Russian spies claim they can now collect crypto keys–but don’t say how | Hacker News Reader

Russian spies claim they can now collect crypto keys–but don’t say how

arstechnica.com

> Russia's intelligence agency the FSB, successor to the KGB, has posted a notice on its website claiming that it now has the ability to collect crypto keys for Internet services that use encryption. This meets a two-week deadline given by Vladimir Putin to the FSB to develop such a capability. However, no details have been provided of how the FSB is able to do this.

This definitely sounds like one of those "Tell the boss it's done, and hope he doesn't ask for it too soon" type of situation.

The xkcd solution should work : https://xkcd.com/538/

I'm surprised that the FSB was actually called upon, Russian SIGINT efforts are directed by the GRU, they inherited the KGB's SIGINT network and personnel, and they are the one heading Russia's terrestrial and space based SIGINT operations and platforms. The FSB is more akin to the FBI+ICE+ATF, MI5 or the Israeli Internal Security Service (Shin-Bet) they are responsible for state and internal security, not intelligence collection on this scale, also so far all the high confidence attributed Russian cyber operations were also attributed to the GRU not the FSB.

Secondary hypothesis: Putin is ex-KGB, he's probably got closer contacts in the FSB than the GRU; easy to tell them to say "yes" to whatever deadline he gives them. Looks good all around.

Putin main KGB career was in the 1st Directorate (Foreign Intelligence Service) in which he served as an FIO, which turned into the SVR when the Russian Federation was established, the SVR and GRU are 2 sides of the same coin. He later did serve as the director of the FSB for a very short period but he's best known for reforming the organization which resulted in major "layoffs" (and being laid off in the intelligence world, especially in pseudo authoritarian regimes rarely ends well), but again this is an odd case, but as some others have mentioned it seems to be a legal framework to compel companies (or individuals) to hand off their keys rather than some technical solution.

The FSB's announcement doesn't speak of any new technical capability, it just says that they formalized the legal procedure by which everyone should share their crypto keys with the government.

Source: I'm a Russian.

Just curious, any company operating in Russia have to comply or only companies hosted in Russia ? Basically, does Facebook have to comply ?

Yes. Any social network, instant messenger or anything else which uses crypto will have to share keys so that government can decrypt "anything they like".

So, Facebook will either comply, or it'll have to pay the fine (800k-1m rubles ≈ $15000), or it will be banned.

The law also prescribes for all "organizers of information distribution" to store the voice call recordings for 6 months and to store metadata for 3 years. Nobody is sure what "organizers of information distribution" means, but at the very least it includes all phone calls and instant messages.

Yes, it's crazy.

>Yes, it's crazy.

I agree. There is an english idiom, "Don't put all your eggs in one basket." I assume this includes government keys as well. This seems like a juicy target for hackers. The damage it could do to Russia is almost unimaginable.

There's also a Russian saying, "The strictness of Russian laws is balanced out by the fact that they don't have to be enforced".

Precedent: a new Personal Data Protection Law was passed two years ago. It included the crazy clause that all personal data of Russian citizens must be stored and processed on servers located in Russia. Facebook didn't comply, and I'm sure many other websites didn't comply too, but nobody cares, AFAICT.

On the other hand, our government can decide at any moment that they don't like some website, person or other entity, and they'll quickly find a way to get rid of this entity without breaking the law.

>Yes, it's crazy.

Seems to me if you vote in Putin and applaud his oppressive autocratic government, then you'll get stuff like this. Not sure what the long-range plan here, but total autocratic control by the executive branch with zero oversight is clearly on the immediate roadmap.

This is further evidence that the west needs to disengage economically from Russia as much as possible. Facebook would be selling Russians to the FSB torture squads. There are real human rights concerns here that Western companies should not be part of. I can't imagine all these EU human rights laws allowing this. It'll be interesting how this all unfolds, but if Russians think this shit will get them out of a recession, then I think they will be sorely surprised. There will be a further divestment from Russian markets from the West and probably more sanctions, or at least, the political will to lift existing sanctions will be lower than ever.

Not too long ago people were talking about a reformed Russia who would be an EU partner, if not a member. Instead, Russians are proudly going back to the Stalin days and giving Putin's regime a 90% approval rating. Now that's crazy.

It's comforting that it's not a new technical capability.

On the other hand, if anyone does have that technical capability, I'm pretty sure they're not going to announce it on a web site...

This will certain make the NSA's job easier when spying on Russia. Instead of having to break into all these services and steal the keys NSA will only have to break into the FSB DB.

Given that:

(1). NSA's primary target when it was founded was USSR/Russia,

(2). and NSA has been targeting FSB/KGB since 1952,

it seems likely that FSB is pretty well compromised at both the human and technological level. The same might not be true of some Russian social network startup.

NSA will probably still have to break into the services every so often since failure to do so will signal they are reading the FSB DB.

https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

Is this just the 526-FZ law from last year?

http://www.hldataprotection.com/2015/01/articles/internation...

Or is this something else?

Certification is only for messengers, which care state secrets:

http://www.fsb.ru/fsb/science/single.htm%21id%3D10437738%40f...

Is it just me or does Putin also have tiny hands?

Reply on news.ycombinator.com