anyone can desolder the chip and solder a new one (or implement similar attacks, depending on the exact PCB layout, that may not even be visible under normal scrutiny), bypassing such security altogether. The same applies to any device, at all scales. Nothing is unfakeable.Quote from: peter-h on November 10, 2024, 01:07:06 pmMost often seems to be keys inadvertently leaked; occasionally a failure in key verification, or in key generation.But also, obligatory XKCD:and