410
Mathematician warns NSA may be weakening next-gen encryption
(www.newscientist.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 19 Oct 2023
410 points (97.2% liked)
Technology
59559 readers
1873 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
There is no such thing as unbreakable encryption. If you want to hide a message, hide it at the source with the way you phrase things. I still have to buy weed illegally, and I use Signal, but I don't tell the person I buy it from, "hey, I want a half-ounce of weed and I'll pick it up on Friday at 2 pm," I say something like, "hey, are you free this weekend?" And then they'll say something like, "yeah, do you want to get your usual thing?" and then we'll arrange a time.
And yes, I see the irony about talking about buying weed illegally when someone could potentially find out who I am on Lemmy.
...there very much is practically unbreakable encryption. We use those every day (it's part of the s in https).
And your example is just a very rudimentary form of encryption that is far far weaker than the typical encryption methods used on the internet today.
It's unbreakable until it isn't.
I think you vastly underestimate modern encryption. I would recommend looking up concepts and math from encryption, it makes more sense for why thinking that practically unbreakable encryption is very much possible once you do.
It's why governments want to implement back-doors, because they are not actually capable of breaking it more directly.
Did you not read the article? It has nothing to do with backdoors.
....it's literally about accusing NSA of trying to implement back-doors for quantum resistant encryption.
I have no idea what you're trying to get at.
NIST is giving incorrect information. That will not enable back doors. And it is only a matter of time before that doesn't matter. I have no idea why you think there is such a thing as an unbreakable code that is not a one-time use code.
Edit: ACCUSED of giving incorrect information.
I have no idea why you think there isn't. Maybe you're going off a strange definition of "unbreakable". When it's used in cryptography, it means "unbreakable in reasonable time limits" (e.g. millions of years).
The thing about good encryption is that it's not just hard to break, it's mathematically too hard to break even if your available computing power keeps rising exponentially. Unless there is a mistake in the algorithm, it is for all intents and purposes, unbreakable.
There are theoretical limits to the speed of computation. One limit is the minimum amount of energy it takes to flip a bit. For 256-bit encryption, you have to start saying things like "assume we can convert 100% of the energy from a supernova into a theoretically perfect computer with perfect efficiency". This is a round about way of saying "impossible".
We've been hammering AES and RSA for decades now, and we haven't been able to get significantly better than brute force against either one. Quantum computers will break RSA (if they can be made with enough qbits, but might be infeasible), but worst case scenario for AES is that we double the key length and we're good again.
As my grandfather was wont to say, locks are for honest people.
Most forms of security are theater and used as a deterrent.
If your door is locked, and your neighbors isn't, well your lock deterred them.
Then again, if someone means you in particular harm, they'll get in, bricks are cheap and most home windows are focused on limiting thermal transfer, not being overly durable (say under an attack). It may not be quiet, you may be able to defend yourself or run or whatever, but the lock was not a deterrent.
So yes, lock your doors, encrypt everything you can, keep devices updated, etc. But it won't stop a determined bad actor if they have reasonable capabilities to do you harm.
The problem with security, especially cyber security, is that you have to find a medium between secure and usable. Most companies, in my experience, tend to loosen security in the name of usability.
I'm not an expert, but I'm studying in that direction with my limited free time (and more to the point, energy and mental health)
True, and a good social engineering hack will get you wonders quite often.
I hate the term social engineering. The only reason that social engineering is an issue is because security has gotten so good, that now people are the low hanging fruit.
Defi crypto users didn't like that.
True encryption does exist, it's just that the encryption key is equally as long as the message itself which shows how impractical it is: if you have a method secure enough to send an encryption key of length X, why not just send the actual message of length X?
That's interesting. I've never heard that before. Do you have more information I can read about somewhere?
https://en.m.wikipedia.org/wiki/One-time_pad
Is that what they're talking about?
Yes
But one-time pads aren't impractical like they said?
One-time pads are impractical because the sender and the target need to meet up beforehand and agree on a code, and no one else should know this code. With modern encryption, this is not necessary. The target can come up with both the encryption and decryption algorithms, and send only the first to the sender publicly.