Can encryption still be safe?
Security
by Ben Sullivan| 09 September 2013
Two sides have emerged from the NSA/GCHQ encryption hacking story. One that is convinced we are in an Orwellian-inducing end of times and we should all just stop using the Internet now, and one which says that this has obviously been happening all along, and now's a good time, more than there ever has been, for companies to improve their security and boast what would surely be great-selling software: NSA-proof encryption.
On the latter side, security experts are touting what Snowden has said all along:
"Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on.""Actually, I see Snowden's encryption revelations as a positive for the crypto community because it gives experts an opportunity to address some misconceptions surrounding the technology. Chiefly, there's a big difference between asymmetric and symmetric encryption," says Paige Leidig, SVP at CipherCloud.
"Most of the Internet is based on asymmetric RSA encryption which is public key cryptography that requires two separate keys one of which is secret (or private) and one of which is public, but both are mathematically linked. Public key is for encrypting the data and the private key is for decrypting the data. Most of Internet encryption e.g. HTTPS and email, are based on asymmetric encryption.
"On the other hand, symmetric encryption is based on single key which is useful when you want to keep information within a single system and not sharing with external parties e.g. Storage, Backup, and Databases. Advanced Encryption Standard (AES) is the most advanced symmetric encryption."
But what about the NSA's tailored access programs? These attacks have a number of exploits that can be used against your computer - whether you're running Windows, Mac OS, Linux, iOS, or something else - and a variety of tricks to get them on to your device. Your anti-virus software won't detect them, even if you knew where to look, it'd be a tough job to find them.
What Leidig says about symmetric encryption, though, is that any surveillance would have to go through the customer first since they retain the key. Yes, they'll be forced to turn it over, but at least the customer is then aware of any such access. So could we be looking at a boom for companies flaunting symmetric encryption storage?
The sentiment of a business opportunity is also echoed in other comments.
Naeem Zafar, chief executive at mobile security startup, Bitzer Mobile, says a ripple effect may be about to spur innovation.
"This is a wake up call that old security and encryption standards are outdated," says Zafar. "We need a new encryption standard. We can no longer sit on our laurels . Security is a changing game and we must come up with new strategies. The ball is in the entrepreneur's court."
Chris Petersen, chief technology officer at security analytics company LogRhythm, says: "What this will really do is put our adversaries on notice that they need to invest in stronger encryption."
Security technologist Bruce Schneier commented in the Guardian that "the NSA has turned the fabric of the internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible."
If symmetric encryption is used, NSA has to turn from mass traffic surveillance to these tailored attacks, which cost money and time.
One problem with using this software though, is that how do you know it hasn't already been compromised by the NSA. It's pretty obvious that most encryption products from large US companies have NSA-friendly back doors, and many international ones probably do as well. How do we separate them from the ones who haven't associated with NSA/GCHQ? Furthermore, traget-rich environments are being created by users who want their data securlely encrypted. I presume these areas would be targeted first and foremost by the government for monitoring suspicious activity.
However, other security experts are claiming that we really have nothing to worry about, and that it's better for governments to be able to spy on data, as there's far worse people out there with actual malicious intent.
"The people who work on PRISM are working to protect us," says Tom Kellermann, Trend Micro's vice president of cybersecurity.
"They don't care what movie you're going to or whether someone is cheating on his wife."
Phil Lieberman, president of security firm Lieberman Software says: "I wish the NSA had a monopoly on these techniques. Consumers should be more worried about the criminals of the world who have similar capabilities. The criminals are certainly not using these capabilities in a narrow way, and they're not going through any approval process."
Pravin Kothari, chief executive at encryption company CipherCloud, agrees:
"The average consumer has more to lose from malicious hackers and spammers out to score a quick buck than from government technologists," says Kothari. "The government is focused on hunting down would-be terrorists and criminals who are intending to disrupt the general welfare."
But are they missing the point? Surely it would be better to have nobody having access to your data, data that was promised to be private by companies that we all had trust in.
Bruce Schneier, writing on the Guardian, gives us five points of advice:
"1) Hide in the network. Implement hidden services. Use Tor to anonymize yourself. Yes, the NSA targets Tor users, but it's work for them. The less obvious you are, the safer you are.
2) Encrypt your communications. Use TLS. Use IPsec. Again, while it's true that the NSA targets encrypted connections - and it may have explicit exploits against these protocols - you're much better protected than if you communicate in the clear.
3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA - so it probably isn't. If you have something really important, use an air gap. Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good.
4) Be suspicious of commercial encryption software, especially from large vendors. My guess is that most encryption products from large US companies have NSA-friendly back doors, and many foreign ones probably do as well. It's prudent to assume that foreign products also have foreign-installed backdoors. Closed-source software is easier for the NSA to backdoor than open-source software. Systems relying on master secrets are vulnerable to the NSA, through either legal or more clandestine means.
5) Try to use public-domain encryption that has to be compatible with other implementations. For example, it's harder for the NSA to backdoor TLS than BitLocker, because any vendor's TLS has to be compatible with every other vendor's TLS, while BitLocker only has to be compatible with itself, giving the NSA a lot more freedom to make changes. And because BitLocker is proprietary, it's far less likely those changes will be discovered. Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can."
Schneier concludes by saying:
"Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it. That's how you can remain secure even in the face of the NSA."
http://www.cbronline.com/news/security/can-encryption-still-be-safe?goback=%2Egde_38412_member_272957563#%21
No comments:
Post a Comment