Hacker News Reader

So Assange, who has actually developed part of Truecrypt, doesn't understand encryption. In that case I wonder what the rest of the tc team is smoking to let him contribute :p

The use of AES is clever. It will be crackable at some point in the future for sure - everyone knows this. I'd be willing to put 20 bucks on NSA already having cracked it anyway, even if that makes me one of those tinfoil hat types, but that would make no difference to Wikileaks - in fact it probably plays into Wikileaks' hands.

The fact that the insurance file probably -will- be cracked at some point in the future means that the information will ultimately be public. Perhaps this encourages more prompt action against Assange but it's a matter of weighing up this risk with the perhaps higher priority of eventually releasing the information - even if every mechanism of distributing the key in case of emergency fails, it will be cracked ONE day. I think this strategy is easily plausible enough.

One could claim that Assange's strategy is poor - certainly being under house arrest hasn't been empowering - but saying Assange is ignorant of encryption is ridiculous.

Hell, it would not have even been a bad idea for Assange to send them a copy of the key when he initially released the insurance file. If the insurance file has anything of substance, it would work better if they know what is in it. Giving them the key would be giving them proof that you are not bluffing.

To anyone reading this, please note that while some of beloch's points are valid, the analysis of AES and the breakability thereof is not. While it's true that at some point it's likely that AES will be broken, it's also true that at some point our solar system will be destroyed.

OTP is theoretically unbreakable, but that would require a key that is as long as the ciphertext, at which point Mr Assange can just keep the data on the USB stick around his neck.

Yeah, the whole point of distributing huge "insurance" data in an encrypted form is that the key is tiny. It's possible to maybe censor distribution of a 10GB file, at least generally, but it would be exceedingly difficult to prevent distribution of a 128-256 bit key. Literally you could shout it from the rooftops.

Nothing remains sensitive forever. It's likely everything in the "insurance file" would be public and mainly of interest to historians in 50-100 years, even without Assange. Most sensitive information in government ceases to be sensitive once everyone involved in the decision-making process is dead, and almost all of it is only operationally sensitive or for the lifetime of a piece of technology or particular source.

I mean, if we found out incontrovertible proof about the USS Maine or Gulf of Tonkin being engineered casus belli, who would really care?

It may be sensitive, but have you ever tried to put in an FOI request for anything. The entire process is marred by bureaucracy. Wikileaks would have a role to play even if there were no classification system. Don't underestimate how hard it is to get a good historical record :-)

I actually supported Wikileaks (and thank god didn't donate!) back when they were publicizing public-but-not-popular information, like about corporate malfeasance, public government documents, etc. Which is partially why I'm so pissed at Julian Assange for hijacking it into a largely anti-US agenda. ("Collateral Murder" had a really obvious spin when released, which was intentional; if they'd just dropped the video without commentary it would have been much more defensible.) Obviously I'm also against the illegal disclosure of any sensitive or classified government data; the correct recourse for someone like PFC Manning is to bring issues up through the chain of command, and if that fails, to the IG, and failing that, to Congress or the judicial system.

"if they'd just dropped the video without commentary it would have been much more defensible."

Have you seen the video? It has no commentary. It has subtitles. It has title screens. No commentary. https://www.youtube.com/watch?v=5rXPrfnU3G0

And how does that video have an anti-US agenda? It's recorded by US soldiers, it's illuminating a particular act on a particular day.

I think the public has a right to know, history has a right to know what goes on in Iraq.

> AES is based on factoring.

And you say _he_ doesn't understand cryptography?

I'm not in classical crypto, so I occasionally mess up and call algorithms based on computational difficult "based on factoring". The end result is the same though. Publication with delay.

RSA and AES are wildly different animals. You break RSA by factoring very large numbers. Currently this is done with GNFS, which is steadily improving. Theoretically, it may also be possible to do it much faster. Nobody brute forces RSA.

In order to crack AES though you need to either brute force it (which you will never do. Not that many bits, just forget about it.) Or you need a cryptanalytic attack that allows you to do it with reasonable computation and memory complexity. An attack that is currently unknown.

But surely such an attack could conceivably appear.. so what is the difference? The difference is that while RSA is a ticking clock (worse case scenario: slap on another ~256 bits to "factor-able" every 5 to 10 years), AES is only a ticking clock in the sense that we cannot rule out the possibility that one day it may start to tick.

If anyone in the world can crack AES, or will be able to crack AES anytime soon, it's the NSA, And it does not matter to Assange if they can crack it (unless the entire insurance file is a bluff).

AES was and is absolutely the correct choice for an insurance file. (I believe this is about when tptacek steps in, correctly calls me an idiot, and points out that another symmetric key cipher is a better choice.)

The NSA doesn't use code it can't crack...

AES is broken on-the-fly now.

Even if information is encrypted. They now just store EVERYTHING indefinitely until they can crack it.

Makes you wonder if in the future, when they crack your encrypted content if your grandchildren will get a visit...

The nazi's did that kind of thing too...

The problem with one-time pads, is that they require a password with the same length as the data you want to encrypt. That mean, if you don't pre-distrubute the key as well, you are in the same boat as if you don't distribute anything at all. To give everyone the one-time pad key, its the same trouble as sending the actually data unencrypted to everyone. As a threat value, pre-releasing xor'ed data has exactly zero value.

