https://arstechnica.com/information-technology/2012/06/flame...
Sounds like "super-secret cryptanalysis" to me. That was 2012 and Schneier was writing in 2014. I wonder what would qualify as magic to him?
Sounds like "super-secret cryptanalysis" to me. That was 2012 and Schneier was writing in 2014. I wonder what would qualify as magic to him?
> The first cryptographic collision attack against the cryptographic hash function MD5 was invented by Xiaoyun Wang et al. in 2004, which however did not pose a serious immediate threat due to technical limitations. Subsequently, we have devised a more flexible collision attack against MD5 in 2007, a so-called chosen-prefix collision attack. This posed a greater threat due to the removal of the most important technical limitation. Finally, we refined our attack in 2008 and used it to construct a rogue Certification Authority, thereby demonstrating a serious vulnerability in internet security. Our demonstration convinced Microsoft and various governments to raise the security standards for Certification Authorities, by disallowing the use of MD5-based signatures effective 15 January 2009.
Flame was probably deployed around February 2010 and the practical attack was announced May 2007, giving 2.5 years for finding a variant and make and debug the malware. Seems reasonable if you have good cryptographers and development team, since the collision is fairly well contained functionality that doesn't block other parts of the project.
Generally I would reserve the term "magic" for secret crypto that is better than state of the art, a new variant of state of the art is simply impressive.
[0]: https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-...
DES also defended against a technique that wasn’t developed in the public until two decades later. That technique was originally developed at IBM and NSA merely convinced them to keep it secret, so I’m not sure how that qualifies.
Edit: Schneier has written about these before, of course. I wonder if his point here is not that the NSA was always boring, but rather that its lead is way less impressive than it once was.