One could suggest that he could use something semi-random but well published information instead of random generated blob for a one-time pad. Earth rotational speed, stock market numbers, intensity of the sun radiation comes to mind. In that case, the password would be the exact dates to take data from, something that could be spread faster than gigs of data. The problem with this is, as soon people start to use it, people would start testing those data to decrypt with, and the key-size essentially becomes the size of time ranges of existing data.

True.

A one-time pad as a consumer encryption has yet to be realized though, even though the programming effort needed to create a system like this is low. It's even easier to use such a system in todays world of 64 GB USB drives. (64 GB could be used as a key for almost a life-time of text correspondance.)

What the public would benefit from is a system that works as follows:

- Program has a create key mode. Lets you specify key size, or use the rest of the capacity (eg. a full thumb stick).

- Creates two of these files (one for each participant).

- Has a simple interface for encrypting/decrypting content based on the key file.

- Each message is prefixed with the offset of the file

- Party 1 starts at the beginning of the file. Party 2 at the end of the file. In order to avoid resending data using the same offset. When they get close to overlapping in the middle, they create a new key.

> If he used a one-time-pad (Vernam cipher) and kept the key on his person he'd be in a far better position, but he's apparently too stupid to do this. How do you use a one-time pad?

A 1.4 GB key... Yeahhhhhh, very practical.

edit: and btw I hope you're also confident on the quality of your RNG to output 1.4 GB of random bytes.

I don't get it. You seem to be inferring that it's impractical to store a couple of gigabytes on your person.

It is difficult to store a couple of gigabytes, withstand a potentially intrusive search incident to arrest or intelligence action (i.e. on the Gulfstream, wearing a hood...) without that data being found or destroyed or removed from your control, and then widely disseminate that information while held in detention, potentially incommunicado, etc.

I've changed my mind.

The problem isn't with storing that 1.4 GB, it's with distributing it quickly to very many people.

Something much smaller is just a copy-pastable string that'll find its way into Wikipedia edit summaries or onto t-shirts or whatever.

a) No one time pad is used, because that would make the whole point of publishing the encrypted blob pointless in the first place. The point of publishing it is that the key could be published very easily in an emergency, e.g. using a tweet. If the one time pad key has to be published, he could just keep the data to himself and publish it unencrypted later. Pretty pointless.

b) The argument about deferred encryption may be correct. However this is not related to the relations between Wikileaks and any government. (The argument may also be wrong. It could turn out that decrypting AES is still hard even in 100 years. In any case it is likely to be safe until the data is de-classified anyway.)

Did you just s/RSA/AES/ ?

And you are suggesting he use a OTP?

Assange is not the one that does not know anything about cryptography here.

Distributing a OTP encrypted ciphertext ahead of time doesn't accomplish anything because the ciphertext can be translated into any plaintext you want by choosing the correct key.

A practical demonstration of this BTW (in scala):

  def otp(s: String, key: String): String = {
    def base64decode(s: String): String = {
      new String(new sun.misc.BASE64Decoder().decodeBuffer(s))
    }
    def xor(a: Char, b: Char): Char = (a ^ b).toChar

    val s2 = base64decode(s)
    val k2 = base64decode(key)

    val sb = new StringBuilder()
    for (i <- 0 to s2.length - 1) {
      sb.append(xor(s2(i), k2(i)))
    }
    sb.toString
  }

  val ciphertext = "LQcGRC0HFR4ME0sjHhkOHBVSGB0ZGhIcWRUPQgsNFkYIHwdE"

  val key1 = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXphYmNkZWZnaGlq"
  val key2 = "eW9jZF5vemoscCpOezlobno/OGlxfzJ7K3R8MXItfShnaGtq"

  otp(ciphertext, key1)
  otp(ciphertext, key2)

So releasing the ciphertext into the wild accomplishes nothing.

You're talking about the Insurance Files, right? Why would Assange give a toss if the government decrypted that? Its their stuff in the first place. Also, the Insurance Files were an exception to the way Wikileaks usually did business, not a demonstration of their typical use of encryption.

What use would a one-time-pad be with the only key around his neck when he got arrested? He needed a dead-mans-handle type arrangement.

There are lots of things that can be claimed about Assange, but claiming that he doesn't know encryption is not one of them.

ref: http://en.wikipedia.org/wiki/WikiLeaks#Insurance_files

so the purpose of the whole scheme is so that you can publish a very small amount of information that would decrypt the entire blob. a key has these properties.

the 'key' in this case would be a multi-gb random document. how do you publish this quickly?

Your politics is broken too. Publishing with a delay would mean "no use going after wikileaks, it's already out there". Keeping the key would mean "if we close them down, it's over". Given the delay to crack AES might be far longer than it takes stuff to emerge anyhow as declassified obsolete history, that's as good as keeping the key. And they have gone after wikileaks.

In your scheme, the random key is as large as the message. It would be pointless to publish the ciphertext.

If someone figures out how to crack AES or how to factor very efficiently, leaks will be the least of our problems.